From: Alvaro Herrera <alvherre@2ndquadrant.com>
To: Stephen Frost <sfrost@snowman.net>
Cc: Jeevan Chalke <jeevan.chalke@enterprisedb.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Thom Brown <thom@linux.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: Add support for restrictive RLS policies
Date: Mon, 26 Sep 2016 17:43:31 -0300
Message-ID: <20160926204331.GA178854@alvherre.pgsql> (raw)
In-Reply-To: <20160926200630.GM5148@tamriel.snowman.net>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Stephen Frost wrote:
> * Alvaro Herrera (alvherre@2ndquadrant.com) wrote:
> > Stephen Frost wrote:
> > > + <para>
> > > + If the policy is a "permissive" or "restrictive" policy. Permissive
> > > + policies are the default and always add visibillity- they ar "OR"d
> > > + together to allow the user access to all rows through any of the
> > > + permissive policies they have access to. Alternativly, a policy can
> > > + instead by "restrictive", meaning that the policy will be "AND"d
> > > + with other restrictive policies and with the result of all of the
> > > + permissive policies on the table.
> > > + </para>
> > > + </listitem>
> > > + </varlistentry>
Stephen,
> > I dislike the "AND"d and "OR"d spelling of those terms. Currently they
> > only appear in comments within rowsecurity.c (of your authorship too, I
> > imagine). I think it'd be better to find actual words for those
> > actions.
>
> I'm certainly open to suggestions, should you, or anyone else, have
> them. I'll try and come up with something else, but that really is what
> we're doing- literally using either AND or OR to join the expressions
> together.
I understand, but the words "and" and "or" are not verbs. I don't know
what are good verbs to use for this but I suppose there must be verbs
related to "conjunction" and "disjunction" ("to conjoin" and "to
disjoin" appear in the Merriam-Webster dictionary but I don't think they
represent the operation very well). Maybe some native speaker would
have a better suggestion.
> > I don't understand this part. Didn't you say previously that we already
> > had this capability in 9.5 and you were only exposing it over SQL? If
> > that is true, how come you need to add a new column to this catalog?
>
> The capability exists in 9.5 through hooks which are available to
> extensions, see the test_rls_hooks extension. Those hooks are called
> every time and therefore don't require the information about restrictive
> policies to be tracked in pg_policy, and so they weren't. Since this is
> adding support for users to define restrictive policies, we need to save
> those policies and therefore we need to distinguish which policies are
> restrictive and which are permissive, hence the need to modify pg_policy
> to track that information.
Ah, okay. I thought you meant that it was already possible to create a
policy to behave this way, just not using SQL-based DDL.
--
Álvaro Herrera https://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: alvherre@2ndquadrant.com, sfrost@snowman.net, jeevan.chalke@enterprisedb.com, robertmhaas@gmail.com, tgl@sss.pgh.pa.us, thom@linux.com
Subject: Re: Add support for restrictive RLS policies
In-Reply-To: <20160926204331.GA178854@alvherre.pgsql>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox