Simon Riggs <simon@2ndquadrant.com> writes:
> On Mon, 2007-09-24 at 14:44 +0200, Dawid Kuroczko wrote:
>> Hello, I see that I can modify system tables even though I have
>> not set allow_system_table_mods... Is this a feature or a bug?
> allow_system_table_mods allows you to modify the structure, not just the
> data, i.e. add additional columns to system tables.
> Superusers have the capability to modify data in catalog tables and many
> other things besides, normal users don't.
It is possible to disable this by turning off your
pg_authid.rolcatupdate flag, but AFAIR there is no handy support for
that (eg, no separate ALTER ROLE option).
The better advice though is "don't run as superuser except when you
absolutely must". You don't do random work as root, do you?
regards, tom lane