database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-30 11:03:19 +03:00
Code Activity

Create default roles

Browse Source 
This creates an initial set of default roles which administrators may
use to grant access to, historically, superuser-only functions.  Using
these roles instead of granting superuser access reduces the number of
superuser roles required for a system.  Documention for each of the
default roles has been added to user-manag.sgml.

Bump catversion to 201604082, as we had a commit that bumped it to
201604081 and another that set it back to 201604071...

Reviews by José Luis Tallón and Robert Haas
This commit is contained in:
Stephen Frost
2016-04-08 16:56:27 -04:00
parent 293007898d
commit 7a542700df
7 changed files with 76 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
doc/src/sgml/func.sgml
View File

@ -17454,7 +17454,8 @@ SELECT set_config('log_statement_stats', 'off', false);
</entry>
<entry><type>boolean</type></entry>
<entry>Cancel a backend's current query. This is also allowed if the
calling role is a member of the role whose backend is being canceled,
calling role is a member of the role whose backend is being canceled or
the calling role has been granted <literal>pg_signal_backend</literal>,
however only superusers can cancel superuser backends.
</entry>
</row>
@ -17478,8 +17479,9 @@ SELECT set_config('log_statement_stats', 'off', false);
</entry>
<entry><type>boolean</type></entry>
<entry>Terminate a backend. This is also allowed if the calling role
is a member of the role whose backend is being terminated, however only
superusers can terminate superuser backends.
is a member of the role whose backend is being terminated or the
calling role has been granted <literal>pg_signal_backend</literal>,
however only superusers can terminate superuser backends.
</entry>
</row>
</tbody>

51
doc/src/sgml/user-manag.sgml
View File

@ -483,6 +483,57 @@ DROP ROLE doomed_role;
</para>
</sect1>
<sect1 id="default-roles">
<title>Default Roles</title>
<indexterm zone="default-roles">
<primary>role</>
</indexterm>
<para>
<productname>PostgreSQL</productname> provides a set of default roles
which provide access to certain, commonly needed, privileged capabilities
and information. Administrators can GRANT these roles to users and/or
other roles in their environment, providing those users with access to
the specified capabilities and information.
</para>
<para>
The default roles are described in <xref linkend="default-roles-table">.
Note that the specific permissions for each of the default roles may
change in the future as additional capabilities are added. Administrators
should monitor the release notes for changes.
</para>
<table tocentry="1" id="default-roles-table">
<title>Default Roles</title>
<tgroup cols="2">
<thead>
<row>
<entry>Role</entry>
<entry>Allowed Access</entry>
</row>
</thead>
<tbody>
<row>
<entry>pg_signal_backend</entry>
<entry>Send signals to other backends (eg: cancel query, terminate).</entry>
</row>
</tbody>
</tgroup>
</table>
<para>
Administrators can grant access to these roles to users using the GRANT
command:
<programlisting>
GRANT pg_signal_backend TO admin_user;
</programlisting>
</para>
</sect1>
<sect1 id="perm-functions">
<title>Function and Trigger Security</title>