REVOKE
Removes access privileges.
Synopsis
REVOKE [GRANT OPTION FOR]
{ {SELECT | INSERT | UPDATE | DELETE | REFERENCES | TRIGGER | TRUNCATE }
[, ...] | ALL [PRIVILEGES] }
ON { { [TABLE] [[[ONLY] <table_name> [, ...]] [, ...]] }
| ALL TABLES IN SCHEMA schema_name [, ...] }
FROM <role_specification> [, ...]
[CASCADE | RESTRICT]
REVOKE [ GRANT OPTION FOR ]
{ { SELECT | INSERT | UPDATE | REFERENCES } ( <column_name> [, ...] )
[, ...] | ALL [ PRIVILEGES ] ( <column_name> [, ...] ) }
ON { [ [TABLE] [[[ONLY] <table_name> [, ...]] [, ...]] }
FROM <role_specification> [, ...]
[ CASCADE | RESTRICT ]
REVOKE [GRANT OPTION FOR] { {USAGE | SELECT | UPDATE} [,...]
| ALL [PRIVILEGES] }
ON { SEQUENCE <sequence_name> [, ...]
| ALL SEQUENCES IN SCHEMA schema_name [, ...] }
FROM <role_specification> [, ...]
[CASCADE | RESTRICT]
REVOKE [GRANT OPTION FOR]
{ {CREATE | CONNECT | TEMPORARY | TEMP} [, ...] | ALL [PRIVILEGES] }
ON DATABASE <database_name> [, ...]
FROM <role_specification> [, ...]
[CASCADE | RESTRICT]
REVOKE [ GRANT OPTION FOR ]
{ USAGE | ALL [ PRIVILEGES ] }
ON DOMAIN <domain_name> [, ...]
FROM <role_specification> [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ USAGE | ALL [ PRIVILEGES ] }
ON FOREIGN DATA WRAPPER <fdw_name> [, ...]
FROM <role_specification> [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ USAGE | ALL [ PRIVILEGES ] }
ON FOREIGN SERVER <server_name> [, ...]
FROM <role_specification> [, ...]
[ CASCADE | RESTRICT ]
REVOKE [GRANT OPTION FOR] {EXECUTE | ALL [PRIVILEGES]}
ON { { FUNCTION | PROCEDURE | ROUTINE } <funcname> [( [[<argmode>] [<argname>] <argtype> [, ...]] )] [, ...]
| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schema_name [, ...] }
FROM <role_specification> [, ...]
[CASCADE | RESTRICT]
REVOKE [GRANT OPTION FOR] {USAGE | ALL [PRIVILEGES]}
ON LANGUAGE <lang_name> [, ...]
FROM <role_specification> [, ...]
[ CASCADE | RESTRICT ]
REVOKE [GRANT OPTION FOR] { {CREATE | USAGE} [, ...] | ALL [PRIVILEGES] }
ON SCHEMA <schema_name> [, ...]
FROM <role_specification> [, ...]
[CASCADE | RESTRICT]
REVOKE [GRANT OPTION FOR] { CREATE | ALL [PRIVILEGES] }
ON TABLESPACE <tablespace_name> [, ...]
FROM <role_specification> [, ...]
[CASCADE | RESTRICT]
REVOKE [ GRANT OPTION FOR ]
{ USAGE | ALL [ PRIVILEGES ] }
ON TYPE <type_name> [, ...]
FROM <role_specification> [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ADMIN OPTION FOR] <role_name> [, ...]
FROM [ GROUP ] <role_specification> [, ...]
[GRANTED BY <role_specification> ]
[CASCADE | RESTRICT]
-- where <role_specification> can be:
[ GROUP ] <role_name>
| PUBLIC
| CURRENT_USER
| SESSION_USER
Description
REVOKE
command revokes previously granted privileges from one or more roles. The key word PUBLIC
refers to the implicitly defined group of all roles.
See the description of the GRANT command for the meaning of the privilege types.
Note that any particular role will have the sum of privileges granted directly to it, privileges granted to any role it is presently a member of, and privileges granted to PUBLIC
. Thus, for example, revoking SELECT
privilege from PUBLIC
does not necessarily mean that all roles have lost SELECT
privilege on the object: those who have it granted directly or via another role will still have it. Similarly, revoking SELECT
from a user might not prevent that user from using SELECT
if PUBLIC
or another membership role still has SELECT
rights.
If GRANT OPTION FOR
is specified, only the grant option for the privilege is revoked, not the privilege itself. Otherwise, both the privilege and the grant option are revoked.
If a role holds a privilege with grant option and has granted it to other roles then the privileges held by those other roles are called dependent privileges. If the privilege or the grant option held by the first role is being revoked and dependent privileges exist, those dependent privileges are also revoked if CASCADE
is specified, else the revoke action will fail. This recursive revocation only affects privileges that were granted through a chain of roles that is traceable to the role that is the subject of this REVOKE
command. Thus, the affected roles may effectively keep the privilege if it was also granted through other roles.
When you revoke privileges on a table, Apache Cloudberry revokes the corresponding column privileges (if any) on each column of the table, as well. On the other hand, if a role has been granted privileges on a table, then revoking the same privileges from individual columns will have no effect.
By default, when you revoke privileges on a partitioned table, Apache Cloudberry recurses the operation to its child tables. To direct Apache Cloudberry to perform the REVOKE
on the partitioned table only, specify the ONLY <table_name>
clause.
When revoking membership in a role, GRANT OPTION
is instead called ADMIN OPTION
, but the behavior is similar. This form of the command also allows a GRANTED BY
option, but that option is currently ignored (except for checking the existence of the named role). Note also that this form of the command does not allow the noise word GROUP
in role_specification.
Parameters
See GRANT.