From: Erik Wienhold <ewie@ewie.name>
To: richard coleman <rcoleman.ascentgl@gmail.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: how to list privileges on the database object itself via SQL?
Date: Wed, 26 Apr 2023 19:17:11 +0200 (CEST)
Message-ID: <2058602074.1048315.1682529431551@office.mailbox.org> (raw)
In-Reply-To: <CAGA3vBvanu7UBtaaVv9PH25Ko==5F2wewhPWTTra8wqexdDAdQ@mail.gmail.com>
References: <CAGA3vBvanu7UBtaaVv9PH25Ko==5F2wewhPWTTra8wqexdDAdQ@mail.gmail.com>
> On 26/04/2023 18:34 CEST richard coleman <rcoleman.ascentgl@gmail.com> wrote:
>
> This might sound like a silly question, but how would I list the privileges
> the various roles have on the database objects themselves?
>
> There appear to be a million ways to list the privileges on various database
> objects; tables, views, foreign tables, etc. but for the life of me there
> doesn't appear to an analogous way to get permissions on the database objects
> themselves.
>
> At the moment all that I've found is:
>
> select has_database_privilege('role','db_name', 'CREATE') as can_create;
> select has_database_privilege('role','db_name', 'CONNECT') as can_connect;
> select has_database_privilege('role','db_name', 'TEMP') as can_temp;
>
> Am I missing something?
If you're interested in specific roles or privileges, then aclexplode is your
friend.
SELECT
datname,
grantor::regrole,
grantee::regrole,
privilege_type,
is_grantable
FROM
pg_database,
aclexplode(datacl)
WHERE
grantee = 'role'::regrole
AND privilege_type IN ('CREATE', 'CONNECT', 'TEMPORARY');
--
Erik
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: ewie@ewie.name, rcoleman.ascentgl@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: how to list privileges on the database object itself via SQL?
In-Reply-To: <2058602074.1048315.1682529431551@office.mailbox.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox