From: Tom Lane <tgl@sss.pgh.pa.us>
To: ivanov17@riseup.net
cc: pgsql-novice@lists.postgresql.org
Subject: Re: Grant CREATE privilege on all schemas
In-reply-to: <e7fdd3ef1f36f903aa3b13a628a88a61@riseup.net>
References: <e7fdd3ef1f36f903aa3b13a628a88a61@riseup.net>
Comments: In-reply-to ivanov17@riseup.net
	message dated "Tue, 12 Sep 2023 01:05:30 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2712773.1694484281.1@sss.pgh.pa.us>
Date: Mon, 11 Sep 2023 22:04:41 -0400
Message-ID: <2712774.1694484281@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2712774.1694484281%40sss.pgh.pa.us>
Precedence: bulk

ivanov17@riseup.net writes:
> Is there a way to grant roles CREATE
> privileges on all schemas?

This is not supported, and it's not likely to ever become supported
in exactly the way you phrased it, because that would presumably
include CREATE on the pg_catalog schema.  If you give somebody
that, you might as well just skip the fooling around and give them
full superuser, because they could hack their way to that in less
time than it's taking me to type this email.  In general, you
want to be pretty darn chary about giving out permissions on
schemas that are likely to be in other users' search_path, for
much the same reasons that you don't give random users write
permission on /usr/bin/.

			regards, tom lane