From: Bruce Momjian <bruce@momjian.us>
Date: Fri, 3 Mar 2006 03:06:17 +0000 (+0000)
Subject: Appended is a small documentation patch that adds a note to the CREATE
X-Git-Tag: REL8_1_4~75
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2c620740bd5c22275c84bacd9ea6602f99d2dd9f;p=thirdparty%2Fpostgresql.git

Appended is a small documentation patch that adds a note to the CREATE
ROLE page, based on what Tom Lane told me here:

	http://archives.postgresql.org/pgsql-general/2005-11/msg00998.php


Joachim Wieland
---

diff --git a/doc/src/sgml/ref/create_role.sgml b/doc/src/sgml/ref/create_role.sgml
index 16cd16ef5ac..e69d6899dd0 100644
--- a/doc/src/sgml/ref/create_role.sgml
+++ b/doc/src/sgml/ref/create_role.sgml
@@ -1,5 +1,5 @@
 <!--
-$PostgreSQL: pgsql/doc/src/sgml/ref/create_role.sgml,v 1.4 2005/11/03 00:51:43 neilc Exp $
+$PostgreSQL: pgsql/doc/src/sgml/ref/create_role.sgml,v 1.4.2.1 2006/03/03 03:06:17 momjian Exp $
 PostgreSQL documentation
 -->
 
@@ -344,6 +344,19 @@ where <replaceable class="PARAMETER">option</replaceable> can be:
    specified in the SQL standard.
   </para>
 
+  <para>
+   Be careful with the <literal>CREATEROLE</> privilege. There is no concept of
+   inheritance for the privileges of a <literal>CREATEROLE</>-role. That
+   means that even if a role does not have a certain privilege but is allowed
+   to create other roles, it can easily create another role with different
+   privileges than its own (except for creating roles with superuser
+   privileges). For example, if the role <quote>user</> has the
+   <literal>CREATEROLE</> privilege but not the <literal>CREATEDB</> privilege,
+   nonetheless it can create a new role with the <literal>CREATEDB</>
+   privilege. Therefore, regard roles that have the <literal>CREATEROLE</>
+   privilege as almost-superuser-roles.
+  </para>
+
   <para>
    <productname>PostgreSQL</productname> includes a program <xref
    linkend="APP-CREATEUSER" endterm="APP-CREATEUSER-title"> that has