65

How to make a query to the Postgres data dictionary to find out all the privileges that a particular user has.

I've been looking for a solution and I can not find anything. Thanks and good day

5 Answers 5

111

Table permissions:

SELECT *
  FROM information_schema.role_table_grants 
 WHERE grantee = 'YOUR_USER';

Ownership:

SELECT *
  FROM pg_tables 
 WHERE tableowner = 'YOUR_USER';

Schema permissions:

      SELECT r.usename AS grantor,
             e.usename AS grantee,
             nspname,
             privilege_type,
             is_grantable
        FROM pg_namespace
JOIN LATERAL (SELECT *
                FROM aclexplode(nspacl) AS x) a
          ON true
        JOIN pg_user e
          ON a.grantee = e.usesysid
        JOIN pg_user r
          ON a.grantor = r.usesysid 
       WHERE e.usename = 'YOUR_USER';
7
  • 1
    Great solution(s) but for schema permission, you don't need a join lateral. Simply ... FROM pg_namespace, aclexplode(nspacl) AS a ...
    – Jeff
    Aug 27, 2019 at 13:00
  • 11
    Not sure what this does, but all query results are empty. Yet my user can access their own databases, tables and even peek into foreign databases and create/delete new tables there! This answer doesn't help.
    – ygoe
    May 3, 2020 at 13:59
  • 3
    @ygoe: if a user owns a table (or database), no special grant exists as the owner of an object always has full access to that object (without grants)
    – user330315
    Dec 8, 2020 at 12:21
  • Note: JOIN LATERAL is available in Postgres from version 9.3 thus the schema permissions query above will not work in AWS Redshift.
    – Gergely M
    Aug 5, 2021 at 11:59
  • 1
    That seems all fine and good for database objects. How does one find the existing privs for a role to the databases themselves? thanks
    – rik
    Nov 14, 2022 at 20:59
7

This is what worked for me the best. short and clean.

\du lists all user accounts and roles and \du+ is the extended version which shows even more information.

# \du
                                        List of roles
     Role name      |                         Attributes                         | Member of
--------------------+------------------------------------------------------------+-----------
 padmin             | Superuser, Create role, Create DB                          | {}
 test               |                                                            | {}
 postgres           | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
 root               | Superuser, Create role, Create DB                          | {}
# \du+
                                               List of roles
     Role name      |                         Attributes                         | Member of | Description
--------------------+------------------------------------------------------------+-----------+-------------
 padmin             | Superuser, Create role, Create DB                          | {}        |
 test               |                                                            | {}        |
 postgres           | Superuser, Create role, Create DB, Replication, Bypass RLS | {}        |
 root               | Superuser, Create role, Create DB                          | {}        |
6

This command was helpful for me:

\l

Here's how I used it:

postgres=# \l

                        List of databases
 Name   | Owner    | Encoding | Collate | Ctype |          Access privileges          
------------------------------+-----------------+----------+---------+-------+-------------------------------------
 mydb1  | postgres | UTF8     | en_NG   | en_NG | =Tc/postgres                       +
        |          |          |         |       | postgres=CTc/postgres              +
        |          |          |         |       | myuser=CTc/postgres
 mydb2  | postgres | UTF8     | en_NG   | en_NG | =Tc/postgres                       +
        |          |          |         |       | postgres=CTc/postgres              +
        |          |          |         |       | my_user=CTc/postgres

Resources: PostgreSQL: List the database privileges using psql

That's all.

I hope this helps

0
0

You can also just use this to see if your user has anything other than SELECT

SELECT * FROM information_schema.role_table_grants WHERE grantee = 'username' AND with_hierarchy = 'YES'

0

The answer from Vao Tsun regarding how to see permissions for schemas is outdated and potentially hides a lot of results (because pg_user only has users that can log in, so the joins fail when the grantor or grantee is a role that cannot log in). Use this instead:

Show schema permissions (2023)

The following lists schemas and permissions for the current database.

WITH users AS (select rolname, oid
               from pg_roles
               union
               select 'PUBLIC', 0)
SELECT r.rolname AS grantor,
       e.rolname AS grantee,
       nspname   as schema,
       privilege_type,
       is_grantable
FROM pg_namespace,
     aclexplode(nspacl) AS a
     JOIN users AS e
          ON a.grantee = e.oid
     JOIN users AS r
          ON a.grantor = r.oid
-- Add a WHERE clause to limit results to a single user
-- WHERE e.rolname = 'PUBLIC' or e.rolname = 'THE_ROLE_YOU_WANT'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.