Subject: Re: Need help understanding has_function_privilege

From: Cosimo Simeone <[email-masked]>
Date: Fri, 21 Mar 2025 14:48:56 +0000

Hi, and thanks (both of you!)
Shouldn't the
 create role my_user NOINHERIT;
avoid this? And since not, why? :-)

On Thu, 20 Mar 2025 at 15:07, David G. Johnston <[email-masked]>
wrote:

> On Wednesday, March 19, 2025, Cosimo Simeone <[email-masked]>
> wrote:
>>
>>
>> true?
>> Well... Ok, "whatever"... I revoke it:
>> =# revoke execute on function my_schema.my_func(text) from my_user;
>> REVOKE
>>
>
> Roles can inherit privileges.  my_user is inheriting its execute privilege
> from PUBLIC.  You have to revoke a granted privilege.
>
> David J.
>
>

---

From: "David G. Johnston" <[email-masked]>
Date: Sun, 23 Mar 2025 07:50:21 -0700

> avoid this? And since not, why? :-)
We might need to improve documentation surrounding the public pseudo-role a
bit.  Since it’s not a true group role I suspect inherit/noinherit doesn’t
apply. (You also cannot SET to it, nor admin it - not tested.) Losing the
execute privilege on every built-in function would be way too annoying.

David J.