Message-ID: <ae583b0b04be3f12714a2f2e003b8ee9d638d305.camel@cybertec.at>
Subject: Re: Fwd: Identify system databases
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Dominique Devienne <ddevienne@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>
Cc: Adrian Klaver <adrian.klaver@aklaver.com>, "David G. Johnston"
	 <david.g.johnston@gmail.com>, Igor Korot <ikorot01@gmail.com>, 
 "pgsql-generallists.postgresql.org"
	 <pgsql-general@lists.postgresql.org>
Date: Wed, 16 Apr 2025 22:04:10 +0200
In-Reply-To: <CAFCRh--z-BzUJ3C9qj=YPHQYA-zwNdTm2wGC7D74-j2vdK1mOA@mail.gmail.com>
References: 
	<CA+FnnTxab=JyE0DZkfL4Z2MK8RvvTud9MZiNenD45AoV_t2Mxg@mail.gmail.com>
	 <CAKFQuwYaDXuuDoEaad5sYW97pRS_FJnmfZCwY3FojnDOdfXc9Q@mail.gmail.com>
	 <CA+FnnTzwmMTNymgPuiF4CLfa6YO+HBRx4Qy5_B_KDw1oNpiukw@mail.gmail.com>
	 <CA+FnnTyWMXPEVAwNNDnCVDfmTFNHdDfffiF5vLioxyTv8Jmq0A@mail.gmail.com>
	 <817abeac-d628-4279-bfef-9e1e3aa1884b@aklaver.com>
	 <CAKFQuwbkQTbUwA4c6LFOMUWX5ojQY8DpKPQRh+xoe4VZABPWfw@mail.gmail.com>
	 <25b6cd49-f871-47fe-bf3b-5416637736ca@aklaver.com>
	 <CAKFQuwYpY7urAHuns26cw=9TKTZJU4JdVBrXWoSH_nHfZ_s3Ww@mail.gmail.com>
	 <bcae9b4b-a85e-4fc7-8e70-5a98c5e5ff28@aklaver.com>
	 <f5612b59b0a82bee2bf28efd314ac338bbc4c6b5.camel@cybertec.at>
	 <CAFCRh-_uEazAHjSz1WvL2STbR857V7E9YtkdwRO5xNNHLy2Ykw@mail.gmail.com>
	 <2dffe860b085b927726a052bcfe16ede704ab923.camel@cybertec.at>
	 <1898934.1744814354@sss.pgh.pa.us>
	 <CAFCRh--z-BzUJ3C9qj=YPHQYA-zwNdTm2wGC7D74-j2vdK1mOA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.54.3 (3.54.3-1.fc41) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/ae583b0b04be3f12714a2f2e003b8ee9d638d305.camel%40cybertec.at>
Precedence: bulk

On Wed, 2025-04-16 at 17:06 +0200, Dominique Devienne wrote:
> So in a way, you guys are saying one should never REVOKE CONNECT ON
> DATABASE FROM PUBLIC?

No, not at all.

> All my DBs are not PUBLIC-accessible.
> And inside my DBs, I try to revoke everything from PUBLIC
> (USAGE ON TYPES, EXECUTE ON ROUTINES).
> Nor do I use the public schema.
> And I never use the "built-in" postgres database.
> Basically I want all GRANTs to be explicit.
>=20
> Given the above, I'd want to not provide access to the postgres DB too.
> Yet have a way to discover which DBs I can connect to, from the "cluster =
only".
> Naively.
>=20
> Sounds like you are saying use the "postgres" DB for that, and move on.

It is just fine to restrict access to databases as much as you want.

You just need access to a database if you want to run SQL statements,
be that SELECT or CREATE DATABASE.  It's as simple as that.

Restricting access is not wrong per se, but if you randomly restrict
access to everything, that's not so much a security measure as a way
to make the database unusable.

I see no value in restricting USAGE on the data type "text" or EXECUTE
on the function "upper()".  Modifying system objects is not recommended
and can lead to trouble.

Yours,
Laurenz Albe