| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | "David G(dot) Johnston" <david(dot)g(dot)johnston(at)gmail(dot)com> |
| Cc: | Robert Haas <robertmhaas(at)gmail(dot)com>, "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER |
| Date: | 2022-07-21 16:46:57 |
| Message-ID: | 72971.1658422017@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
"David G. Johnston" <david(dot)g(dot)johnston(at)gmail(dot)com> writes:
> On Thu, Jul 21, 2022 at 9:28 AM Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>> True, but what if the idea is to have *no* superusers? I seem
>> to recall people being interested in setups like that.
> I would expect an initdb option (once this is possible) to specify this
> desire and we just never set one up in the first place. It seems
> impractical to remove one after it already exists.
There has to be a role that owns the built-in objects. Robert's point
is that pretending that that role isn't high-privilege is silly.
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Robert Haas | 2022-07-21 16:47:30 | Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER |
| Previous Message | David G. Johnston | 2022-07-21 16:41:04 | Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER |