MIME-Version: 1.0
Date: Tue, 12 Sep 2023 18:36:57 +0000
From: ivanov17@riseup.net
To: Pgsql Novice <pgsql-novice@lists.postgresql.org>
Subject: Re: Grant CREATE privilege on all schemas
In-Reply-To: <2712774.1694484281@sss.pgh.pa.us>
References: <e7fdd3ef1f36f903aa3b13a628a88a61@riseup.net>
 <2712774.1694484281@sss.pgh.pa.us>
Message-ID: <c8f2617846366ada74116717ecf95d18@riseup.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Archived-At: 
 <https://www.postgresql.org/message-id/c8f2617846366ada74116717ecf95d18%40riseup.net>
Precedence: bulk

Tom Lane писал(а) 2023-09-12 06:04:
> ivanov17@riseup.net writes:
>> Is there a way to grant roles CREATE
>> privileges on all schemas?
> 
> This is not supported, and it's not likely to ever become supported
> in exactly the way you phrased it, because that would presumably
> include CREATE on the pg_catalog schema.

Oh, now I understand. I think that if something like this is ever
implemented, system catalogs should not be accessible to such a role.

> If you give somebody
> that, you might as well just skip the fooling around and give them
> full superuser, because they could hack their way to that in less
> time than it's taking me to type this email.  In general, you
> want to be pretty darn chary about giving out permissions on
> schemas that are likely to be in other users' search_path, for
> much the same reasons that you don't give random users write
> permission on /usr/bin/.

Thank you very much, now it becomes clearer to me.

-- 
With appreciation, 
Ivanov