Thanks for your reply.
Actually, AFAICT, revoking usage on the schemas you listed seems to have no effect at all on the "minimal role"'s ability to use \l, \d, \dt, etc.kynn
On Mon, Jun 30, 2014 at 5:37 PM, Jerry Sievers <gsievers19@xxxxxxxxxxx> wrote:
Kynn Jones <kynnjo@xxxxxxxxx> writes:Some new role created and not granted anything has only public rights
> How does one define the most limited role/user possible in PostgreSQL?
>
> Ideally, this role would not be able to do *anything* at all. In particular, this role would not be able to query meta-information about existing tables, functions,
> etc. with backslash commands such as \dt, \df.
which by default is the lowest level of privilege but as you probably
are aware does permit creating objects in public schema and viewing
certain system info.
But you can revoke usage on schemas; public, pg_catalog,
information_schema to create the illusion of even tighter than default
perms.
You would then need to grant usage on those schemas to some other role
and give this role to real new roles/users who are permitted to do
those things.
--
>
> (Of course, in practice such a role would not correspond to any real role. Its purpose, rather, is to serve as the starting point for defining more realistic roles by
> selectively adding the fewest privileges possible).
>
> TIA for any pointers!
>
> kynn
>
Jerry Sievers
Postgres DBA/Development Consulting
e: postgres.consulting@xxxxxxxxxxx
p: 312.241.7800
