From: Tom Lane <tgl@sss.pgh.pa.us>
To: "Tefft, Michael J" <Michael.J.Tefft@snapon.com>
cc: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Subject: Re: Removing the default grant of EXECUTE on functions/procedures to PUBLIC
In-reply-to: <BN8PR04MB6289DE86BD158D8785B302C5D0DF2@BN8PR04MB6289.namprd04.prod.outlook.com>
References: <BN8PR04MB6289E694A40BE7DF913754A1D0DF2@BN8PR04MB6289.namprd04.prod.outlook.com> <201663.1720191061@sss.pgh.pa.us> <BN8PR04MB6289DE86BD158D8785B302C5D0DF2@BN8PR04MB6289.namprd04.prod.outlook.com>
Comments: In-reply-to "Tefft, Michael J" <Michael.J.Tefft@snapon.com>
	message dated "Fri, 05 Jul 2024 17:42:35 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <326040.1720203728.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 05 Jul 2024 14:22:08 -0400
Message-ID: <326041.1720203728@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/326041.1720203728%40sss.pgh.pa.us>
Precedence: bulk

"Tefft, Michael J" <Michael.J.Tefft@snapon.com> writes:
> I was checking pg_roles.acl_default to see if my role-level ALTER DEFAUL=
T PRIVILEGES had been effective. But I see the same content both before an=
d after the ALTEr.

Er, what?  There's no column named acl_default in pg_roles, nor any
other standard PG view.

psql's "\ddp" command is the most usual way to examine current
defaults:

regression=3D# create user joe;
CREATE ROLE
regression=3D# ALTER DEFAULT PRIVILEGES FOR USER joe REVOKE EXECUTE ON FUN=
CTIONS FROM public;
ALTER DEFAULT PRIVILEGES
regression=3D# \ddp
           Default access privileges
 Owner | Schema |   Type   | Access privileges =

-------+--------+----------+-------------------
 joe   |        | function | joe=3DX/joe
(1 row)

			regards, tom lane