From: Tom Lane <tgl@sss.pgh.pa.us>
To: Kohei KaiGai <kaigai@kaigai.gr.jp>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Florian Pflug <fgp@phlo.org>
Cc: PgHacker <pgsql-hackers@postgresql.org>
Subject: Re: [v9.3] Row-Level Security
Date: Tue, 26 Jun 2012 16:59:55 -0400
Message-ID: <13017.1340744395@sss.pgh.pa.us> (raw)
In-Reply-To: <CADyhKSWB3NeSQteujA4aF30qNZZW-fUGcyUJmwiPmG+U2fdUzQ@mail.gmail.com>
References: <CADyhKSWGtZqpsXtF7_q2FvKRvX6RqW+xv7VmxNmj4gubSBoo-g@mail.gmail.com>
<CA+Tgmob+P6c1P24u2_STH+2AMbW=q4-X7JqZP+Os43qhiRE4bA@mail.gmail.com>
<CADyhKSWB3NeSQteujA4aF30qNZZW-fUGcyUJmwiPmG+U2fdUzQ@mail.gmail.com>
Kohei KaiGai <kaigai@kaigai.gr.jp> writes:
> 2012/6/26 Robert Haas <robertmhaas@gmail.com>:
>> I think you're missing the point. Everyone who has commented on this
>> issue is in favor of having some check that causes the RLS predicate
>> *not to get added in the first place*.
> Here is a simple idea to avoid the second problematic scenario; that
> assign 0 as cost of has_superuser_privilege().
I am not sure which part of "this isn't safe" isn't getting through to
you. Aside from the scenarios Robert mentioned, consider the
possibility that f_malicious() is marked immutable, so that the planner
is likely to call it (to replace the call with its value) before it will
ever think about whether has_superuser_privilege should be called first.
Please just do what everybody is asking for, and create a bypass that
does not require fragile, easily-broken-by-future-changes assumptions
about what the planner will do with a WHERE clause.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, kaigai@kaigai.gr.jp, robertmhaas@gmail.com, fgp@phlo.org
Subject: Re: [v9.3] Row-Level Security
In-Reply-To: <13017.1340744395@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox