How to make a query to the Postgres data dictionary to find out all the privileges that a particular user has.
I've been looking for a solution and I can not find anything. Thanks and good day
Table permissions:
SELECT *
FROM information_schema.role_table_grants
WHERE grantee = 'YOUR_USER';
Ownership:
SELECT *
FROM pg_tables
WHERE tableowner = 'YOUR_USER';
Schema permissions:
SELECT r.usename AS grantor,
e.usename AS grantee,
nspname,
privilege_type,
is_grantable
FROM pg_namespace
JOIN LATERAL (SELECT *
FROM aclexplode(nspacl) AS x) a
ON true
JOIN pg_user e
ON a.grantee = e.usesysid
JOIN pg_user r
ON a.grantor = r.usesysid
WHERE e.usename = 'YOUR_USER';
... FROM pg_namespace, aclexplode(nspacl) AS a ...
JOIN LATERAL
is available in Postgres from version 9.3 thus the schema permissions
query above will not work in AWS Redshift.
Aug 5, 2021 at 11:59
This is what worked for me the best. short and clean.
\du
lists all user accounts and roles and \du+
is the extended version which shows even more information.
# \du
List of roles
Role name | Attributes | Member of
--------------------+------------------------------------------------------------+-----------
padmin | Superuser, Create role, Create DB | {}
test | | {}
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
root | Superuser, Create role, Create DB | {}
# \du+
List of roles
Role name | Attributes | Member of | Description
--------------------+------------------------------------------------------------+-----------+-------------
padmin | Superuser, Create role, Create DB | {} |
test | | {} |
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {} |
root | Superuser, Create role, Create DB | {} |
This command was helpful for me:
\l
Here's how I used it:
postgres=# \l
List of databases
Name | Owner | Encoding | Collate | Ctype | Access privileges
------------------------------+-----------------+----------+---------+-------+-------------------------------------
mydb1 | postgres | UTF8 | en_NG | en_NG | =Tc/postgres +
| | | | | postgres=CTc/postgres +
| | | | | myuser=CTc/postgres
mydb2 | postgres | UTF8 | en_NG | en_NG | =Tc/postgres +
| | | | | postgres=CTc/postgres +
| | | | | my_user=CTc/postgres
Resources: PostgreSQL: List the database privileges using psql
That's all.
I hope this helps
You can also just use this to see if your user has anything other than SELECT
SELECT * FROM information_schema.role_table_grants WHERE grantee = 'username' AND with_hierarchy = 'YES'
The answer from Vao Tsun regarding how to see permissions for schemas is outdated and potentially hides a lot of results (because pg_user
only has users that can log in, so the joins fail when the grantor or grantee is a role that cannot log in). Use this instead:
The following lists schemas and permissions for the current database.
WITH users AS (select rolname, oid
from pg_roles
union
select 'PUBLIC', 0)
SELECT r.rolname AS grantor,
e.rolname AS grantee,
nspname as schema,
privilege_type,
is_grantable
FROM pg_namespace,
aclexplode(nspacl) AS a
JOIN users AS e
ON a.grantee = e.oid
JOIN users AS r
ON a.grantor = r.oid
-- Add a WHERE clause to limit results to a single user
-- WHERE e.rolname = 'PUBLIC' or e.rolname = 'THE_ROLE_YOU_WANT'