Re: superusers are members of all roles?

From: Bruce Momjian <bruce(at)momjian(dot)us>
To: Andrew Dunstan <andrew(at)dunslane(dot)net>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: superusers are members of all roles?
Date: 2011-05-08 03:42:57
Message-ID: 201105080342.p483gvm16165@momjian.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Andrew Dunstan wrote:
>
>
> On 04/07/2011 11:01 AM, Tom Lane wrote:
> > Andrew Dunstan<andrew(at)dunslane(dot)net> writes:
> >> I thought about that. What I'd like to know is how many people actually
> >> want and use and expect the current behaviour. If it's more than a
> >> handful (which I seriously doubt) then that's probably the way to go.
> >> Otherwise it seems more trouble than it's worth.
> > Well, the point here is that "is_member_of" is currently considered
> > to be a kind of privilege test, and of course superusers should
> > automatically pass every privilege test. If you want it to not act
> > that way in some circumstances, we need a fairly clear theory as to
> > which circumstances it should act which way in.
> >
> >
>
> Personally, other things being equal I would expect things to operate
> similarly to Unix groups, where root can do just about anything but is
> only actually a member of a small number of groups:
>
> [root(at)emma ~]# groups
> root bin daemon sys adm disk wheel
>
> I bet most DBAs and SAs would expect the same.
>
> The HBA file is the most obvious context in which this actually matters,
> and off hand I can't think of another.

Is this a TODO?

--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ It's impossible for everything to be true. +

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Greg Smith 2011-05-08 04:02:46 Re: Why not install pgstattuple by default?
Previous Message Bruce Momjian 2011-05-08 03:37:07 Re: postgresql.conf error checking strategy