tencent cloud

TencentDB for PostgreSQL

Release Notes and Announcements
Release Notes
Product Announcements
Product Introduction
Overview
Features
Strengths
Scenarios
Information Security
Regions and AZs
Product Feature List
Large version lifecycle description
MSSQL Compatible Version
Billing
Billing Overview
Instance Type and Specification
Purchase Methods
Refund
Overdue Payments
Backup Space Billing
Database Audit Billing Overview
Getting Started
Creating TencentDB for PostgreSQL Instance
Connecting to TencentDB for PostgreSQL Instance
Managing TencentDB for PostgreSQL Instance
Importing Data
Migrating Data with DTS
Kernel Version Introduction
Kernel Version Overview
Kernel Version Release Notes
Viewing Kernel Version
Proprietary Kernel Features
Database Audit
Audit Service Description
Activating Audit Service
View Audit Logs
Modify audit services
Audit Performance Description
User Guide
Instance Management
Upgrading Instance
CPU Elastic Scaling
Read-Only Instance
Account Management
Database Management
Parameter Management
Log Management and Analysis
Backup and Restoration
Data Migration
Extension Management
Network Management
Access Management
Data Security
Tenant and Resource Isolation
Security Groups
Monitoring and Alarms
Tag
AI Practice
Using the Tencentdb_ai Plug-In to Call Large Models
Building Ai Applications with the Tencentdb Ai Plug-In
Combining Supabase to Quickly Build Backend Service Based on TencentDB for PostgreSQL
Use Cases
postgres_fdw Extension for Cross-database Access
Automatically Creating Partition in PostgreSQL
Searching in High Numbers of Tags Based on pg_roaringbitmap
Querying People Nearby with One SQL Statement
Configuring TencentDB for PostgreSQL as GitLab's External Data Source
Supporting Tiered Storage Based on cos_fdw Extension
Implement Read/Write Separation via pgpool
Implementing Slow SQL Analysis Using the Auto_explain Plugin
Using pglogical for Logical Replication
Using Debezium to Collect PostgreSQL Data
Set Up a Remote Disaster Recovery Environment for PostgreSQL Locally on CVM
Read-Only Instance and Read-Only Group Practical Tutorial
How to Use SCF for Scheduled Database Operations
Fix Table Bloat
Performance White Paper
Test Methods
Test Results
API Documentation
History
Introduction
API Category
Making API Requests
Instance APIs
Read-Only Instance APIs
Backup and Recovery APIs
Parameter Management APIs
Security Group APIs
Performance Optimization APIs
Account APIs
Specification APIs
Network APIs
Data Types
Error Codes
FAQs
Service Agreement
Service Level Agreement
Terms of Service
Glossary
Contact Us
DocumentaçãoTencentDB for PostgreSQLUser GuideAccount ManagementPUBLIC Permission Operation

PUBLIC Permission Operation

PDF
Modo Foco
Tamanho da Fonte
Última atualização: 2025-11-03 14:21:06
When creating specific objects in PostgreSQL, the system will grant default permissions to the PUBLIC role. The default permissions granted to PUBLIC are as follows. For more permission descriptions, refer to PostgreSQL official documentation:
Object Type
Default PUBLIC Permission
Databases
CONNECT,TEMPORARY
Functions/Procedures
EXECUTE
Languages
USAGE
Data Types
USAGE
Granting permissions to PUBLIC is equivalent to granting them to all users, including those not explicitly created. You can revoke these default PUBLIC permissions as needed for more precise database user authorization. The following context provides detailed examples.
Note:
Kernel versions supporting PUBLIC role-based permission operations are v13.22_r1.26, v14.19_r1.35, v15.14_r1.20, v16.10_r1.15, v17.6_r1.9 and above. TencentDB for PostgreSQL instances with historic kernel minor versions must upgrade minor kernel version to use this capacity.
TencentDB for PostgreSQL instances with historic kernel minor versions must execute drop extension tencentdb_superuser; in the corresponding database, then execute create extension tencentdb_superuser; before using this capacity after upgrading the kernel minor version.
Assuming you have two database accounts, am_a and dbadmin, as shown below. For user creation, refer to Console Operation Guide:

Among them, the database account dbadmin is the OWNER of database test_db, as shown below:

First, we use the account dbadmin to log in to the database test_db, as shown below:
[am@VM-91-60-centos ~]$psql -h10.*.*.* -p5432 -Udbadmin -dtest_db
Password for user dbadmin: 
psql (16.0, server 16.10)
Type "help" for help.
Switch to the am_a account. We can verify that am_a has login permission for the database and query permission for system tables via PUBLIC, as follows:
test_db=> \\c - am_a
psql (16.0, server 16.10)
You are now connected to database "test_db" as user "am_a".
test_db=> select oid FROM pg_class LIMIT 1;
 oid  
------
 2619
(1 row)
After reclaiming PUBLIC permission with the dbadmin account, the am_a account cannot access system tables:
test_db=> \\c - dbadmin
Password for user dbadmin: 
psql (16.0, server 16.10)
You are now connected to database "test_db" as user "dbadmin".
test_db=> REVOKE SELECT ON pg_class FROM PUBLIC;
REVOKE
test_db=> \\c - am_a
Password for user am_a: 
psql (16.0, server 16.10)
You are now connected to database "test_db" as user "am_a".
test_db=> select oid FROM pg_class LIMIT 1;
ERROR:  permission denied for table pg_class
After reclaiming PUBLIC permission with the dbadmin account, the am_a account is unable to connect to database test_db.
test_db=> \\c - dbadmin
Password for user dbadmin: 
psql (16.0, server 16.10)
You are now connected to database "test_db" as user "dbadmin".
test_db=> REVOKE CONNECT ON DATABASE test_db FROM PUBLIC;
REVOKE
test_db=> \\c - am_a 
Password for user am_a: 
connection to server at "10.*.*.*", port 5432 failed: FATAL:  permission denied for database "test_db"
DETAIL:  User does not have CONNECT privilege.
Previous connection kept
After regranting am_a privileges using the dbadmin account, am_a can connect to the database test_db and can access system tables:
test_db=> \\c - dbadmin
psql (16.0, server 16.10)
You are now connected to database "test_db" as user "dbadmin".
test_db=> GRANT CONNECT ON DATABASE test_db TO am_a;
GRANT
test_db=> GRANT SELECT ON pg_class TO am_a;
GRANT
test_db=> \\c - am_a
Password for user am_a: 
psql (16.0, server 16.10)
You are now connected to database "test_db" as user "am_a".
test_db=> select oid FROM pg_class LIMIT 1;
 oid  
------
 2619
(1 row)
Anterior: Console Operation InstructionsPróximo: Database Management via Console

Ajuda e Suporte

Esta página foi útil?

comentários