We are administrating DB in kubernetes to our customers. For each new cluster, we create a new user with CREATE ROLE and CREATE DB roles given to them, so that they can create their own databases and new users with stricter roles. The problem is, with CREATE ROLE permission, the user can GRANT himself "pg_execute_server_program" role, and then use reverse shell attack and then get shell from our pod and read the environment variables, which is not desired. e.g. we have several secrets in env vars that the customer can take advantage of and then increase their attack range and take over more things.

In short, I want to have a user that can create new users, but can't grant himself specific predefined roles.

Update: I looked and found that ADMIN_OPTION has been added in PostgreSQL 16 to resolve such issue. My problem is we're using PostgreSQL version 13,14,15 and we can't just force upgrade all clusters.

Thanks.

We are administrating DB in kubernetes to our customers. For each new cluster, we create a new user with CREATE ROLE and CREATE DB roles given to them, so that they can create their own databases and new users with stricter roles.

The problem is, with CREATE ROLE permission, the user can GRANT himself pg_execute_server_program role, and then use reverse shell attack and then get shell from our pod and read the environment variables, which is not desired. E.g. we have several secrets in env vars that the customer can take advantage of and then increase their attack range and take over more things.

In short, I want to have a user that can create new users, but can't grant himself specific predefined roles.

Update: I looked and found that ADMIN_OPTION has been added in PostgreSQL 16 to resolve such issue. My problem is we're using PostgreSQL version 13,14,15 and we can't just force upgrade all clusters.

We are administrating DB in kubernetes to our customers. For each new cluster, we create a new user with CREATE ROLE and CREATE DB roles given to them, so that they can create their own databases and new users with stricter roles. The problem is, with CREATE ROLE permission, the user can GRANT himself "pg_execute_server_program" role, and then use reverse shell attack and then get shell from our pod and read the environment variables, which is not desired. e.g. we have several secrets in env vars that the customer can take advantage of and then increase their attack range and take over more things.

In short, I want to have a user that can create new users, but can't grant himself specific predefined roles.

Thanks.

We are administrating DB in kubernetes to our customers. For each new cluster, we create a new user with CREATE ROLE and CREATE DB roles given to them, so that they can create their own databases and new users with stricter roles. The problem is, with CREATE ROLE permission, the user can GRANT himself "pg_execute_server_program" role, and then use reverse shell attack and then get shell from our pod and read the environment variables, which is not desired. e.g. we have several secrets in env vars that the customer can take advantage of and then increase their attack range and take over more things.

In short, I want to have a user that can create new users, but can't grant himself specific predefined roles.

Update: I looked and found that ADMIN_OPTION has been added in PostgreSQL 16 to resolve such issue. My problem is we're using PostgreSQL version 13,14,15 and we can't just force upgrade all clusters.

Thanks.