Date: Fri, 11 Dec 2020 16:10:31 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Scott Ribe <scott_ribe@elevated-dev.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>,
	Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: 12 to 13 migration, the privs error with pg_pltemplate
Message-ID: <20201211211031.GC16415@tamriel.snowman.net>
References: <20201211203634.GB16415@tamriel.snowman.net>
 <F1D171AD-F02C-4D78-8152-11329B21E372@elevated-dev.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="KjLXavu97SsPN3hE"
Content-Disposition: inline
In-Reply-To: <F1D171AD-F02C-4D78-8152-11329B21E372@elevated-dev.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--KjLXavu97SsPN3hE
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Scott Ribe (scott_ribe@elevated-dev.com) wrote:
> > On Dec 11, 2020, at 1:36 PM, Stephen Frost <sfrost@snowman.net> wrote:
> > I'm pretty sure none of this has anything to do with DEFAULT PRIVILEGES
> > as those only actually apply when a new table is created (and not from a
> > template database), and that's just never the case with any PG catalog
> > tables.
>=20
> So the fact that default privs were set on the system catalogs was inappr=
opriate, but harmless in this case?

Almost certainly.

> > What might be useful to point out is that only a superuser can change
> > the privileges associated with PG catalog tables and that you really
> > should be careful who you grant superuser privileges to.
>=20
> Yes, that's one thing I took care of earlier this year: change our proces=
ses such that we were able to remove superuser from the commonly-used servi=
ce accounts.

=2E.. and hopefully from most every other account.  There's really very
little need to have actual superuser rights (something we continue to
work to limit the need of with each release).

Thanks,

Stephen

--KjLXavu97SsPN3hE
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJf0+BHAAoJEO1sijiDR2RVJccP/36IQl6Spx/Hh1b/qpRIL3Nd
l88dZINeUo55cSMYqA5zSBXVwfNeWW0+kl3AnmWwiumLmlRVd+7ktI5t6HvdmDgi
O7tNJut9XB1rtwesUuYZwm1k48KTuc8N5+I8Q3NLqsSusOm7gAslL6wTnTUfpolJ
7YA+NBOZK5vqI2rQQTdD9Igi7mWNwpPZmdkogjXfeqysKwdYf8kyMlgEv86uZ3jz
5u80N7u4zDJvX5eFIi55Qhy1p5K7RdzY6RTSab7TT/XO9OOm3mcCwZrUDzkFMS6J
FmmcG3uz3KlDXKBTv3YNlXwJr5cJ0LePuBZWzqmwDhw2pTN/LJp6mpT3GVtaeLQJ
SRezXVANG6eqlV9xbMHPDKsz8+oEXYj7zy85ChHJ1gbjIbGFyxX6s3LFeeBN9zOP
SQur/aifSyeeBgLFnFDiM9orrz2TVApUtpZuAkDv4WGOrpOsgvxFeo8iSq9+NJYX
vfo3hmMy/DKocqjkGWOoaiwulgvCRF7G/uEBkFtt6znwU6qoa7LudFaJRhb+3VhV
NYh5HDosvTC777K+bTtx2KpXp5ed2VktF0mXlOjfT+7KLyPts7hyXGZTyptWgQDn
RVN12mw3yOn9wRwYgAMTA/leol7ZWx3SwD7o6oRRMSuJT4bUVx+MFP6gvQ1zi9Z9
m80MpqrDpPwMqoDilM1x
=1cgy
-----END PGP SIGNATURE-----

--KjLXavu97SsPN3hE--