Re: permission denied for tablespace pg_global?

Hi.

I'm looking at the strange phenomenon....
--
C:\Program Files\PostgreSQL\8.3-beta1\bin>psql postgres postgres
Password for user postgres:
Welcome to psql 8.3beta1, the PostgreSQL interactive terminal.

Type: \copyright for distribution terms
\h for help with SQL commands
\? for help with psql commands
\g or terminate with semicolon to execute query
\q to quit

postgres=# select *,oid from pg_catalog.pg_tablespace;
spcname | spcowner | spclocation | spcacl | oid
------------+----------+-------------+--------+------
pg_default | 10 | | | 1663
pg_global | 10 | | | 1664
(2 rows)

postgres=# SELECT pg_size_pretty(pg_tablespace_size(1663));
pg_size_pretty
----------------
13 MB
(1 row)

postgres=# SELECT pg_size_pretty(pg_tablespace_size(1664));
ERROR: permission denied for tablespace pg_global
postgres=#

/END

Have I overlooked the present specification change?
or can someone suggest?

Regards,
Hiroshi Saito

"Hiroshi Saito" <z-saito(at)guitar(dot)ocn(dot)ne(dot)jp> writes:
> postgres=# SELECT pg_size_pretty(pg_tablespace_size(1664));
> ERROR: permission denied for tablespace pg_global

This is an intentional change, documented in the release notes:

* Put some security restrictions on the dbsize functions (Tom)

Restrict pg_database_size() to users who can connect to the target
database (note that CONNECT privilege is granted by default, so this
does not change the default behavior). Restrict pg_tablespace_size()
to users who have CREATE privilege on the tablespace (which is not
granted by default), except when the tablespace is the default
tablespace for the current database (since we treat that as implicitly
allowing use of the tablespace).

There was a long thread about this in -hackers two months ago:
http://archives.postgresql.org/pgsql-hackers/2007-08/msg00948.php

regards, tom lane

----- Original Message -----
From: "Tom Lane" <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: "Hiroshi Saito" <z-saito(at)guitar(dot)ocn(dot)ne(dot)jp>
Cc: <pgsql-hackers(at)postgresql(dot)org>
Sent: Wednesday, October 10, 2007 9:55 PM
Subject: Re: [HACKERS] permission denied for tablespace pg_global?

> "Hiroshi Saito" <z-saito(at)guitar(dot)ocn(dot)ne(dot)jp> writes:
>> postgres=# SELECT pg_size_pretty(pg_tablespace_size(1664));
>> ERROR: permission denied for tablespace pg_global
>
> This is an intentional change, documented in the release notes:
>
> * Put some security restrictions on the dbsize functions (Tom)
>
> Restrict pg_database_size() to users who can connect to the target
> database (note that CONNECT privilege is granted by default, so this
> does not change the default behavior). Restrict pg_tablespace_size()
> to users who have CREATE privilege on the tablespace (which is not
> granted by default), except when the tablespace is the default
> tablespace for the current database (since we treat that as implicitly
> allowing use of the tablespace).
>
> There was a long thread about this in -hackers two months ago:
> http://archives.postgresql.org/pgsql-hackers/2007-08/msg00948.php
>
> regards, tom lane

Hi.

Oops, I pursued the thread and was not competent.
I will inquire thoroughly. Thanks!!

Regards,
Hiroshi Saito

----- Original Message -----
From: "Tom Lane" <tgl(at)sss(dot)pgh(dot)pa(dot)us>

> "Hiroshi Saito" <z-saito(at)guitar(dot)ocn(dot)ne(dot)jp> writes:
>> postgres=# SELECT pg_size_pretty(pg_tablespace_size(1664));
>> ERROR: permission denied for tablespace pg_global
>
> This is an intentional change, documented in the release notes:
>
> * Put some security restrictions on the dbsize functions (Tom)
>
> Restrict pg_database_size() to users who can connect to the target
> database (note that CONNECT privilege is granted by default, so this
> does not change the default behavior). Restrict pg_tablespace_size()
> to users who have CREATE privilege on the tablespace (which is not
> granted by default), except when the tablespace is the default
> tablespace for the current database (since we treat that as implicitly
> allowing use of the tablespace).
>
> There was a long thread about this in -hackers two months ago:
> http://archives.postgresql.org/pgsql-hackers/2007-08/msg00948.php
>
> regards, tom lane