Re: "REVOKE ... ON DATABASE template1 ..." has no effect

On 15/05/18 03:43, Tom Lane wrote:
> Ralf Jung <post(at)ralfj(dot)de> writes:
>> I would have expected a "REVOKE ALL ON DATABASE template1" to have the effect of
>> changing the default permissions for new databases.
> This is not a bug, and I don't think it's a reasonable expectation either.
> There's certainly plenty of reasons why you might wish to lock people out
> of template1, but that doesn't equate to supposing that people should be
> locked out of every new database. Nor do we copy most other
> database-level attributes when cloning a database (the exceptions are
> things that affect the database contents, such as encoding).
>
> There might be an argument for extending ALTER DEFAULT PRIVILEGES so that
> it can control the initial default privileges for new databases. That's
> certainly a feature request not a bug though.
>
> regards, tom lane
>
Would definitely agree with Tom on both points!

Cheers,
Gavin