我想知道为什么允许新创建的用户在连接到数据库后创建表.我有一个数据库,project2_core：

postgres=# \l

List of databases

Name | Owner | Encoding | Collate | Ctype | Access privileges

---------------+--------------+-----------+-------------+-------------+-------------------------------

postgres | postgres | SQL_ASCII | C | C |

project2_core | atm_project2 | UTF8 | de_DE.UTF-8 | de_DE.UTF-8 | project2=CTc/project2

template0 | postgres | SQL_ASCII | C | C | =c/postgres +

| | | | | postgres=CTc/postgres

template1 | postgres | SQL_ASCII | C | C | =c/postgres +

| | | | | postgres=CTc/postgres

(5 rows)

到现在为止还挺好.现在我创建一个用户：

postgres=# CREATE ROLE dietrich ENCRYPTED PASSWORD 'md5XXX' LOGIN NOCREATEROLE NOCREATEDB NOSUPERUSER

好的.当我尝试连接到数据库时,不允许用户这样做：

$psql -h localhost -p 5432 -U dietrich -W project2_core

Password for user dietrich:

psql: FATAL: permission denied for database "project2_core"

DETAIL: User does not have CONNECT privilege.

这是我的预期.现在奇怪的东西开始了.我授予用户CONNECT：

postgres=# GRANT CONNECT ON DATABASE project2_core TO dietrich;

GRANT

postgres=# \l

List of databases

Name | Owner | Encoding | Collate | Ctype | Access privileges

---------------+--------------+-----------+-------------+-------------+-------------------------------

postgres | postgres | SQL_ASCII | C | C |

project2_core | atm_project2 | UTF8 | de_DE.UTF-8 | de_DE.UTF-8 | project2=CTc/project2+

| | | | | dietrich=c/project2

template0 | postgres | SQL_ASCII | C | C | =c/postgres +

| | | | | postgres=CTc/postgres

template1 | postgres | SQL_ASCII | C | C | =c/postgres +

| | | | | postgres=CTc/postgres

(5 rows)

在没有任何进一步授权的情况下,允许用户创建表：

$psql -h localhost -p 5432 -U dietrich -W project2_core

Password for user dietrich:

psql (9.2.3)

SSL connection (cipher: DHE-RSA-AES256-SHA,bits: 256)

Type "help" for help.

project2_core=> create table adsf ();

CREATE TABLE

project2_core=> \d

List of relations

Schema | Name | Type | Owner

--------+------+-------+----------

public | adsf | table | dietrich

(1 row)

在我明确地对模式进行GRANT USAGE然后在表上进行GRANT SELECT之前,我原本以为不允许用户做任何事情.

我的错误在哪里？我究竟做错了什么？我怎样才能实现我想要的(在明确授予她适当权利之前,不允许新用户做任何事情.

我迷路了,非常感谢你的帮助:)

编辑按照@ daniel-verite的建议,我现在在创建数据库后立即撤销所有操作.用户dietrich不允许再创建表.好.但是：现在,也不允许数据库的所有者project2创建表.即使在数据库上发布GRANT ALL PRIVILEGES project2_core TO project2并在SCHEMA public TO project2上发布GRANT ALL PRIVILEGES,我收到错误错误：没有选择要创建的模式,以及当我专门尝试创建表时public.WHATEVER();,我得到错误：架构公众的权限被拒绝.我究竟做错了什么？