I understand public is not a typical role in postgres:

dav-gis=# \duS public List of roles Role name | Attributes | Member of -----------+------------+-----------

But why can I revoke all privileges on a schema from public, but not assign another role to public? E.g.,

db=# GRANT "eia-ro" TO "public";
ERROR:  role "public" does not exist

I'd like to only give public users read access through the read-only role, but perhaps this is just out of sync with how public access works in Postgres.


As @Evan Carroll said, there is no "public" role. The manual has this to say:




  • that helps "implicitly defined group that always includes all roles" – Dylan Hettinger Jul 5 '17 at 19:36

There is no role, "public". There is a schema public. The default role of the superuser is postgres. You don't want to revoke privileges to it or mess with it. Keep it locked in PostgreSQL. Keep it as trust with the operating system. Then in order to use it, you have to have it configured with sudo or have root access to the box (in which case, if compromised, you have far more dire problems).

Your Answer

