Re: pgsql: Revoke PUBLIC CREATE from public schema, now owned by pg_databas
Noah Misch <noah@leadboat.com>
From: Noah Misch <noah@leadboat.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-committers@lists.postgresql.org
Date: 2021-12-17T18:25:18Z
Lists: pgsql-hackers
On Fri, Dec 17, 2021 at 12:52:39PM -0500, Tom Lane wrote: > Noah Misch <noah@leadboat.com> writes: > > Revoke PUBLIC CREATE from public schema, now owned by pg_database_owner. > > I've just stumbled across a testing problem created by this commit: > if you try to skip the tablespace test, the rest of the run falls > over, because this bit doesn't get executed: > > -- Rest of this suite can use the public schema freely. > GRANT ALL ON SCHEMA public TO public; > > Skipping the tablespace test is something I've been accustomed to do > when testing replication with the standby on the same machine as the > primary, because otherwise you've got to fool with keeping the > standby from overwriting the primary's tablespaces. This hack made > that a lot more painful. > > I'm inclined to think the cleanest fix is to move this step into a > new script, say "test_setup.sql", that is scheduled by itself just > after tablespace.sql. I like that solution for your use case. > It's sort of annoying to fire up a psql+backend > for just one command, but perhaps there's other stuff that could be > put there too. Yes. The src/test/regress suite would be in a better place if one could run most test files via a schedule containing only two files, the setup file and the file of interest. Adding things like the "CREATE TABLE tenk1" to the setup file would help that.
Commits
-
Doc: word-smith the discussion of secure schema usage patterns.
- ef2d7c6f0ba9 16.0 landed
- afa4a4f764cc 15.2 landed
-
Fix the public schema's permissions in a separate test script.
- 944dc45d1b63 15.0 landed
-
Revoke PUBLIC CREATE from public schema, now owned by pg_database_owner.
- b073c3ccd06e 15.0 cited