Re: BUG #13694: Row Level Security by-passed with CREATEUSER permission

Joe Conway <mail@joeconway.com> writes:
> On 10/21/2015 09:42 AM, justin.catterson@sofiebio.com wrote:
>> Users with the CREATEUSER permission do not evaluate Row Level Security
>> functions.  pg_user usebypassrls is set to false.

> Not a bug. See
>  http://www.postgresql.org/docs/9.5/static/sql-createrole.html

> "CREATEUSER
> NOCREATEUSER

>     These clauses are an obsolete, but still accepted, spelling of
> SUPERUSER and NOSUPERUSER. Note that they are not equivalent to
> CREATEROLE as one might naively expect!"

I wonder if it's time yet to remove those keywords.  We've had the
SUPERUSER spelling since 8.1, and this report should remind us that
people get confused by the old spellings.

            regards, tom lane