Re: [HACKERS] CREATEROLE, CREATEDB

2007-06-05 Thread Chander Ganesan
Peter Eisentraut wrote: Is it correct that a user with CREATEROLE privilege but without CREATEDB privilege can create a user with *CREATEDB* privilege, thus bypassing his original restrictions? This sequence doesn't look right: pei=# create user foo1 createrole; CREATE ROLE pei=# \c - foo1 Yo

Re: [HACKERS] CREATEROLE, CREATEDB

2007-06-05 Thread Tom Lane
Bernd Helmle <[EMAIL PROTECTED]> writes: > --On Dienstag, Juni 05, 2007 16:04:44 +0200 Peter Eisentraut > <[EMAIL PROTECTED]> wrote: >> Is it correct that a user with CREATEROLE privilege but without CREATEDB >> privilege can create a user with *CREATEDB* privilege, thus bypassing his >> original

Re: [HACKERS] CREATEROLE, CREATEDB

2007-06-05 Thread Bernd Helmle
--On Dienstag, Juni 05, 2007 16:04:44 +0200 Peter Eisentraut <[EMAIL PROTECTED]> wrote: Is it correct that a user with CREATEROLE privilege but without CREATEDB privilege can create a user with *CREATEDB* privilege, thus bypassing his original restrictions? This sequence doesn't look right: p

[HACKERS] CREATEROLE, CREATEDB

2007-06-05 Thread Peter Eisentraut
Is it correct that a user with CREATEROLE privilege but without CREATEDB privilege can create a user with *CREATEDB* privilege, thus bypassing his original restrictions? This sequence doesn't look right: pei=# create user foo1 createrole; CREATE ROLE pei=# \c - foo1 You are now connected to dat