From: Scott Ribe <scott_ribe@elevated-dev.com>
To: Stephen Frost <sfrost@snowman.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: 12 to 13 migration, the privs error with pg_pltemplate
Date: Fri, 11 Dec 2020 14:04:34 -0700
Message-ID: <F1D171AD-F02C-4D78-8152-11329B21E372@elevated-dev.com> (raw)
In-Reply-To: <20201211203634.GB16415@tamriel.snowman.net>
References: <20201211203634.GB16415@tamriel.snowman.net>
> On Dec 11, 2020, at 1:36 PM, Stephen Frost <sfrost@snowman.net> wrote:
>
> Yes, I specifically asked if you were looking at the correct database
> previously, because it matters:
At that time I thought I had run the original REVOKE command in the target database, and then tried ALTER DEFAULT PRIVILEGES in postgres. I was probably mistaken.
> I'm pretty sure none of this has anything to do with DEFAULT PRIVILEGES
> as those only actually apply when a new table is created (and not from a
> template database), and that's just never the case with any PG catalog
> tables.
So the fact that default privs were set on the system catalogs was inappropriate, but harmless in this case?
> What might be useful to point out is that only a superuser can change
> the privileges associated with PG catalog tables and that you really
> should be careful who you grant superuser privileges to.
Yes, that's one thing I took care of earlier this year: change our processes such that we were able to remove superuser from the commonly-used service accounts.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: scott_ribe@elevated-dev.com, sfrost@snowman.net, tgl@sss.pgh.pa.us, pgsql-admin@lists.postgresql.org
Subject: Re: 12 to 13 migration, the privs error with pg_pltemplate
In-Reply-To: <F1D171AD-F02C-4D78-8152-11329B21E372@elevated-dev.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox