Bruce Momjian <[EMAIL PROTECTED]> writes: > Have we addressed this? I don't think so.
No, it's not done yet. My inclination is * Template1 has temp table creation and schema creation disabled (disallowed to world) by default. * CREATE DATABASE sets up new databases with temp table creation allowed to world and schema creation allowed to DB owner only (regardless of what the template database had). The owner can adjust this default afterwards if he doesn't like it. It would be nice to lock down the public schema in template1 too, but I see no good way to do that, because CREATE DATABASE can't readily fiddle with protections *inside* the database --- the only games we can play are with the protections stored in the pg_database row itself. So public's permissions are going to be inherited from the template database, and that means template1's public has to be writable. Objections anyone? regards, tom lane ---------------------------(end of broadcast)--------------------------- TIP 2: you can get off all lists at once with the unregister command (send "unregister YourEmailAddressHere" to [EMAIL PROTECTED])