public inbox for [email protected]
help / color / mirror / Atom feedFrom: Ron Watkins <[email protected]>
To: [email protected]
Subject: create read-only and revoke create function?
Date: Mon, 14 Aug 2023 08:19:20 -0700
Message-ID: <CAPdrarqjFv3WSUzeppkRxYKicvm7TZ2xuHUEbhzbNg2yRtie2w@mail.gmail.com> (raw)
Management has requested to setup a group of users as READ-ONLY, and to
revoke their ability to create tables, views, procedures, functions, etc...
I looked around, and did the following, but it's not working as expected.
CREATE ROLE "RO_Role" WITH
NOLOGIN
NOSUPERUSER
INHERIT
NOCREATEDB
NOCREATEROLE
NOREPLICATION;
COMMENT ON ROLE "RO_Role" IS 'Read-Only role.';
GRANT "RO_Role" to <users>;
GRANT SELECT ON TABLE <tablename> TO "RO_Role";
GRANT EXECUTE ON FUNCTION <functions> TO "RO_ROLE";
On one server, this seems to have limited the users ability to write to
tables, but on the other server it didn't work, they can still write to
tables.
As for the functions, they can still create. Not sure how to prevent this
from happening.
Suggestions?
--
Ron Watkins, K7DOG
602.743.5272
view thread (2+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected]
Subject: Re: create read-only and revoke create function?
In-Reply-To: <CAPdrarqjFv3WSUzeppkRxYKicvm7TZ2xuHUEbhzbNg2yRtie2w@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox