Horton

Revoke PUBLIC CREATE from public schema, now owned by pg_database_owner.

Noah Misch <noah@leadboat.com>

View on postgr.es
Commit: b073c3ccd06e4cb845e121387a43faa8c68a7b62
Author: Noah Misch <noah@leadboat.com>
Date: 2021-09-10T06:38:09Z
Releases: 15.0 
Revoke PUBLIC CREATE from public schema, now owned by pg_database_owner.

This switches the default ACL to what the documentation has recommended
since CVE-2018-1058.  Upgrades will carry forward any old ownership and
ACL.  Sites that declined the 2018 recommendation should take a fresh
look.  Recipes for commissioning a new database cluster from scratch may
need to create a schema, grant more privileges, etc.  Out-of-tree test
suites may require such updates.

Reviewed by Peter Eisentraut.

Discussion: https://postgr.es/m/20201031163518.GB4039133@rfd.leadboat.com

Files

PathChange+/−
contrib/postgres_fdw/expected/postgres_fdw.out modified +1 −1
contrib/postgres_fdw/sql/postgres_fdw.sql modified +1 −1
doc/src/sgml/ddl.sgml modified +31 −25
doc/src/sgml/user-manag.sgml modified +10 −9
src/bin/initdb/initdb.c modified +1 −2
src/bin/pg_dump/pg_dump.c modified +17 −11
src/bin/pg_dump/t/002_pg_dump.pl modified +8 −11
src/include/catalog/catversion.h modified +1 −1
src/include/catalog/pg_namespace.dat modified +1 −1
src/pl/plperl/expected/plperl_setup.out modified +4 −0
src/pl/plperl/sql/plperl_setup.sql modified +4 −0
src/test/regress/input/tablespace.source modified +4 −1
src/test/regress/output/tablespace.source modified +3 −1

Documentation touched

Discussion