ClickHouse/docs/en/sql-reference/statements/revoke.md

49 lines
1.6 KiB
Markdown
Raw Normal View History

Merges RBAC statements reference with RBAC introduction (#96) * CLICKHOUSEDOCS-559: Started to describe GRANT * CLICKHOUSEDOCS-559: Added headers for some other kinds of quries. * CLICKHOUSEDOCS-559: Further edits. * CLICKHOUSEDOCS-559: Updated grant description. * CLICKHOUSEDOCS-559: The first version for the GRANT statement is finished. * CLICKHOUSEDOCS-559: Almost finished CREATE USER * CLICKHOUSEDOCS-559: Finished the first version of CREATE queries. * CLICKHOUSEDOCS-559: Finished ALTER, DROP and SET. * CLICKHOUSEDOCS-559: Finished the first version of statements. * CLICKHOUSEDOCS-559: Update by review. * CLICKHOUSEDOCS-559: Update by review. * Update docs/en/query_language/alter.md * Update docs/en/query_language/create.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update docs/en/query_language/grant.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update by comments. Also RBAC-7 aplied. * moved new files to new structure * Adopted added articles to a new structure. * CLICKHOUSEDOCS-559: Fixed links. * CLICKHOUSEDOCS-559: Links fix. * CLICKHOUSEDOCS-559: Updated privileges by RBAC-8 changes * CLICKHOUSEDOCS-559: Added CREATE, ALTER, DROP, and SHOW queries for QUOTAS and SETTINGS PROFILES. * CLICKHOUSEDOCS-559: Added ON CLUSTER for CREATE, ALTER, DROP. * CLICKHOUSEDOCS-559: Fixed code-blocks and the anchor. * CLICKHOUSEDOCS-559: Edits after the last portion of commentaries. * CLICKHOUSEDOCS-559: Changed example Co-authored-by: Sergei Shtykov <bayonet@yandex-team.ru> Co-authored-by: Ilya Yatsishin <2159081+qoega@users.noreply.github.com>
2020-04-09 14:02:39 +00:00
---
toc_priority: 40
toc_title: REVOKE
---
# REVOKE {#revoke}
Merges RBAC statements reference with RBAC introduction (#96) * CLICKHOUSEDOCS-559: Started to describe GRANT * CLICKHOUSEDOCS-559: Added headers for some other kinds of quries. * CLICKHOUSEDOCS-559: Further edits. * CLICKHOUSEDOCS-559: Updated grant description. * CLICKHOUSEDOCS-559: The first version for the GRANT statement is finished. * CLICKHOUSEDOCS-559: Almost finished CREATE USER * CLICKHOUSEDOCS-559: Finished the first version of CREATE queries. * CLICKHOUSEDOCS-559: Finished ALTER, DROP and SET. * CLICKHOUSEDOCS-559: Finished the first version of statements. * CLICKHOUSEDOCS-559: Update by review. * CLICKHOUSEDOCS-559: Update by review. * Update docs/en/query_language/alter.md * Update docs/en/query_language/create.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update docs/en/query_language/grant.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update by comments. Also RBAC-7 aplied. * moved new files to new structure * Adopted added articles to a new structure. * CLICKHOUSEDOCS-559: Fixed links. * CLICKHOUSEDOCS-559: Links fix. * CLICKHOUSEDOCS-559: Updated privileges by RBAC-8 changes * CLICKHOUSEDOCS-559: Added CREATE, ALTER, DROP, and SHOW queries for QUOTAS and SETTINGS PROFILES. * CLICKHOUSEDOCS-559: Added ON CLUSTER for CREATE, ALTER, DROP. * CLICKHOUSEDOCS-559: Fixed code-blocks and the anchor. * CLICKHOUSEDOCS-559: Edits after the last portion of commentaries. * CLICKHOUSEDOCS-559: Changed example Co-authored-by: Sergei Shtykov <bayonet@yandex-team.ru> Co-authored-by: Ilya Yatsishin <2159081+qoega@users.noreply.github.com>
2020-04-09 14:02:39 +00:00
Revokes privileges from users or roles.
## Syntax {#revoke-syntax}
**Revoking privileges from users**
``` sql
REVOKE [ON CLUSTER cluster_name] privilege[(column_name [,...])] [,...] ON {db.table|db.*|*.*|table|*} FROM {user | CURRENT_USER} [,...] | ALL | ALL EXCEPT {user | CURRENT_USER} [,...]
```
**Revoking roles from users**
``` sql
REVOKE [ON CLUSTER cluster_name] [ADMIN OPTION FOR] role [,...] FROM {user | role | CURRENT_USER} [,...] | ALL | ALL EXCEPT {user_name | role_name | CURRENT_USER} [,...]
```
## Description {#revoke-description}
To revoke some privilege you can use a privilege of a wider scope than you plan to revoke. For example, if a user has the `SELECT (x,y)` privilege, administrator can execute `REVOKE SELECT(x,y) ...`, or `REVOKE SELECT * ...`, or even `REVOKE ALL PRIVILEGES ...` query to revoke this privilege.
Merges RBAC statements reference with RBAC introduction (#96) * CLICKHOUSEDOCS-559: Started to describe GRANT * CLICKHOUSEDOCS-559: Added headers for some other kinds of quries. * CLICKHOUSEDOCS-559: Further edits. * CLICKHOUSEDOCS-559: Updated grant description. * CLICKHOUSEDOCS-559: The first version for the GRANT statement is finished. * CLICKHOUSEDOCS-559: Almost finished CREATE USER * CLICKHOUSEDOCS-559: Finished the first version of CREATE queries. * CLICKHOUSEDOCS-559: Finished ALTER, DROP and SET. * CLICKHOUSEDOCS-559: Finished the first version of statements. * CLICKHOUSEDOCS-559: Update by review. * CLICKHOUSEDOCS-559: Update by review. * Update docs/en/query_language/alter.md * Update docs/en/query_language/create.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update docs/en/query_language/grant.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update by comments. Also RBAC-7 aplied. * moved new files to new structure * Adopted added articles to a new structure. * CLICKHOUSEDOCS-559: Fixed links. * CLICKHOUSEDOCS-559: Links fix. * CLICKHOUSEDOCS-559: Updated privileges by RBAC-8 changes * CLICKHOUSEDOCS-559: Added CREATE, ALTER, DROP, and SHOW queries for QUOTAS and SETTINGS PROFILES. * CLICKHOUSEDOCS-559: Added ON CLUSTER for CREATE, ALTER, DROP. * CLICKHOUSEDOCS-559: Fixed code-blocks and the anchor. * CLICKHOUSEDOCS-559: Edits after the last portion of commentaries. * CLICKHOUSEDOCS-559: Changed example Co-authored-by: Sergei Shtykov <bayonet@yandex-team.ru> Co-authored-by: Ilya Yatsishin <2159081+qoega@users.noreply.github.com>
2020-04-09 14:02:39 +00:00
### Partial Revokes {#partial-revokes-dscr}
You can revoke a part of a privilege. For example, if a user has the `SELECT *.*` privilege you can revoke from it a privilege to read data from some table or a database.
## Examples {#revoke-example}
Grant the `john` user account with a privilege to select from all the databases, excepting the `accounts` one:
Merges RBAC statements reference with RBAC introduction (#96) * CLICKHOUSEDOCS-559: Started to describe GRANT * CLICKHOUSEDOCS-559: Added headers for some other kinds of quries. * CLICKHOUSEDOCS-559: Further edits. * CLICKHOUSEDOCS-559: Updated grant description. * CLICKHOUSEDOCS-559: The first version for the GRANT statement is finished. * CLICKHOUSEDOCS-559: Almost finished CREATE USER * CLICKHOUSEDOCS-559: Finished the first version of CREATE queries. * CLICKHOUSEDOCS-559: Finished ALTER, DROP and SET. * CLICKHOUSEDOCS-559: Finished the first version of statements. * CLICKHOUSEDOCS-559: Update by review. * CLICKHOUSEDOCS-559: Update by review. * Update docs/en/query_language/alter.md * Update docs/en/query_language/create.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update docs/en/query_language/grant.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update by comments. Also RBAC-7 aplied. * moved new files to new structure * Adopted added articles to a new structure. * CLICKHOUSEDOCS-559: Fixed links. * CLICKHOUSEDOCS-559: Links fix. * CLICKHOUSEDOCS-559: Updated privileges by RBAC-8 changes * CLICKHOUSEDOCS-559: Added CREATE, ALTER, DROP, and SHOW queries for QUOTAS and SETTINGS PROFILES. * CLICKHOUSEDOCS-559: Added ON CLUSTER for CREATE, ALTER, DROP. * CLICKHOUSEDOCS-559: Fixed code-blocks and the anchor. * CLICKHOUSEDOCS-559: Edits after the last portion of commentaries. * CLICKHOUSEDOCS-559: Changed example Co-authored-by: Sergei Shtykov <bayonet@yandex-team.ru> Co-authored-by: Ilya Yatsishin <2159081+qoega@users.noreply.github.com>
2020-04-09 14:02:39 +00:00
``` sql
GRANT SELECT ON *.* TO john;
REVOKE SELECT ON accounts.* FROM john;
```
Grant the `mira` user account with a privilege to select from all the columns of the `accounts.staff` table, excepting the `wage` one.
Merges RBAC statements reference with RBAC introduction (#96) * CLICKHOUSEDOCS-559: Started to describe GRANT * CLICKHOUSEDOCS-559: Added headers for some other kinds of quries. * CLICKHOUSEDOCS-559: Further edits. * CLICKHOUSEDOCS-559: Updated grant description. * CLICKHOUSEDOCS-559: The first version for the GRANT statement is finished. * CLICKHOUSEDOCS-559: Almost finished CREATE USER * CLICKHOUSEDOCS-559: Finished the first version of CREATE queries. * CLICKHOUSEDOCS-559: Finished ALTER, DROP and SET. * CLICKHOUSEDOCS-559: Finished the first version of statements. * CLICKHOUSEDOCS-559: Update by review. * CLICKHOUSEDOCS-559: Update by review. * Update docs/en/query_language/alter.md * Update docs/en/query_language/create.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update docs/en/query_language/grant.md Co-Authored-By: Ilya Yatsishin <2159081+qoega@users.noreply.github.com> * Update by comments. Also RBAC-7 aplied. * moved new files to new structure * Adopted added articles to a new structure. * CLICKHOUSEDOCS-559: Fixed links. * CLICKHOUSEDOCS-559: Links fix. * CLICKHOUSEDOCS-559: Updated privileges by RBAC-8 changes * CLICKHOUSEDOCS-559: Added CREATE, ALTER, DROP, and SHOW queries for QUOTAS and SETTINGS PROFILES. * CLICKHOUSEDOCS-559: Added ON CLUSTER for CREATE, ALTER, DROP. * CLICKHOUSEDOCS-559: Fixed code-blocks and the anchor. * CLICKHOUSEDOCS-559: Edits after the last portion of commentaries. * CLICKHOUSEDOCS-559: Changed example Co-authored-by: Sergei Shtykov <bayonet@yandex-team.ru> Co-authored-by: Ilya Yatsishin <2159081+qoega@users.noreply.github.com>
2020-04-09 14:02:39 +00:00
``` sql
GRANT SELECT ON accounts.staff TO mira;
REVOKE SELECT(wage) ON accounts.staff FROM mira;
```
2020-05-08 13:58:38 +00:00
{## [Original article](https://clickhouse.tech/docs/en/operations/settings/settings/) ##}