From: Joe Conway <mail@joeconway.com>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Dean Rasheed <dean.a.rasheed@gmail.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: RLS related docs
Date: Thu, 15 Sep 2016 16:34:48 -0500
Message-ID: <2782caaf-a7ee-4b3a-eb2d-ad6d9d4876a8@joeconway.com> (raw)
In-Reply-To: <CA+Tgmoae_C5=raLhuxEWAzdOdMA7d1k0JXsnyqZ5H2dZu9vTWg@mail.gmail.com>
References: <5744FA24.3030008@joeconway.com>
<CAEZATCXGzy3P992CHtzf8Nh4_StTqGUzrVAsRzOjW=K6qrMSPg@mail.gmail.com>
<574CA905.2040101@joeconway.com>
<9aafa1cb-469a-89e9-77c5-dff54a792706@joeconway.com>
<CA+Tgmoae_C5=raLhuxEWAzdOdMA7d1k0JXsnyqZ5H2dZu9vTWg@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On 09/15/2016 01:33 PM, Robert Haas wrote:
> On Sun, Aug 28, 2016 at 4:23 PM, Joe Conway <mail@joeconway.com> wrote:
>>>> For COPY, I think perhaps it would be more logical to put the new note
>>>> immediately after the third note which describes the privileges
>>>> required, since it's kind of related, and then we can talk about the
>>>> RLS policies required, e.g.:
>>>>
>>>> If row-level security is enabled for the table, COPY table TO is
>>>> internally converted to COPY (SELECT * FROM table) TO, and the
>>>> relevant security policies are applied. Currently, COPY FROM is not
>>>> supported for tables with row-level security.
>>>
>>> This sounds better than what I had, so I will do it that way.
>>
>> Apologies for the delay, but new patch attached. Assuming no more
>> comments, will commit this, backpatched to 9.5, in a day or two.
>
> I don't think this was ever committed, but my comment is that it seems
> to be exposing rather more of the implementation than is probably
> wise. Can't we say that SELECT policies will apply rather than saying
> that it is internally converted to a SELECT?
I've not committed it yet because I was going to look into the new info
Dean mentioned first. Seems like your wording is fine, so will make that
change.
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
signature.asc (application/pgp-signature, 835B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: mail@joeconway.com, robertmhaas@gmail.com, dean.a.rasheed@gmail.com
Subject: Re: RLS related docs
In-Reply-To: <2782caaf-a7ee-4b3a-eb2d-ad6d9d4876a8@joeconway.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox