lo_compat_privileges

Definition PG 18 manual

In PostgreSQL releases prior to 9.0, large objects did not have access privileges and were, therefore, always readable and writable by all users. Setting this variable to on disables the new privilege checks, for compatibility with prior releases. The default is off. Only superusers and users with the appropriate SET privilege can change this setting.

Setting this variable does not disable all security checks related to large objects — only those for which the default behavior has changed in PostgreSQL 9.0.

How it works

Enables backward compatibility mode for privilege checks on large objects. A superuser or a role granted SET privilege can change it for the relevant session or configuration scope.

The compatibility mode restores pre-9.0 large-object privilege behavior for old applications. It weakens normal ownership/ACL enforcement around large objects and should be a temporary bridge while explicit GRANTs and ownership are corrected.

Monitor and change lo_compat_privileges together with default_with_oids, operator_precedence_warning, synchronize_seqscans. Validate on the relevant server role and real workload, then use its superuser context to choose session change, reload, or restart; a historical boot default is not the current effective value.

Operational considerations

Keeping a compatibility switch permanently instead of fixing the client.

Testing in one session and deploying globally to unrelated applications.

Confusing parsing compatibility with data or security compatibility.

Forgetting to remove an override after the upgrade migration is complete.

Workload guidance

OLAP: Regression-test ETL, generated SQL, and old drivers, where parsing/quoting assumptions hide. Performance is rarely a reason to change this switch.

OLTP: Keep the modern default and repair legacy clients/SQL that depend on lo_compat_privileges. Test migration at session scope first; do not make a compatibility switch permanent cluster policy.

SMALL: Keep the default without a legacy requirement. If temporarily enabled, record owner, affected connections, and a removal date.