Removing the default grant of EXECUTE on functions/procedures to PUBLIC

public inbox for [email protected]  
help / color / mirror / Atom feed

From: Tefft, Michael J <[email protected]>
To: [email protected] <[email protected]>
Subject: Removing the default grant of EXECUTE on functions/procedures to PUBLIC
Date: Fri, 5 Jul 2024 14:45:11 +0000
Message-ID: <BN8PR04MB6289E694A40BE7DF913754A1D0DF2@BN8PR04MB6289.namprd04.prod.outlook.com> (raw)

I am trying to remove the default grant of EXECUTE on all functions/procedures to PUBLIC.
From my reading, there is no straightforward way to do this. For example,
ALTER DEFAULT PRIVILEGES REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;
Does not apply this across the entire cluster (or database) but only applies to the role who issued it (and objects yet to be created by that role) .
So I am arriving at the conclusion that I need to alter the default privileges for every existing role (which I expected), and ensure that default privileges are altered for every new role that is created going forward.

Have I analyzed this correctly?

Thanks,
Mike Tefft

view thread (7+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: Removing the default grant of EXECUTE on functions/procedures to PUBLIC
  In-Reply-To: <BN8PR04MB6289E694A40BE7DF913754A1D0DF2@BN8PR04MB6289.namprd04.prod.outlook.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox