From: PG Doc comments form <noreply@postgresql.org>
To: pgsql-docs@lists.postgresql.org
Cc: mtaube@caci.com
Subject: Row Level Security Execution within the SQL Evaluation Pipeline
Date: Tue, 21 Feb 2023 21:25:41 +0000
Message-ID: <167701474147.23475.959567841182626784@wrigleys.postgresql.org> (raw)
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/15/sql-createpolicy.html
Description:
RLS documentation seems to say the user's predicate is evaluated AFTER the
policy is evaluated. This presents to me an issue that I can't wrap my head
around, and seems to confuse others as well.
Setup:
1. We have a policy-enabled table that has millions of rows, with ID as a
primary key.
2. There exists a row in this table whose ID column is 10.
3. User submits a query: SELECT * FROM MYTABLE WHERE id = 10.
According to the documentation, the WHERE clause is not evaluated until
AFTER the policy is evaluated, thus there is initially a full table scan of
MYTABLE that returns only the set of rows that the user has access to (via
the policy), THEN the WHERE clause is activated that reduces the row count
to 1 or 0.
This sounds non-performant, and if this is or is not the case, I think it
should be more clearly explained. In addition, a link to a "best practices
using the policy effectively" would be useful, as from reviewing stack
overflow, there is lots of concern over performance of RLS.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: noreply@postgresql.org, pgsql-docs@lists.postgresql.org, mtaube@caci.com
Subject: Re: Row Level Security Execution within the SQL Evaluation Pipeline
In-Reply-To: <167701474147.23475.959567841182626784@wrigleys.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox