Re: BUG #1497: Default permissions allow any user to create objects in any database

First paragraph of section 17.4 (Privileges):

"When a database object is created, it is assigned an owner. .... By
default, only an owner (or a superuser) can do anything with the
object. In order to allow other users to use it, privileges must be
granted."

To me, that paragraphs says that only the owner of a database can do
anything with it and all other privileges must be explicitly granted to
others.

-B

On Feb 23, 2005, at 11:10 PM, Bruce Momjian wrote:

> Barry Brown wrote:
>>
>> The following bug has been logged online:
>>
>> Bug reference: 1497
>> Logged by: Barry Brown
>> Email address: barry(at)cs(dot)sierracollege(dot)edu
>> PostgreSQL version: 8.0.1
>> Operating system: RHEL 3.0
>> Description: Default permissions allow any user to create
>> objects in
>> any database
>> Details:
>>
>> The docs say that initially only the owner of a database may use the
>> objects
>> created in it. But I have found that ANY user can work with any
>> object by
>> default, even in the template1 database.
>
> Uh, where did you see that in the docs?
>
> --
> Bruce Momjian | http://candle.pha.pa.us
> pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
> + If your life is a hard drive, | 13 Roberts Road
> + Christ can be your backup. | Newtown Square, Pennsylvania
> 19073