From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Gambhir Singh <gambhir.singh05@gmail.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: Predefined Role - pg_write_all_data
Date: Thu, 26 Oct 2023 07:34:47 +0200
Message-ID: <354278ddf78e0160dccf96927213d6e5cac92d75.camel@cybertec.at> (raw)
In-Reply-To: <CAHOGQfXpTeV74KpUYdRxYgsHrxp3pptwWtXw66Kp+WhuzSkNDQ@mail.gmail.com>
References: <CAHOGQfXpTeV74KpUYdRxYgsHrxp3pptwWtXw66Kp+WhuzSkNDQ@mail.gmail.com>
On Wed, 2023-10-25 at 20:30 +0530, Gambhir Singh wrote:
> Please help me to understand if we grant pg_write_all data role to some user then does
> that user get ability to do DML operations on system catalogs and system views.
>
> if yes then how we can restrict them.
Trying it out would have been less effort than writing this e-mail:
You are now connected to database "x" as user "postgres".
x=# GRANT pg_write_all_data TO laurenz;
GRANT ROLE
x=# SET SESSION AUTHORIZATION laurenz;
SET
x=> DELETE FROM pg_class;
ERROR: permission denied for table pg_class
Yours,
Laurenz Albe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: laurenz.albe@cybertec.at, gambhir.singh05@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Predefined Role - pg_write_all_data
In-Reply-To: <354278ddf78e0160dccf96927213d6e5cac92d75.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox