Received: from makus.postgresql.org (makus.postgresql.org [98.129.198.125]) by mail.postgresql.org (Postfix) with ESMTP id 1F5761AA5B9B for ; Thu, 28 Jun 2012 12:29:28 -0300 (ADT) Received: from sss.pgh.pa.us ([66.207.139.130]) by makus.postgresql.org with esmtp (Exim 4.72) (envelope-from ) id 1SkGet-0000FY-7U for pgsql-hackers@postgresql.org; Thu, 28 Jun 2012 15:29:27 +0000 Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.5/8.14.5) with ESMTP id q5SFT9O4013184; Thu, 28 Jun 2012 11:29:09 -0400 (EDT) From: Tom Lane To: Kohei KaiGai cc: Florian Pflug , Robert Haas , PgHacker Subject: Re: [v9.3] Row-Level Security In-reply-to: References: <13017.1340744395@sss.pgh.pa.us> <45CAFA51-C0CE-481B-86B9-C383E22AD172@phlo.org> Comments: In-reply-to Kohei KaiGai message dated "Thu, 28 Jun 2012 17:02:51 +0200" Date: Thu, 28 Jun 2012 11:29:09 -0400 Message-ID: <13183.1340897349@sss.pgh.pa.us> X-Pg-Spam-Score: -1.9 (-) X-Archive-Number: 201206/1714 X-Sequence-Number: 210554 Kohei KaiGai writes: > 2012/6/27 Florian Pflug : >> Hm, what happens if a SECURITY DEFINER functions returns a refcursor? > My impression is, here is no matter even if SECURITY DEFINER function > returns refcursor. I think Florian has a point: it *should* work, but *will* it? I believe it works today, because the executor only applies permissions checks during query startup. So those checks are executed while still within the SECURITY DEFINER context, and should behave as expected. Subsequently, the cursor portal is returned to caller and caller can execute it to completion, no problem. However, with RLS security-related checks will happen throughout the execution of the portal. They might do the wrong thing once the SECURITY DEFINER function has been exited. We might need to consider that a portal has a local value of "current_user", which is kind of a pain, but probably doable. regards, tom lane