Re: RFC: common database policy/infrastracture
On Thu, 2004-12-23 at 11:52 +0100, Karsten Hilbert wrote:
> > In PostgreSQL, any user that can create other users is the equivalent of
> > superuser;
> Or so the 7.4 docs say.
>
> > he can do anything to any database.
> If that were so ...
>
> > It is not acceptable for
> > a database application package to create such users.
> ... this would hold true.
>
> However, if I create a table as "postgres" in a database and
> then connect as user "gm-dbowner" (which is our application
> admin account with CREATEUSER and CREATEDB rights) I can *not*
> insert into that table. Which seems to go contrary to what the
> docs say.
>
> Also, usesuper in pg_user is FALSE for gm-dbowner.
>
> What is the definitive deal ?
The createuser script will set usesuper to true if the --adduser option
is given; so does the CREATE USER statement if the CREATEUSER option is
given. You can subsequently set usesuper to false, but I don't feel at
all happy with the idea of creating a superuser at any point. Better to
have the existing postgres user create any other needed users.
--
Oliver Elphick olly@lfix.co.uk
Isle of Wight http://www.lfix.co.uk/oliver
GPG: 1024D/A54310EA 92C8 39E7 280E 3631 3F0E 1EC0 5664 7A2F A543 10EA
========================================
"And this shall be a sign unto you; Ye shall find the
babe wrapped in swaddling clothes, lying in a manger."
Luke 2:12
Reply to: