450019844(at)qq(dot)com writes:
> step1:revoke "postgres" database user's superuser privilege.
That's not particularly a supported operation...
> step2:excute query "select relacl from pg_class where relname='pg_authid';"
> the query result is "{postgres=arwdDxt/postgres}"
> here it says "postgres" database user still has the update privilege ,but in
> fact it can't.
There's an additional security filter, independent of granted privileges,
that says that only superusers can directly update system catalogs.
regards, tom lane