Re: superusers are members of all roles?

On 04/07/2011 11:01 AM, Tom Lane wrote:
> Andrew Dunstan<andrew(at)dunslane(dot)net> writes:
>> I thought about that. What I'd like to know is how many people actually
>> want and use and expect the current behaviour. If it's more than a
>> handful (which I seriously doubt) then that's probably the way to go.
>> Otherwise it seems more trouble than it's worth.
> Well, the point here is that "is_member_of" is currently considered
> to be a kind of privilege test, and of course superusers should
> automatically pass every privilege test. If you want it to not act
> that way in some circumstances, we need a fairly clear theory as to
> which circumstances it should act which way in.
>
>

Personally, other things being equal I would expect things to operate
similarly to Unix groups, where root can do just about anything but is
only actually a member of a small number of groups:

[root(at)emma ~]# groups
root bin daemon sys adm disk wheel

I bet most DBAs and SAs would expect the same.

The HBA file is the most obvious context in which this actually matters,
and off hand I can't think of another.

cheers

andrew