Subject: Re: Non-superuser subscription owners

From: Amit Kapila <[email-masked]>
Date: Sat, 8 Jan 2022 12:27:21 +0530

On Thu, Dec 16, 2021 at 1:53 AM Mark Dilger
<[email-masked]> wrote:
>
> > On Nov 24, 2021, at 4:30 PM, Jeff Davis <[email-masked]> wrote:
> >
> > We need to do permission checking for WITH CHECK OPTION and RLS. The
> > patch right now allows the subscription to write data that an RLS
> > policy forbids.
>
> Version 4 of the patch, attached.
>

For Update/Delete, we do read the table first via
FindReplTupleInLocalRel(), so is there a need to check ACL_SELECT
before that?

-- 
With Regards,
Amit Kapila.

---

From: Jeff Davis <[email-masked]>
Date: Fri, 07 Jan 2022 23:31:06 -0800

> FindReplTupleInLocalRel(), so is there a need to check ACL_SELECT

If it's logically an update/delete, then I think ACL_UPDATE/DELETE is
the right one to check. Do you have a different opinion?

Regards,
	Jeff Davis

---

From: Amit Kapila <[email-masked]>
Date: Sat, 8 Jan 2022 15:35:08 +0530

> the right one to check. Do you have a different opinion?

But shouldn't we do it the first time before accessing the table?

-- 
With Regards,
Amit Kapila.

---

From: Jeff Davis <[email-masked]>
Date: Sat, 08 Jan 2022 09:14:59 -0800

> But shouldn't we do it the first time before accessing the table?

I'm not sure I follow the reasoning. Are you saying that, to logically
replay a simple DELETE, the subscription owner should have SELECT
privileges on the destination table?

Is there a way that a subscription owner could somehow exploit a DELETE
privilege to see the contents of a table on which they have no SELECT
privileges? Or is it purely an internal read, which is necessary for
any ordinary local DELETE/UPDATE anyway?

Regards,
	Jeff Davis

---

From: Tom Lane <[email-masked]>
Date: Sat, 08 Jan 2022 12:37:49 -0500

> privileges on the destination table?

We consider that DELETE WHERE <condition> requires SELECT privilege
on the column(s) read by the <condition>.  I suppose that the point
here is to enforce the same privilege checks that occur in normal
SQL operation, so yes.

> privileges?

BEGIN;
DELETE FROM tab WHERE col = 'foo';
-- note deletion count
ROLLBACK;

Now you have some information about whether "col" contains 'foo'.
Admittedly, it might be a pretty low-bandwidth way to extract data,
but we still regard it as a privilege issue.

			regards, tom lane