From: Tom Lane <tgl@sss.pgh.pa.us>
To: Rodrigo De León <rdeleonp@gmail.com>
Cc: Joshua_Kramer <josh@globalherald.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: SUPERUSER vs CREATEUSER causes foul 'code smell'
Date: Thu, 16 Aug 2007 12:43:47 -0400
Message-ID: <5953.1187282627@sss.pgh.pa.us> (raw)
In-Reply-To: <a55915760708160841g436b6c48uea8ac621af247ee@mail.gmail.com>
References: <Pine.LNX.4.64.0708161134270.16729@home-av-server.home-av>
<a55915760708160841g436b6c48uea8ac621af247ee@mail.gmail.com>
"=?UTF-8?Q?Rodrigo_De_Le=C3=B3n?=" <rdeleonp@gmail.com> writes:
> On 8/16/07, Joshua_Kramer <josh@globalherald.net> wrote:
>> If I want to create a role who can create other roles, but not have other
>> SUPERUSER priveleges - how can I do that?
> create role foo createrole login password 'foo';
CREATEROLE privilege is not exactly a superuser, but it implies a lot of
administrative privileges anyway --- for instance the ability to change
the password of another account. So this may not be exactly what the OP
wants. We intended CREATEROLE as a way that a DBA could do all his
routine account-management duties without being a "real" superuser (with
the attendant ability to completely destroy the system with a slipup).
Think of it as sudo that lets you do anything you want to /etc/passwd,
but not "rm -rf /"...
If you want exactly what was stated --- the ability to create new roles,
and nothing else --- the best way is to create a function that does only
that one thing, make it superuser-owned and SECURITY DEFINER, and grant
execute privilege on it to whomever you want to be able to do that.
(Don't forget to revoke the default public execute privilege.) Gateway
functions of this sort are the standard solution whenever the system's
classification of privileges isn't quite what you want.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, rdeleonp@gmail.com, josh@globalherald.net
Subject: Re: SUPERUSER vs CREATEUSER causes foul 'code smell'
In-Reply-To: <5953.1187282627@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox