From: Stephen Frost <sfrost@snowman.net>
To: Adrian Klaver <adrian.klaver@aklaver.com>
Cc: Adam Guthrie <asguthrie@gmail.com>
Cc: pgsql-general@postgresql.org
Subject: Re: "plan should not reference subplan's variable" when using row level security
Date: Wed, 24 Feb 2016 15:29:55 -0500
Message-ID: <20160224202954.GJ3127@tamriel.snowman.net> (raw)
In-Reply-To: <56CE0A82.3040307@aklaver.com>
References: <CAC3DOVy2H7W5bGeVaJjq5XtKvxGNKiPkG_SjXNOqXYLB5ccFBA@mail.gmail.com>
<56CE0A82.3040307@aklaver.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-general>
Adrian,
* Adrian Klaver (adrian.klaver@aklaver.com) wrote:
> I started to work through this when I realized the
> permissions/attributes of the role test are not shown. This seems to
> be important as the UPDATE example works if you run it immediately
> after:
>
> INSERT INTO b (id, a_id, text) VALUES (1, 1, 'one');
Not sure what you mean- the necessary permissions for the test role are
just the 'GRANT ALL ON ALL TABLES' which is included.
If you run the UPDATE immediately after the INSERT, then it's before
that GRANT and, more importantly, before the 'SET ROLE', meaning that
you're running it as the table owner, and the policy is ignored
(policies are not applied to the owner of the table, unless FORCE RLS is
used).
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: sfrost@snowman.net, adrian.klaver@aklaver.com, asguthrie@gmail.com
Subject: Re: "plan should not reference subplan's variable" when using row level security
In-Reply-To: <20160224202954.GJ3127@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox