Re: Restricting the CREATEROLE privilege

On 2010-02-25, Alex Hunsaker wrote:

> You could create a base role that does not have connect privileges on
> the other databases. Then just inherit from that role. Something
like:
> CREATE ROLE base_user; REVOKE CONNECT ON database from base_user; ...
>
> CREATE ROLE my_user inherit base_user;
>

Unfortunately, base_user inherits the connect privileges from role
PUBLIC, regardless, whether it was created with NOINHERIT.

> You could also go the other route and default deny connect databases
> and explicitly allow connect.
>

That other way round seems to be the only solution for now, first revoke
the CONNECT privileges from PUBLIC and then grant them to individual
roles.

How about changing the CREATEROLE privilege to be associated with a
specific database instead of affecting all databases?

--
Robert...