回复: report bug - Mailing list pgsql-bugs

From 断桥烟雨三两月
Subject 回复: report bug
Date
Msg-id tencent_A21DA6DC3396581C4A4E899AFCF9FE12FE06@qq.com
Whole thread Raw
In response to Re: report bug  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-bugs
I got it,thanks


------------------ 原始邮件 ------------------
发件人: "Tom Lane"<tgl@sss.pgh.pa.us>;
发送时间: 2020年4月30日(星期四) 晚上9:47
收件人: "David G. Johnston"<david.g.johnston@gmail.com>;
抄送: "断桥烟雨三两月"<1310659646@qq.com>; "pgsql-bugs"<pgsql-bugs@lists.postgresql.org>;
主题: Re: report bug

"David G. Johnston" <david.g.johnston@gmail.com> writes:
>> So, why a role with NOCREATEDB can create a role who can create DB?

> Cannot answer why but given it is documented as working this way this isn’t
> a bug.

Yeah, that's deliberate.  CREATEROLE is intended to be sufficient
privilege for all day-to-day user/role administration, so that you
don't have to use a superuser bit for that.  The only restriction
on it is you can't manufacture new superuser roles ... but you
definitely can manufacture roles that have other privileges you
don't have yourself.  In particular, a CREATEROLE role can issue
GRANTs for privileges it doesn't have itself; so the behavior with
respect to CREATEDB isn't different from that.

regards, tom lane

.qmbox style, .qmbox script, .qmbox head, .qmbox link, .qmbox meta {display: none !important;}

pgsql-bugs by date:

Previous
From: Tom Lane
Date:
Subject: Re: BUG #16404: PostgreSQL 12.2: Database restore does not accept the EEST time zone.
Next
From: PG Bug reporting form
Date:
Subject: BUG #16405: Exception P0004 not caught in EXCEPTION WHEN OTHERS