From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Christian Lehmann <info@chlehmann.ch>
To: pgsql-admin@postgresql.org
Subject: Re: Shared postgres-cluster / permissions
Date: Thu, 17 Mar 2022 16:29:34 +0100
Message-ID: <a2175514fcbc8da8cb825051179fc9ee84effefe.camel@cybertec.at> (raw)
In-Reply-To: <CAEh-KgtfhSp4q+0CbMtjTDAiyNZB1B+6SZ1W2CLJRRi2TxFpyg@mail.gmail.com>
References: <CAEh-KgtfhSp4q+0CbMtjTDAiyNZB1B+6SZ1W2CLJRRi2TxFpyg@mail.gmail.com>
On Thu, 2022-03-17 at 11:48 +0100, Christian Lehmann wrote:
> There is a "alter default privileges in schema public" in place which grants ALL
> to the rw-role for new tables and select to the ro-role. but it only does it, if
> the rw-role is creating the table. if the user (for example serviceuser) is creating
> new items, it does not add this default privs. (which is by design, but bad because
> other users won't be able to access the table).
>
> do you have a good way to work around this? is my role-setup "correct" or do you
> have a better idea how to do this? as i understood, there is no possibility to have
> a wildcard-default-privilege-setting, right?
You can run an ALTER DEFAULT PRIVILEGES for each user.
But often it is better to have only one role own the tables. If all roles that may create
tables are members of the rw-role, you can give CREATE on the schema only to that role,
and anybody who wants to create an object has to SET ROLE "rw-role".
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: laurenz.albe@cybertec.at, info@chlehmann.ch
Subject: Re: Shared postgres-cluster / permissions
In-Reply-To: <a2175514fcbc8da8cb825051179fc9ee84effefe.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox