NAME
REVOKE - 删除访问权限
SYNOPSIS
REVOKE [ GRANT OPTION FOR ]
{ { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER }
[,...] | ALL [ PRIVILEGES ] }
ON [ TABLE ] tablename [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ { CREATE | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }
ON DATABASE dbname [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ EXECUTE | ALL [ PRIVILEGES ] }
ON FUNCTION funcname ([type, ...]) [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ USAGE | ALL [ PRIVILEGES ] }
ON LANGUAGE langname [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
ON SCHEMA schemaname [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
DESCRIPTION 描述
REVOKE 撤销以前赋予（别人）的权限，可以是撤销一个或多个用户或者一组用户的权限。 关键字 PUBLIC 代表隐含定义的拥有所有用户的组。
参阅 GRANT [grant(7)] 命令的描述获取权限类型的含义。
请注意，任何特定的用户都将拥有直接赋予他/她的权限，加上他/她所处的任何组， 以及再加上赋予 PUBLIC 的权限的总和。因此，举例来说，废止 PUBLIC 的 SELECT 权限并不意味着所有用户都失去了对该对象的 SELECT 权限： 那些直接得到权限赋予的以及通过一个组得到权限的人仍然拥有该权限。
如果声明了 GRANT OPTION FOR，那么只是撤销对该权限的授权的权力，而不是撤销该权限本身。
如果一个用户持有某项权限，并且还有授权的选项，并且还把这个权限赋予了其他用户， 那么那些其他用户持有的权限都叫做依赖性权限。 如果第一个用户持有的权限或者授权选项被撤销，而依赖性权限仍然存在， 那么如果我们声明了 CASCADE，则所有依赖性权限都被撤销， 否则撤销动作就会失败。这个递规的撤销只影响那种通过一个用户链赋予的权限， 这个链条可以通过这条 REVOKE 命令里面给出的用户追踪。 因此，如果权限本身是通过其他用户赋予的， 那么被影响的用户可以有效地保留这个权限。
NOTES 注意
使用 psql(1) 的 \z 命令显示在一个现存对象上赋予的权限。 参见 GRANT [grant(7)] 获取关于格式的信息。
一个用户只能撤销由它自己直接赋予的权限。举例来说，如果用户 A 带着授权选项吧一个权限赋予了用户 B，然后用户 B 又赋予了用户 C， 那么用户 A 不能直接将 C 的权限撤销。但是，用户 A 可以撤销用户 B 的授权选项，并且使用 CASCADE 选项，这样， 用户 C 的权限就会自动被撤销。
如果一个超级用户发出一个 GRANT 或者 REVOKE 命令， 那么命令是按照以被影响的对象的所有者执行的方式执行的。因为所有权限最终从对象所有者（可能间接通过赋权选项获取）， 超级用户可以废除所有权限，但是这样就要求像上面说的那样使用 CASCADE。
EXAMPLES 例子
撤销公众在表 films 上的插入权限：
REVOKE INSERT ON films FROM PUBLIC;
废除用户 manuel 对视图 kinds 的所有权限：
REVOKE ALL PRIVILEGES ON kinds FROM manuel;
COMPATIBILITY 兼容性
GRANT [grant(7)] 命令的兼容性信息基本上也适用于 REVOKE。语法概要是：
REVOKE [ GRANT OPTION FOR ] privileges
ON object [ ( column [, ...] ) ]
FROM { PUBLIC | username [, ...] }
{ RESTRICT | CASCADE }
标准要求 RESTRICT 或者 CASCADE 之一必须出现， 但是 PostgreSQL 假设缺省是 RESTRICT。
SEE ALSO 参见
GRANT [grant(7)]
#p#
NAME
REVOKE - remove access privileges
SYNOPSIS
REVOKE [ GRANT OPTION FOR ]
{ { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER }
[,...] | ALL [ PRIVILEGES ] }
ON [ TABLE ] tablename [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ { CREATE | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }
ON DATABASE dbname [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ EXECUTE | ALL [ PRIVILEGES ] }
ON FUNCTION funcname ([type, ...]) [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ USAGE | ALL [ PRIVILEGES ] }
ON LANGUAGE langname [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
ON SCHEMA schemaname [, ...]
FROM { username | GROUP groupname | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
DESCRIPTION
The REVOKE command revokes previously granted privileges from one or more users or groups of users. The key word PUBLIC refers to the implicitly defined group of all users.
See the description of the GRANT [grant(7)] command for the meaning of the privilege types.
Note that any particular user will have the sum of privileges granted directly to him, privileges granted to any group he is presently a member of, and privileges granted to PUBLIC. Thus, for example, revoking SELECT privilege from PUBLIC does not necessarily mean that all users have lost SELECT privilege on the object: those who have it granted directly or via a group will still have it.
If GRANT OPTION FOR is specified, only the grant option for the privilege is revoked, not the privilege itself.
If a user holds a privilege with grant option and has granted it to other users then the privileges held by those other users are called dependent privileges. If the privilege or the grant option held by the first user is being revoked and dependent privileges exist, those dependent privileges are also revoked if CASCADE is specified, else the revoke action will fail. This recursive revocation only affects privileges that were granted through a chain of users that is traceable to the user that is the subject of this REVOKE command. Thus, the affected users may effectively keep the privilege if it was also granted through other users.
NOTES
Use psql(1)'s \z command to display the privileges granted on existing objects. See also GRANT [grant(7)] for information about the format.
A user can only revoke privileges that were granted directly by that user. If, for example, user A has granted a privilege with grant option to user B, and user B has in turned granted it to user C, then user A cannot revoke the privilege directly from C. Instead, user A could revoke the grant option from user B and use the CASCADE option so that the privilege is automatically revoked from user C.
If a superuser chooses to issue a GRANT or REVOKE command, the command is performed as though it were issued by the owner of the affected object. Since all privileges ultimately come from the object owner (possibly indirectly via chains of grant options), it is possible for a superuser to revoke all privileges, but this may require use of CASCADE as stated above.
EXAMPLES
Revoke insert privilege for the public on table films:
REVOKE INSERT ON films FROM PUBLIC;
Revoke all privileges from user manuel on view kinds:
REVOKE ALL PRIVILEGES ON kinds FROM manuel;
COMPATIBILITY
The compatibility notes of the GRANT [grant(7)] command apply analogously to REVOKE. The syntax summary is:
REVOKE [ GRANT OPTION FOR ] privileges
ON object [ ( column [, ...] ) ]
FROM { PUBLIC | username [, ...] }
{ RESTRICT | CASCADE }
One of RESTRICT or CASCADE is required according to the standard, but PostgreSQL assumes RESTRICT by default.
SEE ALSO
GRANT [grant(7)]
