From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Michael.Dietrich@swisscom.com
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Connect to db denied for superuser inherited by group
Date: Fri, 16 Mar 2018 10:52:44 -0400
Message-ID: <19470.1521211964@sss.pgh.pa.us> (raw)
In-Reply-To: <20180316134234.GE2416@tamriel.snowman.net>
References: <b93d9993e79545ffaa54d440a6f4383f@swisscom.com>
<9cd041b2b19143758e4f4d8a752421c5@swisscom.com>
<20180316134234.GE2416@tamriel.snowman.net>
Stephen Frost <sfrost@snowman.net> writes:
> * Michael.Dietrich@swisscom.com (Michael.Dietrich@swisscom.com) wrote:
>> 2) User without superuser privileges uses a role with superuser rights (usage confirmed with SHOW current_role.)
> Please provide more details about what this step #2 actually means.
If you mean that you did "GRANT superuserrole TO nonsuperuser", this
does not make "nonsuperuser" into a superuser; it merely allows
"nonsuperuser" to use whatever ordinary privileges might've been
granted to "superuserrole". If you did that with the bootstrap
superuser, this would include ownership rights on all built-in
objects, so it'd still be pretty darn dangerous; but it does not
give the ability to ignore privileges for other objects.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, Michael.Dietrich@swisscom.com, pgsql-admin@lists.postgresql.org
Subject: Re: Connect to db denied for superuser inherited by group
In-Reply-To: <19470.1521211964@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox