Re: almost-super-user problems that we haven't fixed yet

Robert Haas <robertmhaas@gmail.com>

From: Robert Haas <robertmhaas@gmail.com>

To: tushar <tushar.ahuja@enterprisedb.com>

Cc: Nathan Bossart <nathandbossart@gmail.com>, "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>

Date: 2023-01-19T15:31:57Z

Lists: pgsql-hackers

On Thu, Jan 19, 2023 at 9:21 AM tushar <tushar.ahuja@enterprisedb.com> wrote:
> that is not true because the superuser can still able to connect,

It is true, but because superusers have all privileges.

-- 
Robert Haas
EDB: http://www.enterprisedb.com

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

Improve several permission-related error messages.
- de4d456b406b 16.0 landed
Integrate superuser check into has_rolreplication()
- 442f8700656b 16.0 landed
Small code simplification
- 3b7cd8c690f2 16.0 landed
Adjust interaction of CREATEROLE with role properties.
- f1358ca52dd7 16.0 landed
Add new GUC reserved_connections.
- 6e2775e4d4e4 16.0 landed
Rename ReservedBackends variable to SuperuserReservedConnections.
- fe00fec1f5d7 16.0 landed
Update docs and error message for superuser_reserved_connections.
- 6c1d5ba48678 16.0 landed
Add new GUC createrole_self_grant.
- e5b8a4c098ad 16.0 cited
Restrict the privileges of CREATEROLE users.
- cf5eb37c5ee0 16.0 cited
Add a SET option to the GRANT command.
- 3d14e171e9e2 16.0 cited