Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER - Mailing list pgsql-hackers

From Tom Lane
Subject Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER
Date
Msg-id 72971.1658422017@sss.pgh.pa.us
Whole thread Raw
In response to Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER  ("David G. Johnston" <david.g.johnston@gmail.com>)
Responses Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER
List pgsql-hackers
"David G. Johnston" <david.g.johnston@gmail.com> writes:
> On Thu, Jul 21, 2022 at 9:28 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> True, but what if the idea is to have *no* superusers?  I seem
>> to recall people being interested in setups like that.

> I would expect an initdb option (once this is possible) to specify this
> desire and we just never set one up in the first place.  It seems
> impractical to remove one after it already exists.

There has to be a role that owns the built-in objects.  Robert's point
is that pretending that that role isn't high-privilege is silly.

            regards, tom lane



pgsql-hackers by date:

Previous
From: "David G. Johnston"
Date:
Subject: Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER
Next
From: Robert Haas
Date:
Subject: Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER