每个用户都可以使用 pg_restore 恢复转储吗？

Question

I created a user on local PostgreSQL instance using this command:

create role testuser with login password 'test' 

Then I created a blank database and used pg_restore to restore a backup on the newly created database using this command:

pg_restore -c -h 172.27.211.11 -U testuser -d abcd_test1  "E:\testbackup_20180509_2330.backup"

Surprisingly, the backup got restored. Does that mean all users have the right to restore the database?

Is there any way to prevent a user from restoring the database?

Answer 1

Unless you gave testuser the CREATE permission on abcd_test1 , that can only work if all objects in the dump are in the public schema. Otherwise you'd get errors as soon an pg_restore tries to create the schemas.

What you observe is caused by two things:

1. Every database has CONNECT permissions for PUBLIC by default.

2. the public schema has CREATE permissions for PUBLIC by default.

Since PUBLIC is the pseudo-role that everybody belongs to, testuser can connect and create objects in the public schema.

It is a good idea to restrict permissions on every new PostgreSQL database:

REVOKE ALL ON DATABASE abcd_test1 FROM PUBLIC;
REVOKE CREATE ON SCHEMA public FROM PUBLIC;

Then you can deal out permissions in a more restrictive fashion.