> > > > Can someone who has permission to create databases be trusted not to
> > > > delete others? If we say no, how do we make sure they can change
> > > > pg_database rows on only databases that they own?
> > >
> > > deleting a database is accomplished using 'drop database', no?
> > > Can the code for that not be modified to see whether the person dropping
> > > the database is the person that owns it *or* pgsuperuser?
> >
> > It already does the check, but issues an SQL from the C code to delete
> > from pg_database. I believe any user who can create a database can
> > issue the same SQL command from psql, bypassing the drop database
> > checks, no?
>
> Okay, I understand what you mean here...so I guess the next
> question is should system tables be directly modifyable by non-superuser?
>
> For instance, we have a 'drop database' SQL command...can we
> restrict 'delete from pg_database' to just superuser, while leaving 'drop
> database' open to those with createdb privileges? Same with 'create
> user', and, possible, a 'create group' command instead of 'insert into
> pg_group'?
IMHO, the system tables should _never_ be directly modifiable by anyone
other than the superuser/dba. The rest of the population should have to
use a command of some sort that can be grant/revoked by said superuser/dba.
darrenk