pgsql/doc/src/sgml/html/predefined-roles.html - master - Ao/MaxReport

pgsql/doc/src/sgml/html/predefined-roles.html
124 строки13 KB
AoAnima
first_commit
13 июл 2026, 17:47
13 июл 2026, 17:47f1a670a
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>21.5. Predefined Roles</title><link rel="stylesheet" type="text/css" href="stylesheet.css" /><link rev="made" href="pgsql-docs@lists.postgresql.org" /><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot" /><link rel="prev" href="role-removal.html" title="21.4. Dropping Roles" /><link rel="next" href="perm-functions.html" title="21.6. Function Security" /></head><body id="docContent" class="container-fluid col-10"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="5" align="center">21.5. Predefined Roles</th></tr><tr><td width="10%" align="left"><a accesskey="p" href="role-removal.html" title="21.4. Dropping Roles">Prev</a> </td><td width="10%" align="left"><a accesskey="u" href="user-manag.html" title="Chapter 21. Database Roles">Up</a></td><th width="60%" align="center">Chapter 21. Database Roles</th><td width="10%" align="right"><a accesskey="h" href="index.html" title="PostgreSQL 18.4 Documentation">Home</a></td><td width="10%" align="right"> <a accesskey="n" href="perm-functions.html" title="21.6. Function Security">Next</a></td></tr></table><hr /></div><div class="sect1" id="PREDEFINED-ROLES"><div class="titlepage"><div><div><h2 class="title" style="clear: both">21.5. Predefined Roles <a href="#PREDEFINED-ROLES" class="id_link">#</a></h2></div></div></div><a id="id-1.6.8.9.2" class="indexterm"></a><p>
   <span class="productname">PostgreSQL</span> provides a set of predefined roles
   that provide access to certain, commonly needed, privileged capabilities
   and information.  Administrators (including roles that have the
   <code class="literal">CREATEROLE</code> privilege) can <code class="command">GRANT</code> these
   roles to users and/or other roles in their environment, providing those
   users with access to the specified capabilities and information.  For
   example:

</p><pre class="programlisting">
GRANT pg_signal_backend TO admin_user;
</pre><p>
  </p><div class="warning"><h3 class="title">Warning</h3><p>
    Care should be taken when granting these roles to ensure they are only used
    where needed and with the understanding that these roles grant access to
    privileged information.
   </p></div><p>
   The predefined roles are described below.
   Note that the specific permissions for each of the roles may change in
   the future as additional capabilities are added.  Administrators
   should monitor the release notes for changes.

   </p><div class="variablelist"><dl class="variablelist"><dt id="PREDEFINED-ROLE-PG-CHECKPOINT"><span class="term"><code class="varname">pg_checkpoint</code></span> <a href="#PREDEFINED-ROLE-PG-CHECKPOINT" class="id_link">#</a></dt><dd><p>
       <code class="literal">pg_checkpoint</code> allows executing the
       <a class="link" href="sql-checkpoint.html" title="CHECKPOINT"><code class="command">CHECKPOINT</code></a> command.
      </p></dd><dt id="PREDEFINED-ROLE-PG-CREATE-SUBSCRIPTION"><span class="term"><code class="varname">pg_create_subscription</code></span> <a href="#PREDEFINED-ROLE-PG-CREATE-SUBSCRIPTION" class="id_link">#</a></dt><dd><p>
       <code class="literal">pg_create_subscription</code> allows users with
       <code class="literal">CREATE</code> permission on the database to issue
       <a class="link" href="sql-createsubscription.html" title="CREATE SUBSCRIPTION"><code class="command">CREATE SUBSCRIPTION</code></a>.
      </p></dd><dt id="PREDEFINED-ROLE-PG-DATABASE-OWNER"><span class="term"><code class="varname">pg_database_owner</code></span> <a href="#PREDEFINED-ROLE-PG-DATABASE-OWNER" class="id_link">#</a></dt><dd><p>
       <code class="literal">pg_database_owner</code> always has exactly one implicit
       member: the current database owner.  It cannot be granted membership in
       any role, and no role can be granted membership in
       <code class="literal">pg_database_owner</code>.  However, like any other role, it
       can own objects and receive grants of access privileges.  Consequently,
       once <code class="literal">pg_database_owner</code> has rights within a template
       database, each owner of a database instantiated from that template will
       possess those rights.  Initially, this role owns the
       <code class="literal">public</code> schema, so each database owner governs local
       use of that schema.
      </p></dd><dt id="PREDEFINED-ROLE-PG-MAINTAIN"><span class="term"><code class="varname">pg_maintain</code></span> <a href="#PREDEFINED-ROLE-PG-MAINTAIN" class="id_link">#</a></dt><dd><p>
       <code class="literal">pg_maintain</code> allows executing
       <a class="link" href="sql-vacuum.html" title="VACUUM"><code class="command">VACUUM</code></a>,
       <a class="link" href="sql-analyze.html" title="ANALYZE"><code class="command">ANALYZE</code></a>,
       <a class="link" href="sql-cluster.html" title="CLUSTER"><code class="command">CLUSTER</code></a>,
       <a class="link" href="sql-refreshmaterializedview.html" title="REFRESH MATERIALIZED VIEW"><code class="command">REFRESH MATERIALIZED VIEW</code></a>,
       <a class="link" href="sql-reindex.html" title="REINDEX"><code class="command">REINDEX</code></a>,
       and <a class="link" href="sql-lock.html" title="LOCK"><code class="command">LOCK TABLE</code></a> on all
       relations, as if having <code class="literal">MAINTAIN</code> rights on those
       objects.
      </p></dd><dt id="PREDEFINED-ROLE-PG-MONITOR"><span class="term"><code class="varname">pg_monitor</code><br /></span><span class="term"><code class="varname">pg_read_all_settings</code><br /></span><span class="term"><code class="varname">pg_read_all_stats</code><br /></span><span class="term"><code class="varname">pg_stat_scan_tables</code></span> <a href="#PREDEFINED-ROLE-PG-MONITOR" class="id_link">#</a></dt><dd><p>
       These roles are intended to allow administrators to easily configure a
       role for the purpose of monitoring the database server.  They grant a
       set of common privileges allowing the role to read various useful
       configuration settings, statistics, and other system information
       normally restricted to superusers.
      </p><p>
       <code class="literal">pg_monitor</code> allows reading/executing various
       monitoring views and functions.  This role is a member of
       <code class="literal">pg_read_all_settings</code>,
       <code class="literal">pg_read_all_stats</code> and
       <code class="literal">pg_stat_scan_tables</code>.
      </p><p>
       <code class="literal">pg_read_all_settings</code> allows reading all configuration
       variables, even those normally visible only to superusers.
      </p><p>
       <code class="literal">pg_read_all_stats</code> allows reading all pg_stat_* views
       and use various statistics related extensions, even those normally
       visible only to superusers.
      </p><p>
       <code class="literal">pg_stat_scan_tables</code> allows executing monitoring
       functions that may take <code class="literal">ACCESS SHARE</code> locks on tables,
       potentially for a long time (e.g., <code class="function">pgrowlocks(text)</code>
       in the <a class="xref" href="pgrowlocks.html" title="F.31. pgrowlocks — show a table's row locking information">pgrowlocks</a> extension).
      </p></dd><dt id="PREDEFINED-ROLE-PG-READ-ALL-DATA"><span class="term"><code class="varname">pg_read_all_data</code><br /></span><span class="term"><code class="varname">pg_write_all_data</code></span> <a href="#PREDEFINED-ROLE-PG-READ-ALL-DATA" class="id_link">#</a></dt><dd><p>
       <code class="literal">pg_read_all_data</code> allows reading all data (tables,
       views, sequences), as if having <code class="command">SELECT</code> rights on
       those objects and <code class="literal">USAGE</code> rights on all schemas.  This
       role does not bypass row-level security (RLS) policies.  If RLS is being
       used, an administrator may wish to set <code class="literal">BYPASSRLS</code> on
       roles which this role is granted to.
      </p><p>
       <code class="literal">pg_write_all_data</code> allows writing all data (tables,
       views, sequences), as if having <code class="command">INSERT</code>,
       <code class="command">UPDATE</code>, and <code class="command">DELETE</code> rights on those
       objects and <code class="literal">USAGE</code> rights on all schemas.  This role
       does not bypass row-level security (RLS) policies.  If RLS is being
       used, an administrator may wish to set <code class="literal">BYPASSRLS</code> on
       roles which this role is granted to.
      </p></dd><dt id="PREDEFINED-ROLE-PG-READ-SERVER-FILES"><span class="term"><code class="varname">pg_read_server_files</code><br /></span><span class="term"><code class="varname">pg_write_server_files</code><br /></span><span class="term"><code class="varname">pg_execute_server_program</code></span> <a href="#PREDEFINED-ROLE-PG-READ-SERVER-FILES" class="id_link">#</a></dt><dd><p>
       These roles are intended to allow administrators to have trusted, but
       non-superuser, roles which are able to access files and run programs on
       the database server as the user the database runs as.  They bypass all
       database-level permission checks when accessing files directly and they
       could be used to gain superuser-level access.  Therefore, great care
       should be taken when granting these roles to users.
      </p><p>
       <code class="literal">pg_read_server_files</code> allows reading files from any
       location the database can access on the server using
       <code class="command">COPY</code> and other file-access functions.
      </p><p>
       <code class="literal">pg_write_server_files</code> allows writing to files in any
       location the database can access on the server using
       <code class="command">COPY</code> and other file-access functions.
      </p><p>
       <code class="literal">pg_execute_server_program</code> allows executing programs
       on the database server as the user the database runs as using
       <code class="command">COPY</code> and other functions which allow executing a
       server-side program.
      </p></dd><dt id="PREDEFINED-ROLE-PG-SIGNAL-AUTOVACUUM-WORKER"><span class="term"><code class="varname">pg_signal_autovacuum_worker</code></span> <a href="#PREDEFINED-ROLE-PG-SIGNAL-AUTOVACUUM-WORKER" class="id_link">#</a></dt><dd><p>
       <code class="literal">pg_signal_autovacuum_worker</code> allows signaling
       autovacuum workers to cancel the current table's vacuum or terminate its
       session.  See <a class="xref" href="functions-admin.html#FUNCTIONS-ADMIN-SIGNAL" title="9.28.2. Server Signaling Functions">Section 9.28.2</a>.
      </p></dd><dt id="PREDEFINED-ROLE-PG-SIGNAL-BACKEND"><span class="term"><code class="varname">pg_signal_backend</code></span> <a href="#PREDEFINED-ROLE-PG-SIGNAL-BACKEND" class="id_link">#</a></dt><dd><p>
       <code class="literal">pg_signal_backend</code> allows signaling another backend to
       cancel a query or terminate its session.  Note that this role does not
       permit signaling backends owned by a superuser.  See
       <a class="xref" href="functions-admin.html#FUNCTIONS-ADMIN-SIGNAL" title="9.28.2. Server Signaling Functions">Section 9.28.2</a>.
      </p></dd><dt id="PREDEFINED-ROLE-PG-USE-RESERVED-CONNECTIONS"><span class="term"><code class="varname">pg_use_reserved_connections</code></span> <a href="#PREDEFINED-ROLE-PG-USE-RESERVED-CONNECTIONS" class="id_link">#</a></dt><dd><p>
       <code class="literal">pg_use_reserved_connections</code> allows use of connection
       slots reserved via <a class="xref" href="runtime-config-connection.html#GUC-RESERVED-CONNECTIONS">reserved_connections</a>.
      </p></dd></dl></div><p>
  </p></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="role-removal.html" title="21.4. Dropping Roles">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="user-manag.html" title="Chapter 21. Database Roles">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="perm-functions.html" title="21.6. Function Security">Next</a></td></tr><tr><td width="40%" align="left" valign="top">21.4. Dropping Roles </td><td width="20%" align="center"><a accesskey="h" href="index.html" title="PostgreSQL 18.4 Documentation">Home</a></td><td width="40%" align="right" valign="top"> 21.6. Function Security</td></tr></table></div></body></html>