On Thu, Feb 25, 2010 at 08:22, Wappler, Robert <rwapp...@ophardt.com> wrote: > Unfortunately, base_user inherits the connect privileges from role > PUBLIC, regardless, whether it was created with NOINHERIT.
Yeah, IMO the documentation does not really spell out that limitation. > How about changing the CREATEROLE privilege to be associated with a > specific database instead of affecting all databases? Well just on the grounds that it would break every current user of CREATE ROLE... that's probably not going to happen. I could imagine there could be some syntax sugar for this. But I don't think it would be any nicer as you would probably need to REVOKE PUBLIC and inherit anyway. Not to mention I'm not sure what the semantics would be or where it gets its 'default' permissions. A ruff idea would be for each database (except the connected one) REVOKE ALL on database. Of course feel free to flesh it out and submit a patch :). In any event its certainly too late for 9.0 and would not be back patched anyway... -- Sent via pgsql-general mailing list (pgsql-general@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-general