From: Tom Lane <tgl@sss.pgh.pa.us>
To: Florian Pflug <fgp@phlo.org>
cc: Kohei KaiGai <kaigai@kaigai.gr.jp>, Robert Haas <robertmhaas@gmail.com>,
	PgHacker <pgsql-hackers@postgresql.org>
Subject: Re: [v9.3] Row-Level Security
In-reply-to: <113BF38F-43EC-46D7-93AF-423BEC77B025@phlo.org>
References: 
 <CADyhKSWGtZqpsXtF7_q2FvKRvX6RqW+xv7VmxNmj4gubSBoo-g@mail.gmail.com>
	<CA+Tgmob+P6c1P24u2_STH+2AMbW=q4-X7JqZP+Os43qhiRE4bA@mail.gmail.com>
	<CADyhKSWB3NeSQteujA4aF30qNZZW-fUGcyUJmwiPmG+U2fdUzQ@mail.gmail.com>
	<13017.1340744395@sss.pgh.pa.us>
	<CADyhKSUy8vdfs3UMo10o=FzzgzR6ard=+N4xwCN4xNb3baP1bg@mail.gmail.com>
	<45CAFA51-C0CE-481B-86B9-C383E22AD172@phlo.org>
	<CA+TgmoYMahZ7QijiTHkRuHAsNvovEqwkO3UaksGLhphk-tRX3Q@mail.gmail.com>
	<CADyhKSWLa30t68ic7sJb2DugP6Mptm-bx=NfOPUstORD2KXMGA@mail.gmail.com>
	<DFBBD1D7-68C0-4364-BF02-AFA56BEA8AF6@phlo.org>
	<CADyhKSWTWVmYgW2o8pyTXxC0gUfigXwh+GcmN02U4DrGTfaxRQ@mail.gmail.com>
	<13183.1340897349@sss.pgh.pa.us>
	<113BF38F-43EC-46D7-93AF-423BEC77B025@phlo.org>
Comments: In-reply-to Florian Pflug <fgp@phlo.org>
	message dated "Thu, 28 Jun 2012 17:34:13 +0200"
Date: Thu, 28 Jun 2012 11:46:50 -0400
Message-ID: <13647.1340898410@sss.pgh.pa.us>

Florian Pflug <fgp@phlo.org> writes:
> On Jun28, 2012, at 17:29 , Tom Lane wrote:
>> I believe it works today, because the executor only applies permissions
>> checks during query startup.  So those checks are executed while still
>> within the SECURITY DEFINER context, and should behave as expected.
>> Subsequently, the cursor portal is returned to caller and caller can
>> execute it to completion, no problem.

> Don't we (sometimes?) defer query startup to the first time FETCH is
> called?

There are things inside individual plan node functions that may only
happen when the first row is demanded, but permissions checks are done
in ExecutorStart().

			regards, tom lane