Date: Wed, 24 Feb 2016 15:29:55 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Adrian Klaver <adrian.klaver@aklaver.com>
Cc: Adam Guthrie <asguthrie@gmail.com>, pgsql-general@postgresql.org
Subject: Re: "plan should not reference subplan's variable" when
 using row level security
Message-ID: <20160224202954.GJ3127@tamriel.snowman.net>
References: 
 <CAC3DOVy2H7W5bGeVaJjq5XtKvxGNKiPkG_SjXNOqXYLB5ccFBA@mail.gmail.com>
 <56CE0A82.3040307@aklaver.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="n8884J15jRwcBTvu"
Content-Disposition: inline
In-Reply-To: <56CE0A82.3040307@aklaver.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-general-owner@postgresql.org


--n8884J15jRwcBTvu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Adrian,

* Adrian Klaver (adrian.klaver@aklaver.com) wrote:
> I started to work through this when I realized the
> permissions/attributes of the role test are not shown. This seems to
> be important as the UPDATE example works if you run it immediately
> after:
>=20
> INSERT INTO b (id, a_id, text) VALUES (1, 1, 'one');

Not sure what you mean- the necessary permissions for the test role are
just the 'GRANT ALL ON ALL TABLES' which is included.

If you run the UPDATE immediately after the INSERT, then it's before
that GRANT and, more importantly, before the 'SET ROLE', meaning that
you're running it as the table owner, and the policy is ignored
(policies are not applied to the owner of the table, unless FORCE RLS is
used).

Thanks!

Stephen

--n8884J15jRwcBTvu
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWzhLCAAoJEO1sijiDR2RVK8oQAL+oQGFSSuJeP+ZqZN7UogJX
tJNWUzQDy7L5R46lP2zztqO9nTPlDtAmI5MBDipowp/Nv/4iQx650EEFLdO8Gf2g
x7WKYFI4Jc3TS0GDMzre5wHKyn0ILOcZtcNDKgOx4vPXl8TMzkVJp1naGUJ4dFOd
fhOoC3HMFqZgvl2jWgYLhdeQMPWMUBBG7lyFjuM6LefiuuF47YAy12rvQTSsJFQx
VSOGXQrlJN+JwOGwvgHt0/Cm1mCGvvF4z63sZC1OEXyB280NKnP0VYgs6GsZslQY
tXh//yBWPIwaEUkeX6PK15R+Auf60TjqNfQOrsaMDuzZKpe/i3KtyB8iuTjW9yjf
KEdSYemMSIU+a8558OsYc46K7xMR+1blwYuATSAT3GGztFaFw73VUNDYIDNd5H1z
uK31kGDRS3R+g007yIHs+s05/3Q3V/n1cTtrOUOxSVg9NZGb3daVkSmh6w/GzKJ/
JYe0FJwtGJuI6z/NNuIohZKnsaawAlAoVfN/A2AOBAOsutxrrO0uU22Ylclum7HA
oFSIQzeeYODgyptfJoueQx+QNwvhG3v5GrFFng5OwqGSq6IBlSaAUtuyhOQBUR4F
5lF6z57i/zBLNygmJ25cMlAp/+6SrqfkSKdsu3LCei747Sa//4DN2XqZEeW6OuBm
X3cZ/eEVl2S0EzrJhs3h
=LJFn
-----END PGP SIGNATURE-----

--n8884J15jRwcBTvu--