CODEWITHSUNDEEP
postgresqlexecutepostgresql-9.4database-security
ExactaBox
ExactaBox

Reputation: 3395

SECURITY DEFINER - privileges of the function's creator, or owner?

Postgres's official docs indicate that functions defined with SECURITY DEFINER run with privileges of the user who created it.

However other sources, such as here and here, claim it is the privileges of the owner of the function.

Which is correct?

(for 9.4+)

Upvotes: 19

Views: 13039

Answers (1)

klin
klin

Reputation: 121574

Usually (initially) the creator is the owner. However, if the owner of the function has been changed, security definer applies to the new owner. Per the documentation:

new_owner - The new owner of the function. Note that if the function is marked SECURITY DEFINER, it will subsequently execute as the new owner.

Upvotes: 25

Related Questions