1
- == Overview ==
1
+ # Overview
2
2
3
3
We have a postgres server for a shared hosting environment, or an
4
4
organization with semi-autonomous business units. For the rest of the
@@ -24,7 +24,7 @@ I believe these constraints can be demonstrated with only two groups:
24
24
the admins (us), and customer's developers. If I've made a mistake, it
25
25
will have to be amended with an additional customer (and group).
26
26
27
- == Running the Tests ==
27
+ # Running the Tests
28
28
29
29
These two tests will create system and postgres users on your
30
30
machine. They are designed to run as root, with local trust
@@ -34,7 +34,31 @@ They should clean up after themselves, and I don't think they'll
34
34
damage anything, but you'd be nuts to run the scripts without reading
35
35
what they do first.
36
36
37
- == Groups ==
37
+ To run the tests, simply 'cd' into the directory, and run the scripts
38
+ in order. On my machine, this is how the filesystem tests (POSIX ACL
39
+ support required) are run:
40
+
41
+ ``` Bash
42
+ sudo ./01-create-actors.sh
43
+ sudo ./02-create-acls.sh
44
+ sudo ./03-run-tests.sh
45
+ sudo ./04-add-new-user-and-retest.sh
46
+ sudo ./05-destroy-actors.sh
47
+ ```
48
+
49
+ There's no output, which means that the test succeeded. The postgres
50
+ test, on the other hand, fails at step #4 :
51
+
52
+ ``` Bash
53
+ sudo ./01-create-actors.sh
54
+ sudo ./02-create-permissions.sh
55
+ sudo ./03-run-tests.sh
56
+ sudo ./04-add-new-user-and-retest.sh
57
+ ERROR: alice can' t modify dba2' s table.
58
+ sudo ./05-destroy-actors.sh
59
+ ```
60
+
61
+ # Groups
38
62
39
63
We will use a few groups to illustrate the requirements.
40
64
@@ -49,7 +73,7 @@ We will use a few groups to illustrate the requirements.
49
73
DBAs). They should be able to access anything in their own
50
74
databases.
51
75
52
- == Users ==
76
+ # Users
53
77
54
78
The following users will be used to illustrate the examples.
55
79
@@ -79,9 +103,9 @@ The following users will be used to illustrate the examples.
79
103
Another customer employee. Everything he creates in one of their
80
104
databases should be writable by alice and vice-versa.
81
105
82
- == Filesystem Examples ==
106
+ # Filesystem Examples
83
107
84
- === Windows ===
108
+ ## Windows
85
109
86
110
In Windows, to accomplish everything above, you only need to create
87
111
those three groups. When you create a new directory for the customer,
92
116
3 . Replace all entries on child objects with the default (in case
93
117
the directory was non-empty).
94
118
95
- === Unix ===
119
+ ## Unix
96
120
97
121
With Linux, it's a little more work to meet the full requirements. The
98
122
setgid strategy will fall apart if you have more than one group with
@@ -117,9 +141,9 @@ thing. When you create a new directory for the customer,
117
141
118
142
If the directory is non-empty here, find/xargs can be used.
119
143
120
- == Database Examples ==
144
+ # Database Examples
121
145
122
- === Microsoft SQL Server ===
146
+ ## Microsoft SQL Server
123
147
124
148
This sort of arrangement can be achieved easily in MSSQL, although
125
149
there are three different ways to do it.
@@ -134,7 +158,7 @@ roles at the server level. Then it's no more difficult than with AD
134
158
logins: right click on the database, hit properties, and grant
135
159
permissions to the (server-level) role.
136
160
137
- === Postgres ===
161
+ ## Postgres
138
162
139
163
Postgres has no (obvious?) way to achieve this. The closest I was able
140
164
to come can be found in the pg-tests/02-create-permissions.sh file. It
0 commit comments