X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org Received: from localhost (neptune.hub.org [200.46.204.2]) by svr1.postgresql.org (Postfix) with ESMTP id 46A10D1B48B for ; Sat, 27 Dec 2003 18:50:56 +0000 (GMT) Received: from svr1.postgresql.org ([200.46.204.71]) by localhost (neptune.hub.org [200.46.204.2]) (amavisd-new, port 10024) with ESMTP id 73610-04 for ; Sat, 27 Dec 2003 14:50:08 -0400 (AST) Received: from sss.pgh.pa.us (unknown [192.204.191.242]) by svr1.postgresql.org (Postfix) with ESMTP id 00126D1B4AC for ; Sat, 27 Dec 2003 14:50:06 -0400 (AST) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.12.10/8.12.10) with ESMTP id hBRIo419012886; Sat, 27 Dec 2003 13:50:04 -0500 (EST) To: Casey Allen Shobe Cc: Devrim GUNDUZ , PostgreSQL Mailing Lists-SQL Subject: Re: What am I doing wrong in here? In-reply-to: <200312271153.20937.cshobe@softhome.net> References: <200312271153.20937.cshobe@softhome.net> Comments: In-reply-to Casey Allen Shobe message dated "Sat, 27 Dec 2003 11:53:20 -0500" Date: Sat, 27 Dec 2003 13:50:03 -0500 Message-ID: <12885.1072551003@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by amavisd-new at postgresql.org X-Archive-Number: 200312/209 X-Sequence-Number: 16375 Casey Allen Shobe writes: > Devrim GUNDUZ (Saturday 27 December 2003 10:45) >> Hmm, that solved the problem, thanks. >> >> But I still could not understand why the lack of createuser permission >> caused the error above... > Because database users (and lots of other database information) is stored in > the pg_catalog schema. When you create, alter, or drop a user, you are > performing an insert, update, or delete on pg_catalog.pg_shadow. This analysis is nonsense ... system catalog operations do not do the same kinds of permission checks as user queries do. Furthermore, if he'd not had permissions to create users, the initial CREATE USER command would have failed, and so would CREATE DATABASE (since it would then be specifying a nonexistent owner name). My guess is that Devrim interpreted your suggestion as telling him to make the created user (tdmsoftmailserveruser) a superuser, which would naturally suppress any and all permissions failures for operations executed by that user. That's hardly a reasonable answer to his problem though. As to what his real problem is, I dunno, but I'd like to find out. regards, tom lane