From: Stephen Frost <sfrost@snowman.net>
To: Scott Ribe <scott_ribe@elevated-dev.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: 12 to 13 migration, the privs error with pg_pltemplate
Date: Fri, 11 Dec 2020 16:10:31 -0500
Message-ID: <20201211211031.GC16415@tamriel.snowman.net> (raw)
In-Reply-To: <F1D171AD-F02C-4D78-8152-11329B21E372@elevated-dev.com>
References: <20201211203634.GB16415@tamriel.snowman.net>
<F1D171AD-F02C-4D78-8152-11329B21E372@elevated-dev.com>
Greetings,
* Scott Ribe (scott_ribe@elevated-dev.com) wrote:
> > On Dec 11, 2020, at 1:36 PM, Stephen Frost <sfrost@snowman.net> wrote:
> > I'm pretty sure none of this has anything to do with DEFAULT PRIVILEGES
> > as those only actually apply when a new table is created (and not from a
> > template database), and that's just never the case with any PG catalog
> > tables.
>
> So the fact that default privs were set on the system catalogs was inappropriate, but harmless in this case?
Almost certainly.
> > What might be useful to point out is that only a superuser can change
> > the privileges associated with PG catalog tables and that you really
> > should be careful who you grant superuser privileges to.
>
> Yes, that's one thing I took care of earlier this year: change our processes such that we were able to remove superuser from the commonly-used service accounts.
... and hopefully from most every other account. There's really very
little need to have actual superuser rights (something we continue to
work to limit the need of with each release).
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, scott_ribe@elevated-dev.com, tgl@sss.pgh.pa.us, pgsql-admin@lists.postgresql.org
Subject: Re: 12 to 13 migration, the privs error with pg_pltemplate
In-Reply-To: <20201211211031.GC16415@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox