pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Florian Pflug <fgp@phlo.org>
Cc: Kohei KaiGai <kaigai@kaigai.gr.jp>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: PgHacker <pgsql-hackers@postgresql.org>
Subject: Re: [v9.3] Row-Level Security
Date: Thu, 28 Jun 2012 11:46:50 -0400
Message-ID: <13647.1340898410@sss.pgh.pa.us> (raw)
In-Reply-To: <113BF38F-43EC-46D7-93AF-423BEC77B025@phlo.org>
References: <CADyhKSWGtZqpsXtF7_q2FvKRvX6RqW+xv7VmxNmj4gubSBoo-g@mail.gmail.com>
	<CA+Tgmob+P6c1P24u2_STH+2AMbW=q4-X7JqZP+Os43qhiRE4bA@mail.gmail.com>
	<CADyhKSWB3NeSQteujA4aF30qNZZW-fUGcyUJmwiPmG+U2fdUzQ@mail.gmail.com>
	<13017.1340744395@sss.pgh.pa.us>
	<CADyhKSUy8vdfs3UMo10o=FzzgzR6ard=+N4xwCN4xNb3baP1bg@mail.gmail.com>
	<45CAFA51-C0CE-481B-86B9-C383E22AD172@phlo.org>
	<CA+TgmoYMahZ7QijiTHkRuHAsNvovEqwkO3UaksGLhphk-tRX3Q@mail.gmail.com>
	<CADyhKSWLa30t68ic7sJb2DugP6Mptm-bx=NfOPUstORD2KXMGA@mail.gmail.com>
	<DFBBD1D7-68C0-4364-BF02-AFA56BEA8AF6@phlo.org>
	<CADyhKSWTWVmYgW2o8pyTXxC0gUfigXwh+GcmN02U4DrGTfaxRQ@mail.gmail.com>
	<13183.1340897349@sss.pgh.pa.us>
	<113BF38F-43EC-46D7-93AF-423BEC77B025@phlo.org>

Florian Pflug <fgp@phlo.org> writes:
> On Jun28, 2012, at 17:29 , Tom Lane wrote:
>> I believe it works today, because the executor only applies permissions
>> checks during query startup.  So those checks are executed while still
>> within the SECURITY DEFINER context, and should behave as expected.
>> Subsequently, the cursor portal is returned to caller and caller can
>> execute it to completion, no problem.

> Don't we (sometimes?) defer query startup to the first time FETCH is
> called?

There are things inside individual plan node functions that may only
happen when the first row is demanded, but permissions checks are done
in ExecutorStart().

			regards, tom lane



view thread (165+ messages)  latest in thread

Message-ID: <13647.1340898410@sss.pgh.pa.us>
Permalink:  ../13647.1340898410@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/13647.1340898410@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, fgp@phlo.org, kaigai@kaigai.gr.jp, robertmhaas@gmail.com
  Subject: Re: [v9.3] Row-Level Security
  In-Reply-To: <13647.1340898410@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox