• Stephen Frost's avatar
    Add pg_read_all_data and pg_write_all_data roles · 6c3ffd69
    Stephen Frost authored
    A commonly requested use-case is to have a role who can run an
    unfettered pg_dump without having to explicitly GRANT that user access
    to all tables, schemas, et al, without that role being a superuser.
    This address that by adding a "pg_read_all_data" role which implicitly
    gives any member of this role SELECT rights on all tables, views and
    sequences, and USAGE rights on all schemas.
    
    As there may be cases where it's also useful to have a role who has
    write access to all objects, pg_write_all_data is also introduced and
    gives users implicit INSERT, UPDATE and DELETE rights on all tables,
    views and sequences.
    
    These roles can not be logged into directly but instead should be
    GRANT'd to a role which is able to log in.  As noted in the
    documentation, if RLS is being used then an administrator may (or may
    not) wish to set BYPASSRLS on the login role which these predefined
    roles are GRANT'd to.
    
    Reviewed-by: Georgios Kokolatos
    Discussion: https://postgr.es/m/20200828003023.GU29590@tamriel.snowman.net
    6c3ffd69
privileges.sql 54.1 KB