RE: Removing the default grant of EXECUTE on functions/procedures to PUBLIC

public inbox for [email protected]  
help / color / mirror / Atom feed

From: Tefft, Michael J <[email protected]>
To: Tom Lane <[email protected]>
Cc: [email protected] <[email protected]>
Subject: RE: Removing the default grant of EXECUTE on functions/procedures to PUBLIC
Date: Fri, 5 Jul 2024 17:42:35 +0000
Message-ID: <BN8PR04MB6289DE86BD158D8785B302C5D0DF2@BN8PR04MB6289.namprd04.prod.outlook.com> (raw)
In-Reply-To: <[email protected]>
References: <BN8PR04MB6289E694A40BE7DF913754A1D0DF2@BN8PR04MB6289.namprd04.prod.outlook.com>
	<[email protected]>

I was checking pg_roles.acl_default to see if my role-level ALTER DEFAULT PRIVILEGES had been effective. But I see the same content both before and after the ALTEr.

You mention that this needs to be done in each database. Is there a database-level version of pg_roles.acl_default that I should be checking instead?

Thanks,
Mike Tefft

From: Tom Lane <[email protected]>
Sent: Friday, July 5, 2024 10:51 AM
To: Tefft, Michael J <[email protected]>
Cc: [email protected]
Subject: Re: Removing the default grant of EXECUTE on functions/procedures to PUBLIC

"Tefft, Michael J" <Michael. J. Tefft@ snapon. com> writes: > I am trying to remove the default grant of EXECUTE on all functions/procedures to PUBLIC. >> From my reading, there is no straightforward way to do this. For example,


"Tefft, Michael J" <[email protected]<mailto:[email protected]>> writes:

> I am trying to remove the default grant of EXECUTE on all functions/procedures to PUBLIC.

>> From my reading, there is no straightforward way to do this. For example,

> ALTER DEFAULT PRIVILEGES REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;

> Does not apply this across the entire cluster (or database) but only applies to the role who issued it (and objects yet to be created by that role) .

> So I am arriving at the conclusion that I need to alter the default privileges for every existing role (which I expected), and ensure that default privileges are altered for every new role that is created going forward.



> Have I analyzed this correctly?



You'll also need to repeat the ALTERs in each database of your

installation.



                                       regards, tom lane

view thread (7+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: RE: Removing the default grant of EXECUTE on functions/procedures to PUBLIC
  In-Reply-To: <BN8PR04MB6289DE86BD158D8785B302C5D0DF2@BN8PR04MB6289.namprd04.prod.outlook.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox