Skip to main content
4 votes

Can a user with db_ddladmin elevate their privileges to db_owner

Yes. As the docs say Members of this role can potentially elevate their privileges by manipulating code that may get executed under high privileges and their actions should be monitored. Database-...
David Browne - Microsoft's user avatar
4 votes
Accepted

How do I see which roles have `admin option` on them?

The admin option is set for a membership of a role in another role (a.k.a. "group role"). So it's not an attribute of the role itself. Information about memberships is stored in the system ...
Erwin Brandstetter's user avatar
1 vote
Accepted

Logical replication security risk with run_as_owner = false

The risk is the other way around. If you are an unprivileged user and own a table to which data are replicated by the subscription, you could create a trigger on that table and define it as a replica ...
Laurenz Albe's user avatar
  • 53.4k
1 vote
Accepted

ALTER ROLE DROP MEMBER succeeds but doesn't drop member

This is because your domain\user is a Windows group member, and that Windows group is the member of the role from which you want to remove your user. I show you an example: My domain account BL-DB-...
sepupic's user avatar
  • 11k
1 vote

Need a Role that can CREATE USER but not allowed to GRANT Predefined Roles in PostgreSQL <16

If you aren't stuck with only executing CREATE ROLE then create a custom function / procedure to allow your customers to create new users. That function would need to be created with SECURITY DEFINER ...
Richard Huxton's user avatar
1 vote

Need a Role that can CREATE USER but not allowed to GRANT Predefined Roles in PostgreSQL <16

You have to use at least PostgreSQL v16. In that version, CREATEROLE has been modified so that it doesn't allow you to grant membership in arbitrary roles. You can only grant membership in roles for ...
Laurenz Albe's user avatar
  • 53.4k
1 vote

Postgresql: Even when I grant the owner role, I can't alter tables

The problem is that bar has NOINHERIT set, which means that it doesn't automatically assume the privileges of roles granted to it. I can fix this on a query-by-query basis by having bar first do SET ...
Isaac Moses's user avatar
1 vote

How to get all roles that a user is a member of (including inherited roles)?

Strongly based on Erwin Brandstetter's answer, but also: Removing duplicates (the same role can appear in multiple places in the "tree" of parent roles) Does not use the magic ::regrole to ...
Michal Charemza's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible