pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Florian Pflug <fgp@phlo.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Kohei KaiGai <kaigai@kaigai.gr.jp>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: PgHacker <pgsql-hackers@postgresql.org>
Subject: Re: [v9.3] Row-Level Security
Date: Thu, 28 Jun 2012 17:34:13 +0200
Message-ID: <113BF38F-43EC-46D7-93AF-423BEC77B025@phlo.org> (raw)
In-Reply-To: <13183.1340897349@sss.pgh.pa.us>
References: <CADyhKSWGtZqpsXtF7_q2FvKRvX6RqW+xv7VmxNmj4gubSBoo-g@mail.gmail.com>
	<CA+Tgmob+P6c1P24u2_STH+2AMbW=q4-X7JqZP+Os43qhiRE4bA@mail.gmail.com>
	<CADyhKSWB3NeSQteujA4aF30qNZZW-fUGcyUJmwiPmG+U2fdUzQ@mail.gmail.com>
	<13017.1340744395@sss.pgh.pa.us>
	<CADyhKSUy8vdfs3UMo10o=FzzgzR6ard=+N4xwCN4xNb3baP1bg@mail.gmail.com>
	<45CAFA51-C0CE-481B-86B9-C383E22AD172@phlo.org>
	<CA+TgmoYMahZ7QijiTHkRuHAsNvovEqwkO3UaksGLhphk-tRX3Q@mail.gmail.com>
	<CADyhKSWLa30t68ic7sJb2DugP6Mptm-bx=NfOPUstORD2KXMGA@mail.gmail.com>
	<DFBBD1D7-68C0-4364-BF02-AFA56BEA8AF6@phlo.org>
	<CADyhKSWTWVmYgW2o8pyTXxC0gUfigXwh+GcmN02U4DrGTfaxRQ@mail.gmail.com>
	<13183.1340897349@sss.pgh.pa.us>

On Jun28, 2012, at 17:29 , Tom Lane wrote:
> Kohei KaiGai <kaigai@kaigai.gr.jp> writes:
>> 2012/6/27 Florian Pflug <fgp@phlo.org>:
>>> Hm, what happens if a SECURITY DEFINER functions returns a refcursor?
> 
>> My impression is, here is no matter even if SECURITY DEFINER function
>> returns refcursor.
> 
> I think Florian has a point: it *should* work, but *will* it?
> 
> I believe it works today, because the executor only applies permissions
> checks during query startup.  So those checks are executed while still
> within the SECURITY DEFINER context, and should behave as expected.
> Subsequently, the cursor portal is returned to caller and caller can
> execute it to completion, no problem.

Don't we (sometimes?) defer query startup to the first time FETCH is
called?

best regards,
Florian Pflug




view thread (165+ messages)  latest in thread

Message-ID: <113BF38F-43EC-46D7-93AF-423BEC77B025@phlo.org>
Permalink:  ../113BF38F-43EC-46D7-93AF-423BEC77B025@phlo.org/
Also on:    postgresql.org/message-id/113BF38F-43EC-46D7-93AF-423BEC77B025@phlo.org

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: fgp@phlo.org, tgl@sss.pgh.pa.us, kaigai@kaigai.gr.jp, robertmhaas@gmail.com
  Subject: Re: [v9.3] Row-Level Security
  In-Reply-To: <113BF38F-43EC-46D7-93AF-423BEC77B025@phlo.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox