From: deinspanjer@gmail.com
To: pgsql-docs@postgresql.org
Subject: Row Level Security Policies documentation doesn't mention lack of support for views
Date: Thu, 29 Jun 2017 14:25:11 +0000
Message-ID: <20170629142511.1481.84436@wrigleys.postgresql.org> (raw)
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-docs>
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/9.6/static/ddl-rowsecurity.html
Description:
The policy documentation page is great, and the example in it is very
informative, but I just discovered a major flaw in our implementation of it
that I would like to see mentioned in the documentation.
If you create a view on a table, any queries against the view are in the
context of the view creator rather than the actual current user.
So, in the example on the page, if the admin creates a view of the passwd
table and grants access to this view, alice would no longer be subject to
any of the RLS policies as long as she used the view instead of the real
table.
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: deinspanjer@gmail.com
Subject: Re: Row Level Security Policies documentation doesn't mention lack of support for views
In-Reply-To: <20170629142511.1481.84436@wrigleys.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox