MIME-Version: 1.0
In-Reply-To: <CAD1W9HUKn-u8HnfhVX8e7qib1pYssiuSHp+Lu=5iHzpGJUDMMg@mail.gmail.com>
References: <CAD1W9HXMUZ6mjBVhNQJGqLQkMnyQAc28OAqvCEpZ_rOEH=eDfw@mail.gmail.com>
 <CAKFQuwZmk+xvU9WUyX7CudPW7A7M0Jz+nAS+PWZ1dvVpDPLzjA@mail.gmail.com> <CAD1W9HUKn-u8HnfhVX8e7qib1pYssiuSHp+Lu=5iHzpGJUDMMg@mail.gmail.com>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Sun, 23 Mar 2025 07:50:21 -0700
Message-ID: <CAKFQuwZmXG7uKX0dH+5=RMHrpTkGXa-VG4gePAOTtP+vd+C=ig@mail.gmail.com>
Subject: Re: Need help understanding has_function_privilege
To: Cosimo Simeone <cosimo.simeone@gmail.com>
Cc: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000652ace0631039bdd"
Archived-At: <https://www.postgresql.org/message-id/CAKFQuwZmXG7uKX0dH%2B5%3DRMHrpTkGXa-VG4gePAOTtP%2Bvd%2BC%3Dig%40mail.gmail.com>
Precedence: bulk

--000000000000652ace0631039bdd
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Friday, March 21, 2025, Cosimo Simeone <cosimo.simeone@gmail.com> wrote:

> Hi, and thanks (both of you!)
> Shouldn't the
>  create role my_user NOINHERIT;
> avoid this? And since not, why? :-)
>
>
We might need to improve documentation surrounding the public pseudo-role a
bit.  Since it=E2=80=99s not a true group role I suspect inherit/noinherit =
doesn=E2=80=99t
apply. (You also cannot SET to it, nor admin it - not tested.) Losing the
execute privilege on every built-in function would be way too annoying.

David J.

--000000000000652ace0631039bdd
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Friday, March 21, 2025, Cosimo Simeone &lt;<a href=3D"mailto:cosimo.sime=
one@gmail.com">cosimo.simeone@gmail.com</a>&gt; wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex"><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-f=
amily:arial,helvetica,sans-serif">Hi, and thanks (both of you!)</div><div c=
lass=3D"gmail_default" style=3D"font-family:arial,helvetica,sans-serif">Sho=
uldn&#39;t the <br></div><div class=3D"gmail_default" style=3D"font-family:=
arial,helvetica,sans-serif">=C2=A0create role my_user NOINHERIT;</div><div =
class=3D"gmail_default" style=3D"font-family:arial,helvetica,sans-serif">av=
oid this? And since not, why? :-)</div><div class=3D"gmail_default" style=
=3D"font-family:arial,helvetica,sans-serif"><br></div></div></blockquote><d=
iv><br></div><div>We might need to improve documentation surrounding the pu=
blic pseudo-role a bit.=C2=A0 Since it=E2=80=99s not a true group role I su=
spect inherit/noinherit doesn=E2=80=99t apply. (You also cannot SET to it, =
nor admin it - not tested.) Losing the execute privilege on every built-in =
function would be way too annoying.</div><div><br></div><div>David J.</div>=
<div><br></div>

--000000000000652ace0631039bdd--