public inbox for [email protected]  

help / color / mirror / Atom feed

From: [email protected]
To: Pgsql Novice <[email protected]>
Subject: Re: Grant CREATE privilege on all schemas
Date: Tue, 12 Sep 2023 18:36:57 +0000
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<[email protected]>

Tom Lane писал(а) 2023-09-12 06:04:
> [email protected] writes:
>> Is there a way to grant roles CREATE
>> privileges on all schemas?
> 
> This is not supported, and it's not likely to ever become supported
> in exactly the way you phrased it, because that would presumably
> include CREATE on the pg_catalog schema.

Oh, now I understand. I think that if something like this is ever
implemented, system catalogs should not be accessible to such a role.

> If you give somebody
> that, you might as well just skip the fooling around and give them
> full superuser, because they could hack their way to that in less
> time than it's taking me to type this email.  In general, you
> want to be pretty darn chary about giving out permissions on
> schemas that are likely to be in other users' search_path, for
> much the same reasons that you don't give random users write
> permission on /usr/bin/.

Thank you very much, now it becomes clearer to me.

-- 
With appreciation, 
Ivanov

view thread (7+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: Grant CREATE privilege on all schemas
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox