No, I'm not misunderstanding. When I said "equates to superuser privileges", I meant the privileges that the database superuser has. We're speaking in the context of DBMS permissions here—in DBMS docs, "user" always means "database user" (and "superuser" always means "database superuser"); and if you want to mean "OS user", you have to explicitly spell that out (as I did each time I meant that.)

But, as well, I think it's important to point out that, on a system that's dedicated to being a database instance, there's really not that much difference between being able to execute arbitrary commands as the OS superuser, and being able to execute arbitrary commands as the OS user that the DBMS runs as. If you can run commands as the OS `postgres` user, you can, for example:

- delete the cluster (even if your DBMS user can't do that)

- read all the Postgres configuration files, including any secrets loaded from such files

- change other [DBMS!] users' passwords

- configure a new authentication method that sends credentials to an arbitrary third-party system (e.g. an LDAP server you control), turning the database instance into a login-credential harvester

Etc.

Yes, the OS `postgres` user isn't the OS superuser; but that is kind of meaningless if the box is essentially just a substrate for running Postgres on.

Well, I was right, there was a misunderstanding - on my part, obviously.

Basically, you were discussing a mechanism for allowing non-admin DB users to safely run COPY FROM... PROGRAM?