Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: Mark Phillips <mphillips@mophilly.com>
Mime-Version: 1.0 (1.0)
Subject: Re: Row level security policy
Date: Thu, 14 Nov 2024 04:04:00 -0800
Message-Id: <8DC107DB-1FE0-45F2-98D5-554B8EFAA990@mophilly.com>
References: <e02436cddbd2f628062f12365c9868b5ea124737.camel@cybertec.at>
Cc: pgsql-general@lists.postgresql.org
In-Reply-To: <e02436cddbd2f628062f12365c9868b5ea124737.camel@cybertec.at>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Archived-At: <https://www.postgresql.org/message-id/8DC107DB-1FE0-45F2-98D5-554B8EFAA990%40mophilly.com>
Precedence: bulk

Thank you for clarifying this. I missed that even though it is there in the s=
econd paragraph.
 - Mark, out and about.

> On Nov 14, 2024, at 1:57=E2=80=AFAM, Laurenz Albe <laurenz.albe@cybertec.a=
t> wrote:
>=20
> =EF=BB=BFOn Wed, 2024-11-13 at 17:33 -0800, Mark Phillips wrote:
>> Given a database table with one policy statement FOR SELECT applied, it i=
s necessary
>> to apply additional policy statements for insert, update, and delete oper=
ations?
>>=20
>> My testing indicates that this is case but I haven=E2=80=99t found an exp=
lanation of this
>> requirement in the documentation.
>=20
> https://www.postgresql.org/docs/current/ddl-rowsecurity.html says:
>=20
>  When row security is enabled on a table (with ALTER TABLE ... ENABLE ROW L=
EVEL SECURITY),
>  all normal access to the table for selecting rows or modifying rows must b=
e allowed by
>  a row security policy.
>=20
> So if you only have a policy for SELECT, that's all you are allowed to do.=

>=20
> Yours,
> Laurenz Albe