Kynn Jones <kynnjo@xxxxxxxxx> writes: > How does one define the most limited role/user possible in PostgreSQL? > > Ideally, this role would not be able to do *anything* at all. In particular, this role would not be able to query meta-information about existing tables, functions, > etc. with backslash commands such as \dt, \df. Some new role created and not granted anything has only public rights which by default is the lowest level of privilege but as you probably are aware does permit creating objects in public schema and viewing certain system info. But you can revoke usage on schemas; public, pg_catalog, information_schema to create the illusion of even tighter than default perms. You would then need to grant usage on those schemas to some other role and give this role to real new roles/users who are permitted to do those things. > > (Of course, in practice such a role would not correspond to any real role. Its purpose, rather, is to serve as the starting point for defining more realistic roles by > selectively adding the fewest privileges possible). > > TIA for any pointers! > > kynn > -- Jerry Sievers Postgres DBA/Development Consulting e: postgres.consulting@xxxxxxxxxxx p: 312.241.7800
