pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedConnect to db denied for superuser inherited by group
4+ messages / 4 participants
[nested] [flat]
* Connect to db denied for superuser inherited by group
@ 2018-03-16 13:28 Michael.Dietrich@swisscom.com
0 siblings, 1 reply; 4+ messages in thread
From: Michael.Dietrich@swisscom.com @ 2018-03-16 13:28 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
Unexpected behavior when trying to connect to a database. Facts:
1) The privilege to connect to the database was revoked from public.
2) User without superuser privileges uses a role with superuser rights (usage confirmed with SHOW current_role.)
3) Unecpected Message: FATAL: permission denied for database "db" DETAIL: User does not have CONNECT privilege.
After granting one of the listed privileges it is working as expected.
1) granting superuser to user
2) granting connect to db for user
3) granting connect to db to group
3) granting connect to db to public
What am I missing? --Michael
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Connect to db denied for superuser inherited by group
@ 2018-03-16 13:42 Stephen Frost <sfrost@snowman.net>
parent: Michael.Dietrich@swisscom.com
0 siblings, 1 reply; 4+ messages in thread
From: Stephen Frost @ 2018-03-16 13:42 UTC (permalink / raw)
To: Michael.Dietrich@swisscom.com; +Cc: pgsql-admin@lists.postgresql.org
Greetings,
* Michael.Dietrich@swisscom.com (Michael.Dietrich@swisscom.com) wrote:
> Unexpected behavior when trying to connect to a database. Facts:
> 1) The privilege to connect to the database was revoked from public.
> 2) User without superuser privileges uses a role with superuser rights (usage confirmed with SHOW current_role.)
Please provide more details about what this step #2 actually means.
> 3) Unecpected Message: FATAL: permission denied for database "db" DETAIL: User does not have CONNECT privilege.
Details about exactly what you're doing to connect here would be
helpful.
> After granting one of the listed privileges it is working as expected.
> 1) granting superuser to user
> 2) granting connect to db for user
> 3) granting connect to db to group
> 3) granting connect to db to public
>
> What am I missing? --Michael
CONNECT privileges are needed to be able to connect to the database, so
it's not surprising that you needed to GRANT them to the user after
REVOKE'ing them from PUBLIC. What's not clear is what you're actually
trying to do and what you're expecting to work that apparently isn't.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Connect to db denied for superuser inherited by group
@ 2018-03-16 14:52 Tom Lane <tgl@sss.pgh.pa.us>
parent: Stephen Frost <sfrost@snowman.net>
0 siblings, 1 reply; 4+ messages in thread
From: Tom Lane @ 2018-03-16 14:52 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: Michael.Dietrich@swisscom.com; pgsql-admin@lists.postgresql.org
Stephen Frost <sfrost@snowman.net> writes:
> * Michael.Dietrich@swisscom.com (Michael.Dietrich@swisscom.com) wrote:
>> 2) User without superuser privileges uses a role with superuser rights (usage confirmed with SHOW current_role.)
> Please provide more details about what this step #2 actually means.
If you mean that you did "GRANT superuserrole TO nonsuperuser", this
does not make "nonsuperuser" into a superuser; it merely allows
"nonsuperuser" to use whatever ordinary privileges might've been
granted to "superuserrole". If you did that with the bootstrap
superuser, this would include ownership rights on all built-in
objects, so it'd still be pretty darn dangerous; but it does not
give the ability to ignore privileges for other objects.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Connect to db denied for superuser inherited by group
@ 2018-03-16 15:08 David G. Johnston <david.g.johnston@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 4+ messages in thread
From: David G. Johnston @ 2018-03-16 15:08 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Stephen Frost <sfrost@snowman.net>; Michael.Dietrich@swisscom.com; pgsql-admin@lists.postgresql.org
On Fri, Mar 16, 2018 at 7:52 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > * Michael.Dietrich@swisscom.com (Michael.Dietrich@swisscom.com) wrote:
> >> 2) User without superuser privileges uses a role with superuser rights
> (usage confirmed with SHOW current_role.)
>
> > Please provide more details about what this step #2 actually means.
>
> If you mean that you did "GRANT superuserrole TO nonsuperuser", this
> does not make "nonsuperuser" into a superuser; it merely allows
> "nonsuperuser" to use whatever ordinary privileges might've been
> granted to "superuserrole".
IOW, the privileges on the "CREATE ROLE" page are not inheritable -
inheritance only applies to privileges that are GRANT'ed
David J.
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2018-03-16 15:08 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2018-03-16 13:28 Connect to db denied for superuser inherited by group Michael.Dietrich@swisscom.com
2018-03-16 13:42 ` Stephen Frost <sfrost@snowman.net>
2018-03-16 14:52 ` Tom Lane <tgl@sss.pgh.pa.us>
2018-03-16 15:08 ` David G. Johnston <david.g.johnston@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox