154 lines
8.5 KiB
SQL
154 lines
8.5 KiB
SQL
-- ============================================================================
|
|
-- Per-Module Schema Permissions
|
|
-- ============================================================================
|
|
-- Grants each module user access to their respective schema(s).
|
|
-- Users can only access tables in their designated schemas.
|
|
-- ============================================================================
|
|
|
|
-- ============================================================================
|
|
-- Authority Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA authority TO authority_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA authority TO authority_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA authority TO authority_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA authority GRANT ALL ON TABLES TO authority_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA authority GRANT ALL ON SEQUENCES TO authority_user;
|
|
|
|
-- ============================================================================
|
|
-- Concelier Module (uses 'vuln' schema)
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA vuln TO concelier_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA vuln TO concelier_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA vuln TO concelier_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA vuln GRANT ALL ON TABLES TO concelier_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA vuln GRANT ALL ON SEQUENCES TO concelier_user;
|
|
|
|
-- ============================================================================
|
|
-- Excititor Module (uses 'vex' schema)
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA vex TO excititor_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA vex TO excititor_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA vex TO excititor_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA vex GRANT ALL ON TABLES TO excititor_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA vex GRANT ALL ON SEQUENCES TO excititor_user;
|
|
|
|
-- ============================================================================
|
|
-- Scanner Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA scanner TO scanner_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA scanner TO scanner_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA scanner TO scanner_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA scanner GRANT ALL ON TABLES TO scanner_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA scanner GRANT ALL ON SEQUENCES TO scanner_user;
|
|
|
|
-- ============================================================================
|
|
-- Scheduler Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA scheduler TO scheduler_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA scheduler TO scheduler_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA scheduler TO scheduler_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA scheduler GRANT ALL ON TABLES TO scheduler_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA scheduler GRANT ALL ON SEQUENCES TO scheduler_user;
|
|
|
|
-- ============================================================================
|
|
-- TaskRunner Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA taskrunner TO taskrunner_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA taskrunner TO taskrunner_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA taskrunner TO taskrunner_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA taskrunner GRANT ALL ON TABLES TO taskrunner_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA taskrunner GRANT ALL ON SEQUENCES TO taskrunner_user;
|
|
|
|
-- ============================================================================
|
|
-- Policy Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA policy TO policy_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA policy TO policy_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA policy TO policy_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA policy GRANT ALL ON TABLES TO policy_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA policy GRANT ALL ON SEQUENCES TO policy_user;
|
|
|
|
-- ============================================================================
|
|
-- Unknowns Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA unknowns TO unknowns_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA unknowns TO unknowns_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA unknowns TO unknowns_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA unknowns GRANT ALL ON TABLES TO unknowns_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA unknowns GRANT ALL ON SEQUENCES TO unknowns_user;
|
|
|
|
-- ============================================================================
|
|
-- Attestor Module (uses 'proofchain' and 'attestor' schemas)
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA proofchain TO attestor_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA proofchain TO attestor_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA proofchain TO attestor_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA proofchain GRANT ALL ON TABLES TO attestor_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA proofchain GRANT ALL ON SEQUENCES TO attestor_user;
|
|
|
|
GRANT USAGE ON SCHEMA attestor TO attestor_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA attestor TO attestor_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA attestor TO attestor_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA attestor GRANT ALL ON TABLES TO attestor_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA attestor GRANT ALL ON SEQUENCES TO attestor_user;
|
|
|
|
-- ============================================================================
|
|
-- Signer Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA signer TO signer_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA signer TO signer_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA signer TO signer_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA signer GRANT ALL ON TABLES TO signer_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA signer GRANT ALL ON SEQUENCES TO signer_user;
|
|
|
|
-- ============================================================================
|
|
-- Notify Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA notify TO notify_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA notify TO notify_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA notify TO notify_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA notify GRANT ALL ON TABLES TO notify_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA notify GRANT ALL ON SEQUENCES TO notify_user;
|
|
|
|
-- ============================================================================
|
|
-- Signals Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA signals TO signals_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA signals TO signals_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA signals TO signals_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA signals GRANT ALL ON TABLES TO signals_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA signals GRANT ALL ON SEQUENCES TO signals_user;
|
|
|
|
-- ============================================================================
|
|
-- Packs Registry Module
|
|
-- ============================================================================
|
|
GRANT USAGE ON SCHEMA packs TO packs_user;
|
|
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA packs TO packs_user;
|
|
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA packs TO packs_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA packs GRANT ALL ON TABLES TO packs_user;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA packs GRANT ALL ON SEQUENCES TO packs_user;
|
|
|
|
-- ============================================================================
|
|
-- Verification
|
|
-- ============================================================================
|
|
DO $$
|
|
DECLARE
|
|
v_user TEXT;
|
|
v_schema TEXT;
|
|
BEGIN
|
|
RAISE NOTICE 'Per-module permissions granted:';
|
|
RAISE NOTICE ' authority_user -> authority';
|
|
RAISE NOTICE ' concelier_user -> vuln';
|
|
RAISE NOTICE ' excititor_user -> vex';
|
|
RAISE NOTICE ' scanner_user -> scanner';
|
|
RAISE NOTICE ' scheduler_user -> scheduler';
|
|
RAISE NOTICE ' taskrunner_user -> taskrunner';
|
|
RAISE NOTICE ' policy_user -> policy';
|
|
RAISE NOTICE ' unknowns_user -> unknowns';
|
|
RAISE NOTICE ' attestor_user -> proofchain, attestor';
|
|
RAISE NOTICE ' signer_user -> signer';
|
|
RAISE NOTICE ' notify_user -> notify';
|
|
RAISE NOTICE ' signals_user -> signals';
|
|
RAISE NOTICE ' packs_user -> packs';
|
|
END $$;
|