Re: Revoke "drop database" even for superusers?

From: "Albe Laurenz" <laurenz(dot)albe(at)wien(dot)gv(dot)at>
To: <richter(at)simkorp(dot)com(dot)br>, <pgsql-general(at)postgresql(dot)org>
Subject: Re: Revoke "drop database" even for superusers?
Date: 2012-11-09 11:42:37
Message-ID: D960CB61B694CF459DCFB4B0128514C208AF01A7@exadv11.host.magwien.gv.at
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Edson Richter wrote:
> I've a bunch of databases that cannot be dropped in any case.
>
> I was wondering if it is possible to revoke "drop database" permission
for all users, in order that
> even superuser, if he wishes to drop a database, he will need first to
"grant drop database" first.
>
> I know there is already a safety that does not allow dropping
databases in use - I just want to make
> even harder.

You cannot play it over permissions, but what about the following trick:

postgres=# CREATE DATABASE persist;
CREATE DATABASE
postgres=# UPDATE pg_database SET datistemplate=TRUE WHERE
datname='persist';
UPDATE 1
postgres=# DROP DATABASE persist;
ERROR: cannot drop a template database

Yours,
Laurenz Albe

In response to

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Albe Laurenz 2012-11-09 11:56:33 Re: explain plan visibility
Previous Message Edson Richter 2012-11-09 11:19:58 Revoke "drop database" even for superusers?