crunchy_check_access
crunchy_check_access copied to clipboard
all_access() returns incomplete results?
Following the examples in your blog article https://info.crunchydata.com/blog/postgresql-defaults-and-impact-on-security-part-1, all_access()
seems to return incomplete results: joe is a member of both dbadm and endusers, so his privileges should be the same as alice, however array_agg(base_role)
does not contain him, while alice is in the list. I've verified on a PostgreSQL 11 installation that joe can SET ROLE dbadm
then CREATE DATABASE joe
.
@hai-ld I was not able to reproduce the issue. In the output from all_access I do see both joe and alice listed. Let us know if you are still facing challenges.