From: | Stephen Frost <sfrost(at)snowman(dot)net> |
---|---|
To: | Andrew Dunstan <andrew(at)dunslane(dot)net> |
Cc: | PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: superusers are members of all roles? |
Date: | 2011-04-06 23:54:06 |
Message-ID: | 20110406235406.GC4548@tamriel.snowman.net |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
* Andrew Dunstan (andrew(at)dunslane(dot)net) wrote:
> The surprising (to me) consequence was that every superuser was
> locked out of the system. I had not granted them (or anyone) the
> role, but nevertheless these lines took effect.
As I recall, the way we allow superusers to set role to other roles is
by considering the superuser to be a member of every role. Now, I agree
that such an approach doesn't make sense for pg_hba consideration.
> If this is intended, it should at least be documented. But if it is
> intended then it's ugly anyway, IMNSHO, and we should change it.
Perhaps the superuser-override should be moved to be at the 'set role'
level instead of setting things up such that the superuser is considered
a member of every role. That would fix this but would require adding a
couple of additional special superuser checks, which isn't something to
do lightly, imv.
Thanks,
Stephen
From | Date | Subject | |
---|---|---|---|
Next Message | Tatsuo Ishii | 2011-04-06 23:57:44 | Re: GSoC Proposal - Caching query results in pgpool-II |
Previous Message | Andrew Dunstan | 2011-04-06 23:04:42 | superusers are members of all roles? |