Documentation - V-261914

Title

PostgreSQL must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.

Description

<VulnDiscussion>Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user-controlled table permissions. When d...

Fix Text (Documentation Requirement)

Implement the organization's DAC policy in the security configuration of the database and PostgreSQL, and, if applicable, the security configuration of the application(s) using the database. To GRANT privileges to roles, as the database administrator (shown here as "postgres"), run statements like the following examples: $ sudo su - postgres $ psql -c "CREATE SCHEMA test" $ psql -c "GRANT CREATE ON SCHEMA test TO bob" $ psql -c "CREATE TABLE test.test_table(id INT)" $ psql -c "GRANT SELECT ON TABLE test.test_table TO bob" To REVOKE privileges to roles, as the database administrator (shown here as "postgres"), run statements like the following examples: $ psql -c "REVOKE SELECT ON TABLE test.test_table FROM bob" $ psql -c "REVOKE CREATE ON SCHEMA test FROM bob"