public inbox for [email protected]  
help / color / mirror / Atom feed
From: Ron Watkins <[email protected]>
To: [email protected]
Subject: create read-only and revoke create function?
Date: Mon, 14 Aug 2023 08:19:20 -0700
Message-ID: <CAPdrarqjFv3WSUzeppkRxYKicvm7TZ2xuHUEbhzbNg2yRtie2w@mail.gmail.com> (raw)

Management has requested to setup a group of users as READ-ONLY, and to
revoke their ability to create tables, views, procedures, functions, etc...
I looked around, and did the following, but it's not working as expected.

CREATE ROLE "RO_Role" WITH
  NOLOGIN
  NOSUPERUSER
  INHERIT
  NOCREATEDB
  NOCREATEROLE
  NOREPLICATION;

COMMENT ON ROLE "RO_Role" IS 'Read-Only role.';

GRANT "RO_Role" to <users>;
GRANT SELECT ON TABLE <tablename> TO "RO_Role";
GRANT EXECUTE ON FUNCTION <functions> TO "RO_ROLE";

On one server, this seems to have limited the users ability to write to
tables, but on the other server it didn't work, they can still write to
tables.

As for the functions, they can still create. Not sure how to prevent this
from happening.
Suggestions?

-- 
Ron Watkins, K7DOG
602.743.5272


view thread (2+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: create read-only and revoke create function?
  In-Reply-To: <CAPdrarqjFv3WSUzeppkRxYKicvm7TZ2xuHUEbhzbNg2yRtie2w@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox