On 03/03/2018 01:56 AM, Noah Misch wrote:
> Commit 5770172 ("Document security implications of search_path and the public
> schema.") is largely a workaround for the fact that the boot_val of
> search_path contains "public" while template0 gets "GRANT CREATE, USAGE ON
> SCHEMA public TO PUBLIC". It's like having world-writable /usr/bin. The
> security team opted not to change that in released branches, but we thought to
> revisit it later. I propose, for v11, switching to "GRANT USAGE ON SCHEMA
> public TO PUBLIC" (omit CREATE). Concerns?
+1. Doing this, or even revoking everything for schema public from
PUBLIC, is already common enough and good practice.
> If we do that alone, databases reaching v11 via dump/reload or pg_upgrade will
> get the new default ACL if they had not changed the ACL of schema public. If
> they had GRANTed or REVOKEd on schema public, pg_dump will recreate the
> resulting ACL. This is the standard pg_dump behavior for ACLs on system
> objects. I think that's okay for the public schema, too, and I like
> preserving that usual rule. However, if we wanted to minimize upgrade-time
> surprises, we could make pg_dump include GRANT for schema public
> unconditionally. That way, the default ACL change would apply to new
> databases only. Does anyone want to argue for that?
What about a pg_dump option to do that and then a big note in the
release notes telling people why they might want to use it?
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
