Re: BUG #1497: Default permissions allow any user to create objects in any database

First paragraph of section 17.4 (Privileges):

"When a database object is created, it is assigned an owner. .... By
default, only an owner (or a superuser) can do anything with the
object. In order to allow other users to use it, privileges must be
granted."

To me, that paragraphs says that only the owner of a database can do
anything with it and all other privileges must be explicitly granted to
others.

-B

On Feb 23, 2005, at 11:10 PM, Bruce Momjian wrote:

> Barry Brown wrote:
>>
>> The following bug has been logged online:
>>
>> Bug reference:      1497
>> Logged by:          Barry Brown
>> Email address:      barry@cs.sierracollege.edu
>> PostgreSQL version: 8.0.1
>> Operating system:   RHEL 3.0
>> Description:        Default permissions allow any user to create
>> objects in
>> any database
>> Details:
>>
>> The docs say that initially only the owner of a database may use the
>> objects
>> created in it. But I have found that ANY user can work with any
>> object by
>> default, even in the template1 database.
>
> Uh, where did you see that in the docs?
>
> --
>   Bruce Momjian                        |  http://candle.pha.pa.us
>   pgman@candle.pha.pa.us               |  (610) 359-1001
>   +  If your life is a hard drive,     |  13 Roberts Road
>   +  Christ can be your backup.        |  Newtown Square, Pennsylvania
> 19073