Re: Largeobject Access Controls (r2460)

Tom Lane wrote:
> Takahiro Itagaki <itagaki.takahiro@oss.ntt.co.jp> writes:
>> OK, I'll add the following description in the documentation of pg_largeobject.
> 
>>    <structname>pg_largeobject</structname> should not be readable by the
>>    public, since the catalog contains data in large objects of all users.
> 
> This is going to be a problem, because it will break applications that
> expect to be able to read pg_largeobject.  Like, say, pg_dump.

Is it a right behavior, even if we have permission checks on large objects?

If so, we can inject a hardwired rule to prevent to select pg_largeobject
when lo_compat_privileges is turned off, instead of REVOKE ALL FROM PUBLIC.

-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>