larvit/plainpages
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Keep role re-assertion within a non-superuser provisioner's rights, and test the second boot

Browse Source
This commit is contained in:
Lilleman auf Larv
2026-08-19 00:44:49 +02:00
parent e66a8a3e89
commit 5589472e25
12 changed files with 173 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ory/postgres/init/init.sql
+3 -3
View File
@@ -6,9 +6,9 @@ CREATE DATABASE kratos;
CREATE DATABASE keto;
CREATE DATABASE hydra;
-- Postgres grants CONNECT to PUBLIC by default, so every plugin role would otherwise reach the auth
-- plane: table data stays protected, but pg_catalog and the connection slots do not. Ory connects as
-- the POSTGRES_USER, which owns these and keeps its access.
-- Postgres grants CONNECT to PUBLIC by default, so every plugin role could otherwise open the auth
-- plane's databases and read pg_catalog; table data stays protected either way. Ory connects as the
-- POSTGRES_USER, which owns these and keeps its access.
REVOKE CONNECT ON DATABASE kratos FROM PUBLIC;
REVOKE CONNECT ON DATABASE keto FROM PUBLIC;
REVOKE CONNECT ON DATABASE hydra FROM PUBLIC;