NAME

REVOKE - 刪除訪問(wèn)權(quán)限

SYNOPSIS

REVOKE [ GRANT OPTION FOR ]
    { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER }
    [,...] | ALL [ PRIVILEGES ] }
    ON [ TABLE ] tablename [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { CREATE | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }
    ON DATABASE dbname [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { EXECUTE | ALL [ PRIVILEGES ] }
    ON FUNCTION funcname ([type, ...]) [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { USAGE | ALL [ PRIVILEGES ] }
    ON LANGUAGE langname [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
    ON SCHEMA schemaname [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

DESCRIPTION 描述

REVOKE 撤銷(xiāo)以前賦予（別人）的權(quán)限，可以是撤銷(xiāo)一個(gè)或多個(gè)用戶或者一組用戶的權(quán)限。 關(guān)鍵字 PUBLIC 代表隱含定義的擁有所有用戶的組。

 參閱 GRANT [grant(7)] 命令的描述獲取權(quán)限類型的含義。

 請(qǐng)注意，任何特定的用戶都將擁有直接賦予他/她的權(quán)限，加上他/她所處的任何組， 以及再加上賦予 PUBLIC 的權(quán)限的總和。因此，舉例來(lái)說(shuō)，廢止 PUBLIC  的 SELECT 權(quán)限并不意味著所有用戶都失去了對(duì)該對(duì)象的 SELECT 權(quán)限： 那些直接得到權(quán)限賦予的以及通過(guò)一個(gè)組得到權(quán)限的人仍然擁有該權(quán)限。

 如果聲明了 GRANT OPTION FOR，那么只是撤銷(xiāo)對(duì)該權(quán)限的授權(quán)的權(quán)力，而不是撤銷(xiāo)該權(quán)限本身。

 如果一個(gè)用戶持有某項(xiàng)權(quán)限，并且還有授權(quán)的選項(xiàng)，并且還把這個(gè)權(quán)限賦予了其他用戶， 那么那些其他用戶持有的權(quán)限都叫做依賴性權(quán)限。 如果第一個(gè)用戶持有的權(quán)限或者授權(quán)選項(xiàng)被撤銷(xiāo)，而依賴性權(quán)限仍然存在， 那么如果我們聲明了 CASCADE，則所有依賴性權(quán)限都被撤銷(xiāo)， 否則撤銷(xiāo)動(dòng)作就會(huì)失敗。這個(gè)遞規(guī)的撤銷(xiāo)只影響那種通過(guò)一個(gè)用戶鏈賦予的權(quán)限， 這個(gè)鏈條可以通過(guò)這條 REVOKE 命令里面給出的用戶追蹤。 因此，如果權(quán)限本身是通過(guò)其他用戶賦予的， 那么被影響的用戶可以有效地保留這個(gè)權(quán)限。  

NOTES 注意

 使用 psql(1) 的 \z 命令顯示在一個(gè)現(xiàn)存對(duì)象上賦予的權(quán)限。 參見(jiàn) GRANT [grant(7)] 獲取關(guān)于格式的信息。

 一個(gè)用戶只能撤銷(xiāo)由它自己直接賦予的權(quán)限。舉例來(lái)說(shuō)，如果用戶 A 帶著授權(quán)選項(xiàng)吧一個(gè)權(quán)限賦予了用戶 B，然后用戶 B 又賦予了用戶 C， 那么用戶 A 不能直接將 C 的權(quán)限撤銷(xiāo)。但是，用戶 A 可以撤銷(xiāo)用戶 B 的授權(quán)選項(xiàng)，并且使用 CASCADE 選項(xiàng)，這樣， 用戶 C 的權(quán)限就會(huì)自動(dòng)被撤銷(xiāo)。

 如果一個(gè)超級(jí)用戶發(fā)出一個(gè) GRANT 或者 REVOKE 命令， 那么命令是按照以被影響的對(duì)象的所有者執(zhí)行的方式執(zhí)行的。因?yàn)樗袡?quán)限最終從對(duì)象所有者（可能間接通過(guò)賦權(quán)選項(xiàng)獲?。?， 超級(jí)用戶可以廢除所有權(quán)限，但是這樣就要求像上面說(shuō)的那樣使用 CASCADE。  

EXAMPLES 例子

 撤銷(xiāo)公眾在表 films 上的插入權(quán)限：

REVOKE INSERT ON films FROM PUBLIC;

 廢除用戶 manuel 對(duì)視圖 kinds 的所有權(quán)限：

  
REVOKE ALL PRIVILEGES ON kinds FROM manuel;

COMPATIBILITY 兼容性

GRANT [grant(7)] 命令的兼容性信息基本上也適用于 REVOKE。語(yǔ)法概要是：

REVOKE [ GRANT OPTION FOR ] privileges
    ON object [ ( column [, ...] ) ]
    FROM { PUBLIC | username [, ...] }
    { RESTRICT | CASCADE }

 標(biāo)準(zhǔn)要求 RESTRICT 或者 CASCADE 之一必須出現(xiàn)， 但是 PostgreSQL 假設(shè)缺省是 RESTRICT。  

SEE ALSO 參見(jiàn)

GRANT [grant(7)]  

#p#

NAME

REVOKE - remove access privileges

SYNOPSIS

REVOKE [ GRANT OPTION FOR ]
    { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER }
    [,...] | ALL [ PRIVILEGES ] }
    ON [ TABLE ] tablename [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { CREATE | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }
    ON DATABASE dbname [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { EXECUTE | ALL [ PRIVILEGES ] }
    ON FUNCTION funcname ([type, ...]) [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { USAGE | ALL [ PRIVILEGES ] }
    ON LANGUAGE langname [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
    ON SCHEMA schemaname [, ...]
    FROM { username | GROUP groupname | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

DESCRIPTION

The REVOKE command revokes previously granted privileges from one or more users or groups of users. The key word PUBLIC refers to the implicitly defined group of all users.

See the description of the GRANT [grant(7)] command for the meaning of the privilege types.

Note that any particular user will have the sum of privileges granted directly to him, privileges granted to any group he is presently a member of, and privileges granted to PUBLIC. Thus, for example, revoking SELECT privilege from PUBLIC does not necessarily mean that all users have lost SELECT privilege on the object: those who have it granted directly or via a group will still have it.

If GRANT OPTION FOR is specified, only the grant option for the privilege is revoked, not the privilege itself.

If a user holds a privilege with grant option and has granted it to other users then the privileges held by those other users are called dependent privileges. If the privilege or the grant option held by the first user is being revoked and dependent privileges exist, those dependent privileges are also revoked if CASCADE is specified, else the revoke action will fail. This recursive revocation only affects privileges that were granted through a chain of users that is traceable to the user that is the subject of this REVOKE command. Thus, the affected users may effectively keep the privilege if it was also granted through other users.  

NOTES

Use psql(1)'s \z command to display the privileges granted on existing objects. See also GRANT [grant(7)] for information about the format.

A user can only revoke privileges that were granted directly by that user. If, for example, user A has granted a privilege with grant option to user B, and user B has in turned granted it to user C, then user A cannot revoke the privilege directly from C. Instead, user A could revoke the grant option from user B and use the CASCADE option so that the privilege is automatically revoked from user C.

If a superuser chooses to issue a GRANT or REVOKE command, the command is performed as though it were issued by the owner of the affected object. Since all privileges ultimately come from the object owner (possibly indirectly via chains of grant options), it is possible for a superuser to revoke all privileges, but this may require use of CASCADE as stated above.  

EXAMPLES

Revoke insert privilege for the public on table films:

REVOKE INSERT ON films FROM PUBLIC;

Revoke all privileges from user manuel on view kinds:

  
REVOKE ALL PRIVILEGES ON kinds FROM manuel;

COMPATIBILITY

The compatibility notes of the GRANT [grant(7)] command apply analogously to REVOKE. The syntax summary is:

REVOKE [ GRANT OPTION FOR ] privileges
    ON object [ ( column [, ...] ) ]
    FROM { PUBLIC | username [, ...] }
    { RESTRICT | CASCADE }

One of RESTRICT or CASCADE is required according to the standard, but PostgreSQL assumes RESTRICT by default.  

SEE ALSO

GRANT [grant(7)]