Horton

Re: pgsql: Fix search_path to a safe value during maintenance operations.

David G. Johnston <david.g.johnston@gmail.com>

View thread View on postgr.es
From: "David G. Johnston" <david.g.johnston@gmail.com>
To: Jeff Davis <pgsql@j-davis.com>
Cc: Noah Misch <noah@leadboat.com>, Tom Lane <tgl@sss.pgh.pa.us>, Jeff Davis <jdavis@postgresql.org>, "pgsql-committers@lists.postgresql.org" <pgsql-committers@lists.postgresql.org>
Date: 2023-06-13T20:22:01Z
Lists: pgsql-hackers 
On Tue, Jun 13, 2023 at 12:54 PM Jeff Davis <pgsql@j-davis.com> wrote:

> On Mon, 2023-06-12 at 18:31 -0700, David G. Johnston wrote:
> > On a related note, are we OK with someone using this privilege
> > setting their own default_statistics_target?
> >
> >
> https://www.postgresql.org/docs/current/runtime-config-query.html#GUC-DEFAULT-STATISTICS-TARGET
> >
> > My prior attempt to open up analyze had brought this up as a reason
> > to avoid having someone besides the table owner allowed to analyze
> > the table.
>
> Thank you for bringing it up. I don't see a major concern there, but
> please link to the prior discussion so I can see the objections.
>
>
This is the specific (first?) message I am recalling.

https://www.postgresql.org/message-id/A737B7A37273E048B164557ADEF4A58B53803F5A%40ntex2010i.host.magwien.gv.at

David J.

Commits

  1. Fix search_path to a safe value during maintenance operations.

  2. Revert MAINTAIN privilege and pg_maintain predefined role.

  3. Add grantable MAINTAIN privilege and pg_maintain role.

  4. Revoke PUBLIC CREATE from public schema, now owned by pg_database_owner.