Message-ID: <354278ddf78e0160dccf96927213d6e5cac92d75.camel@cybertec.at>
Subject: Re: Predefined Role - pg_write_all_data
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Gambhir Singh <gambhir.singh05@gmail.com>,
	pgsql-admin@lists.postgresql.org
Date: Thu, 26 Oct 2023 07:34:47 +0200
In-Reply-To: 
 <CAHOGQfXpTeV74KpUYdRxYgsHrxp3pptwWtXw66Kp+WhuzSkNDQ@mail.gmail.com>
References: 
	<CAHOGQfXpTeV74KpUYdRxYgsHrxp3pptwWtXw66Kp+WhuzSkNDQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/354278ddf78e0160dccf96927213d6e5cac92d75.camel%40cybertec.at>
Precedence: bulk

On Wed, 2023-10-25 at 20:30 +0530, Gambhir Singh wrote:
> Please help me to understand if we grant pg_write_all data role to some u=
ser then does
> that user get ability to do DML operations=C2=A0on system catalogs and sy=
stem views.
>=20
> if yes then how we can restrict them.

Trying it out would have been less effort than writing this e-mail:

You are now connected to database "x" as user "postgres".
x=3D# GRANT pg_write_all_data TO laurenz;
GRANT ROLE
x=3D# SET SESSION AUTHORIZATION laurenz;
SET
x=3D> DELETE FROM pg_class;
ERROR:  permission denied for table pg_class

Yours,
Laurenz Albe