postgres.git / summary / log / commit / refs

commit    53afdef662ef77a3f27fc36dbc0472f855069fd3
Author:   Joe Conway <mail@joeconway.com>
Date:     Fri Dec 23 01:57:14 2016 +0000

    Improve RLS documentation with respect to COPY
    
    Documentation for pg_restore said COPY TO does not support row security
    when in fact it should say COPY FROM. Fix that.
    
    While at it, make it clear that "COPY FROM" does not allow RLS to be
    enabled and INSERT should be used instead. Also that SELECT policies
    will apply to COPY TO statements.
    
    Back-patch to 9.5 where RLS first appeared.
    
    Author: Joe Conway
    Reviewed-By: Dean Rasheed and Robert Haas
    Discussion: https://postgr.es/m/5744FA24.3030008%40joeconway.com


 doc/src/sgml/ref/copy.sgml       | 9 +++++++++
 doc/src/sgml/ref/pg_dump.sgml    | 5 +++++
 doc/src/sgml/ref/pg_restore.sgml | 2 +-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/doc/src/sgml/ref/copy.sgml b/doc/src/sgml/ref/copy.sgml
index 2850b4763f2..808355a3fbe 100644
--- a/doc/src/sgml/ref/copy.sgml
+++ b/doc/src/sgml/ref/copy.sgml
@@ -411,6 +411,15 @@ COPY <replaceable class="parameter">count</replaceable>
     to have column privileges on the column(s) listed in the command.
    </para>
 
+   <para>
+    If row-level security is enabled for the table, the relevant 
+    <command>SELECT</command> policies will apply to <literal>COPY
+    <replaceable class="parameter">table</> TO</literal> statements.
+    Currently, <command>COPY FROM</command> is not supported for tables
+    with row-level security. Use equivalent <command>INSERT</command>
+    statements instead.
+   </para>
+
    <para>
     Files named in a <command>COPY</command> command are read or written
     directly by the server, not by the client application. Therefore,
diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgml
index 0ca4ad40a43..ab8ec3f47ed 100644
--- a/doc/src/sgml/ref/pg_dump.sgml
+++ b/doc/src/sgml/ref/pg_dump.sgml
@@ -700,6 +700,11 @@ PostgreSQL documentation
         to dump the parts of the contents of the table that they have access to.
        </para>
 
+       <para>
+        Note that if you use this option currently, you probably also want
+        the dump be in <command>INSERT</command> format, as the
+        <command>COPY FROM</command> during restore does not support row security.
+       </para>
       </listitem>
      </varlistentry>
 
diff --git a/doc/src/sgml/ref/pg_restore.sgml b/doc/src/sgml/ref/pg_restore.sgml
index 66a3aa5455a..f357c573149 100644
--- a/doc/src/sgml/ref/pg_restore.sgml
+++ b/doc/src/sgml/ref/pg_restore.sgml
@@ -498,7 +498,7 @@
 
        <para>
         Note that this option currently also requires the dump be in <command>INSERT</command>
-        format, as <command>COPY TO</command> does not support row security.
+        format, as <command>COPY FROM</command> does not support row security.
        </para>
       </listitem>
      </varlistentry>


[parent: e8236921773d]