title: PostgreSQL / Redshift - prevent access to system views
body: <p>I am working with Redshift (which is based on PostgreSQL) and need to create a user that is restricted to a particular database schema.  They also need to be locked out of the system views.  I ran the following on the database cluster:</p>
  
  <pre><code>revoke create on schema information_schema from public
  revoke usage on schema information_schema from public
  
  revoke create on schema pg_catalog from public
  revoke usage on schema pg_catalog from public
  
  revoke create on schema public from public
  revoke usage on schema public from public
  </code></pre>
  
  <p>Next, I create a user and run as that user:</p>
  
  <pre><code>SET SESSION AUTHORIZATION someUser
  </code></pre>
  
  <p>Then I try to access some system views:</p>
  
  <pre><code>select * from information_schema.tables
  </code></pre>
  
  <blockquote>
    <p>An error occurred when executing the SQL command:<br>
    select * from information_schema.tables<br>
    ERROR: permission denied for schema information_schema [SQL State=42501]</p>
  </blockquote>
  
  <pre><code>select * from pg_catalog.pg_user
  </code></pre>
  
  <blockquote>
    <p>An error occurred when executing the SQL command:<br>
    select * from pg_catalog.pg_user<br>
    ERROR: permission denied for schema pg_catalog [SQL State=42501] </p>
  </blockquote>
  
  <p>So far so good -- the user cannot poke around in the system views.</p>
  
  <p>But for some reason when I run the following it succeeds:</p>
  
  <pre><code>select * from pg_user
  </code></pre>
  
  <p>In other words, if the user tries to query pg_user without specifying the pg_catalog schema, they are able to see the users in the system.</p>
  
  <p>Any ideas on how to prevent this?</p>