MIME-Version: 1.0
References: <CAD1W9HXMUZ6mjBVhNQJGqLQkMnyQAc28OAqvCEpZ_rOEH=eDfw@mail.gmail.com>
 <CAKFQuwZmk+xvU9WUyX7CudPW7A7M0Jz+nAS+PWZ1dvVpDPLzjA@mail.gmail.com>
In-Reply-To: <CAKFQuwZmk+xvU9WUyX7CudPW7A7M0Jz+nAS+PWZ1dvVpDPLzjA@mail.gmail.com>
From: Cosimo Simeone <cosimo.simeone@gmail.com>
Date: Fri, 21 Mar 2025 14:48:56 +0000
Message-ID: <CAD1W9HUKn-u8HnfhVX8e7qib1pYssiuSHp+Lu=5iHzpGJUDMMg@mail.gmail.com>
Subject: Re: Need help understanding has_function_privilege
To: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000c542f50630db5c1f"
Archived-At: <https://www.postgresql.org/message-id/CAD1W9HUKn-u8HnfhVX8e7qib1pYssiuSHp%2BLu%3D5iHzpGJUDMMg%40mail.gmail.com>
Precedence: bulk

--000000000000c542f50630db5c1f
Content-Type: text/plain; charset="UTF-8"

Hi, and thanks (both of you!)
Shouldn't the
 create role my_user NOINHERIT;
avoid this? And since not, why? :-)


On Thu, 20 Mar 2025 at 15:07, David G. Johnston <david.g.johnston@gmail.com>
wrote:

> On Wednesday, March 19, 2025, Cosimo Simeone <cosimo.simeone@gmail.com>
> wrote:
>>
>>
>> true?
>> Well... Ok, "whatever"... I revoke it:
>> =# revoke execute on function my_schema.my_func(text) from my_user;
>> REVOKE
>>
>
> Roles can inherit privileges.  my_user is inheriting its execute privilege
> from PUBLIC.  You have to revoke a granted privilege.
>
> David J.
>
>

--000000000000c542f50630db5c1f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:arial,he=
lvetica,sans-serif">Hi, and thanks (both of you!)</div><div class=3D"gmail_=
default" style=3D"font-family:arial,helvetica,sans-serif">Shouldn&#39;t the=
 <br></div><div class=3D"gmail_default" style=3D"font-family:arial,helvetic=
a,sans-serif">=C2=A0create role my_user NOINHERIT;</div><div class=3D"gmail=
_default" style=3D"font-family:arial,helvetica,sans-serif">avoid this? And =
since not, why? :-)</div><div class=3D"gmail_default" style=3D"font-family:=
arial,helvetica,sans-serif"><br></div><div class=3D"gmail_default" style=3D=
"font-family:arial,helvetica,sans-serif"><br></div></div><br><div class=3D"=
gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On=
 Thu, 20 Mar 2025 at 15:07, David G. Johnston &lt;<a href=3D"mailto:david.g=
.johnston@gmail.com">david.g.johnston@gmail.com</a>&gt; wrote:<br></div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef=
t:1px solid rgb(204,204,204);padding-left:1ex">On Wednesday, March 19, 2025=
, Cosimo Simeone &lt;<a href=3D"mailto:cosimo.simeone@gmail.com" target=3D"=
_blank">cosimo.simeone@gmail.com</a>&gt; wrote:<blockquote class=3D"gmail_q=
uote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,2=
04);padding-left:1ex"><div dir=3D"ltr"><div class=3D"gmail_default" style=
=3D"font-family:arial,helvetica,sans-serif"><div><br></div><div><div style=
=3D"font-family:arial,helvetica,sans-serif" class=3D"gmail_default">true?</=
div><div style=3D"font-family:arial,helvetica,sans-serif" class=3D"gmail_de=
fault">Well... Ok, &quot;whatever&quot;... I revoke it:</div><div style=3D"=
font-family:arial,helvetica,sans-serif" class=3D"gmail_default">=3D# revoke=
 execute on function my_schema.my_func(text) from my_user;<br>REVOKE</div><=
/div></div></div></blockquote><div><br></div><div>Roles can inherit privile=
ges. =C2=A0my_user is inheriting its execute privilege from PUBLIC.=C2=A0 Y=
ou have to revoke a granted privilege.</div><div><br></div><div>David J.</d=
iv><div>=C2=A0</div>
</blockquote></div>

--000000000000c542f50630db5c1f--