Received: from maia.hub.org (maia-5.hub.org [200.46.204.29]) by mail.postgresql.org (Postfix) with ESMTP id AF9C71337B99 for ; Tue, 12 Oct 2010 14:59:34 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.29]) (amavisd-maia, port 10024) with ESMTP id 26869-09 for ; Tue, 12 Oct 2010 17:59:27 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from sd-17937.dedibox.fr (sd-17937.dedibox.fr [88.191.100.74]) by mail.postgresql.org (Postfix) with ESMTP id 6DEEA1337B8F for ; Tue, 12 Oct 2010 14:59:26 -0300 (ADT) Received: from [192.168.0.6] (uni14-1-82-233-223-216.fbx.proxad.net [82.233.223.216]) by sd-17937.dedibox.fr (Postfix) with ESMTPA id BD0113B8F5; Tue, 12 Oct 2010 19:59:25 +0200 (CEST) Message-ID: <4CB4A1F9.60408@lelarge.info> Date: Tue, 12 Oct 2010 19:59:21 +0200 From: Guillaume Lelarge User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); fr; rv:1.9.2.9) Gecko/20100915 Thunderbird/3.1.4 MIME-Version: 1.0 To: Kasia Tuszynska CC: pgsql-admin Subject: Re: two questions about pg 9.0 References: <1508171717.69491.1286831195955.JavaMail.root@sz0093a.westchester.pa.mail.comcast.net> <7815.1286839244@sss.pgh.pa.us> <232B5217AD58584C87019E8933556D1102198CA98C@redmx2.esri.com> In-Reply-To: <232B5217AD58584C87019E8933556D1102198CA98C@redmx2.esri.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-1.9 tagged_above=-10 required=5 tests=BAYES_00=-1.9 X-Spam-Level: X-Archive-Number: 201010/96 X-Sequence-Number: 35837 Hi, Le 12/10/2010 19:25, Kasia Tuszynska a écrit : > [...] > 1. Permissions: > When I create a login role with superuser privileges in pgAdminIII I have the option of indicating that the superuser will also have the permission to: "can modify catalog directly", when I look at the sql that is generated by that gui, I do not see a corresponding sql permission, I see: > "CREATE ROLE kasia LOGIN ENCRYPTED PASSWORD 'md5ff0508b7bb33909c096d1b447a17d09b' > SUPERUSER VALID UNTIL 'infinity';" > A. What does "can modify catalog directly" actually do? I looked it up and I found : "This option determines whether the role can modify system catalog directly or not." But that really does not tell me much. Yeah, we kinda suck at documenting things :) It refers to the rolcatupdate column in the pg_authid system table. Which is a permission to update the system catalogs (system tables). > B. Why is there no sql level equivalent? When I revoke the "can modify catalog directly" permission I get the following sql: UPDATE pg_authid SET rolcatupdate=false WHERE OID=17331::oid; You create a superuser, which already has this capacity. So we don't need to add something else. Of course, if you uncheck it, we'll have to update the system table to set it to false. -- Guillaume http://www.postgresql.fr http://dalibo.com