public inbox for [email protected]
help / color / mirror / Atom feedFrom: Tom Lane <[email protected]>
To: Jacek Trocinski <[email protected]>
Cc: [email protected]
Subject: Re: Why is EXECUTE granted to PUBLIC for all routines?
Date: Fri, 22 Apr 2022 13:44:40 -0400
Message-ID: <[email protected]> (raw)
In-Reply-To: <CAPBN_=npERDpVuvJ63-7gn8PCGPCu_7q0DTwaURg8Of+7a7M+Q@mail.gmail.com>
References: <CAPBN_=npERDpVuvJ63-7gn8PCGPCu_7q0DTwaURg8Of+7a7M+Q@mail.gmail.com>
Jacek Trocinski <[email protected]> writes:
> The default behavior on Postgres is to grant EXECUTE to PUBLIC on any
> function or procedure that is created.
> I feel this this is a security concern, especially for procedures and
> functions defined with the "SECURITY DEFINER" clause.
There is zero security concern for non-SECURITY-DEFINER functions,
since they do nothing callers couldn't do for themselves. For those,
you typically do want to grant out permissions. As for SECURITY DEFINER
functions, there is no reason to make one unless it is meant to be called
by someone besides the owner. Perhaps PUBLIC isn't the scope you want to
grant it to, but no-privileges wouldn't be a useful default there either.
In any case, changing this decision now would cause lots of problems,
such as breaking existing dump files. We're unlikely to revisit it.
As noted in the docs, best practice is to adjust the permissions
as you want them in the same transaction that creates the function.
regards, tom lane
view thread (4+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected]
Subject: Re: Why is EXECUTE granted to PUBLIC for all routines?
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox