Search code examples
postgresqlexecutepostgresql-9.4database-security

SECURITY DEFINER - privileges of the function's creator, or owner?

Postgres's official docs indicate that functions defined with SECURITY DEFINER run with privileges of the user who created it.

However other sources, such as here and here, claim it is the privileges of the owner of the function.

Which is correct?

(for 9.4+)

Solution

  • Usually (initially) the creator is the owner. However, if the owner of the function has been changed, security definer applies to the new owner. Per the documentation:

    new_owner - The new owner of the function. Note that if the function is marked SECURITY DEFINER, it will subsequently execute as the new owner.