title: PostgreSQL permissions explained
body: <p>Please explain the output of the <code>\z</code> command in PostgreSQL. I understand the permission, I read the documentation, but somehow I missed the interpretation of the output of <code>\z</code>.</p>
  
  <pre><code>datastore_default=&gt; \z
  
                                      Access privileges
   Schema |      Name       | Type  |         Access privileges         | Column access privileges 
  --------+-----------------+-------+-----------------------------------+--------------------------
   public | _table_metadata | view  | ckan_default=arwdDxt/ckan_default+| 
          |                 |       | datastore_default=r/ckan_default +| 
          |                 |       | readonlyuser=r/ckan_default      +| 
   public | foo             | table | ckan_default=arwdDxt/ckan_default+| 
          |                 |       | datastore_default=r/ckan_default +| 
          |                 |       | readonlyuser=r/ckan_default      +| 
  </code></pre>
  
  <p>Somehow <code>readonlyuser</code> seems to be able to read tables <code>foo</code> and _foo but in practice it cannot. Both commands return an error:</p>
  
  <pre><code>sudo -u postgres psql -d datastore_default -U readonlyuser -c 'SELECT * FROM foo'
  sudo -u postgres psql -d datastore_default -U readonlyuser -c 'SELECT * FROM public.foo'
  ERROR:  permission denied for schema public
  LINE 1: SELECT * FROM public.foo
  </code></pre>
  
  <p>Edit: apparently I had a poor understanding of how database and schema permissions work. First of all only the db admin (user postgres) or the owner of the database (in my case user ckan_default) can grant other users privileges on a specific database. The schema is only at a database level, so it's ok that I added <code>readonlyuser</code> the permission to see the public schema, it cannot select from other databases anyway. </p>