Default privileges for new databases (was Re: Can't import large objects in most recent cvs) - Mailing list pgsql-hackers

From Tom Lane
Subject Default privileges for new databases (was Re: Can't import large objects in most recent cvs)
Date
Msg-id 1695.1023587707@sss.pgh.pa.us
Whole thread Raw
In response to Re: Can't import large objects in most recent cvs (2002  (Ron Snyder <snyder@roguewave.com>)
Responses Re: Default privileges for new databases (was Re: Can't import large objects in most recent cvs)  (Josh Berkus <josh@agliodbs.com>)
Re: Default privileges for new databases (was Re: Can't  (Peter Eisentraut <peter_e@gmx.net>)
Re: Default privileges for new databases (was Re: Can't import  (Bruce Momjian <pgman@candle.pha.pa.us>)
List pgsql-hackers
Ron Snyder <snyder@roguewave.com> writes:
> May 31 16:11:50 vault pgcvs[2135]: [91] LOG:  query: Create Temporary Table
> pg_dump_blob_xref(oldOid pg_catalog.oid, newOid pg_catalog.oid);
> May 31 16:11:50 vault pgcvs[2135]: [93] ERROR:  quickview: not authorized to
> create temp tables

> My theory is that I'm getting this last message (not authorized to create
> temp tables) because the permissions have been tightened down.

Yeah.  Right at the moment, new databases default to only-db-owner-has-
any-rights, which means that others cannot create schemas or temp tables
in that database (unless they're superusers).  I'm of the opinion that
this is a bad default, but was waiting to see if anyone complained
before starting a discussion about it.

Probably we should have temp table creation allowed to all by default.
I'm not convinced that that's a good idea for schema-creation privilege
though.  Related issues: what should initdb set as the permissions for
template1?  Would it make sense for newly created databases to copy
their permission settings from the template database?  (Probably not,
since the owner is likely to be different.)  What about copying those
per-database config settings Peter just invented?

Comments anyone?  
        regards, tom lane


pgsql-hackers by date:

Previous
From: Bruce Momjian
Date:
Subject: Re: Per tuple overhead, cmin, cmax, OID
Next
From: Tom Lane
Date:
Subject: Re: [Fwd: Bug#149056: postgresql: should not try in a busy loop when allocating resources]