Re: pgsql: Revoke PUBLIC CREATE from public schema, now owned by pg_databas

Tom Lane <tgl@sss.pgh.pa.us>

From: Tom Lane <tgl@sss.pgh.pa.us>
To: Noah Misch <noah@leadboat.com>
Cc: pgsql-committers@lists.postgresql.org
Date: 2021-12-17T18:41:00Z
Lists: pgsql-hackers
Noah Misch <noah@leadboat.com> writes:
> On Fri, Dec 17, 2021 at 12:52:39PM -0500, Tom Lane wrote:
>> It's sort of annoying to fire up a psql+backend
>> for just one command, but perhaps there's other stuff that could be
>> put there too.

> Yes.  The src/test/regress suite would be in a better place if one could run
> most test files via a schedule containing only two files, the setup file and
> the file of interest.  Adding things like the "CREATE TABLE tenk1" to the
> setup file would help that.

If we're thinking of a generalized setup file, putting it after the
tablespace test feels pretty weird.  What was your motivation for
doing this at the end of tablespace.source rather than the start?
It doesn't look like that test in itself had any interesting
dependencies on public not being writable.

			regards, tom lane



Commits

  1. Doc: word-smith the discussion of secure schema usage patterns.

  2. Fix the public schema's permissions in a separate test script.

  3. Revoke PUBLIC CREATE from public schema, now owned by pg_database_owner.