Subject: Re: RLS related docs
To: Robert Haas <robertmhaas@gmail.com>
References: <5744FA24.3030008@joeconway.com>
 <CAEZATCXGzy3P992CHtzf8Nh4_StTqGUzrVAsRzOjW=K6qrMSPg@mail.gmail.com>
 <574CA905.2040101@joeconway.com>
 <9aafa1cb-469a-89e9-77c5-dff54a792706@joeconway.com>
 <CA+Tgmoae_C5=raLhuxEWAzdOdMA7d1k0JXsnyqZ5H2dZu9vTWg@mail.gmail.com>
Cc: Dean Rasheed <dean.a.rasheed@gmail.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
From: Joe Conway <mail@joeconway.com>
Openpgp: id=4EA5B4659ED59CC9538139A5332B7E68B699434A
Message-ID: <2782caaf-a7ee-4b3a-eb2d-ad6d9d4876a8@joeconway.com>
Date: Thu, 15 Sep 2016 16:34:48 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: 
 <CA+Tgmoae_C5=raLhuxEWAzdOdMA7d1k0JXsnyqZ5H2dZu9vTWg@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="xerIaS36q9GmCXXMBMvH9QtkrI4hLI5ng"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--xerIaS36q9GmCXXMBMvH9QtkrI4hLI5ng
From: Joe Conway <mail@joeconway.com>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Dean Rasheed <dean.a.rasheed@gmail.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Message-ID: <2782caaf-a7ee-4b3a-eb2d-ad6d9d4876a8@joeconway.com>
Subject: Re: [HACKERS] RLS related docs
References: <5744FA24.3030008@joeconway.com>
 <CAEZATCXGzy3P992CHtzf8Nh4_StTqGUzrVAsRzOjW=K6qrMSPg@mail.gmail.com>
 <574CA905.2040101@joeconway.com>
 <9aafa1cb-469a-89e9-77c5-dff54a792706@joeconway.com>
 <CA+Tgmoae_C5=raLhuxEWAzdOdMA7d1k0JXsnyqZ5H2dZu9vTWg@mail.gmail.com>
In-Reply-To: <CA+Tgmoae_C5=raLhuxEWAzdOdMA7d1k0JXsnyqZ5H2dZu9vTWg@mail.gmail.com>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=utf-8

On 09/15/2016 01:33 PM, Robert Haas wrote:
> On Sun, Aug 28, 2016 at 4:23 PM, Joe Conway <mail@joeconway.com> wrote:
>>>> For COPY, I think perhaps it would be more logical to put the new note
>>>> immediately after the third note which describes the privileges
>>>> required, since it's kind of related, and then we can talk about the
>>>> RLS policies required, e.g.:
>>>>
>>>>     If row-level security is enabled for the table, COPY table TO is
>>>>     internally converted to COPY (SELECT * FROM table) TO, and the
>>>>     relevant security policies are applied. Currently, COPY FROM is not
>>>>     supported for tables with row-level security.
>>>
>>> This sounds better than what I had, so I will do it that way.
>>
>> Apologies for the delay, but new patch attached. Assuming no more
>> comments, will commit this, backpatched to 9.5, in a day or two.
>=20
> I don't think this was ever committed, but my comment is that it seems
> to be exposing rather more of the implementation than is probably
> wise.  Can't we say that SELECT policies will apply rather than saying
> that it is internally converted to a SELECT?

I've not committed it yet because I was going to look into the new info
Dean mentioned first. Seems like your wording is fine, so will make that
change.

Joe


--=20
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development


--xerIaS36q9GmCXXMBMvH9QtkrI4hLI5ng
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBAgAGBQJX2xP4AAoJEDfy90M199hlickP/2xDwWApVrRT33h56XkpwLSM
J/QTzgrBypA4WNNk3w1t7ND3CC7ObAmUQ0SQtP2tsLYYZbusKcZ7W7cPnwowfu4y
AbYXOoPjB2bCDJn11UOLZUhrz1Xt+OiBeyIH1+mLlxq7boSl1yt+fxMzx5o7MlDg
9GBzRf4bWPud5487QnwIpu7+6KQAhoMrA5epWqzoL/Quw/fFbGm5eIGW+NWCJ9QH
2R/GbKY12eM5hB/X9XJaeixFIrpZ4eJ45GDLxPHsB8OXTVoEnltMud6Oxxm5iiqC
SdGy20OPYzOUkzv++0MXK1pV89H4iqlpOMjFckTf8Bgt7cwHkvPDQUA+AZvL3prV
819qPvainMdPruWuHwTBYbIa2/Ax0OGKltYsdhHnmRzehax/3N7RVpUgDBxLwFgN
p+qgz5jJ4OakVLATqNczrNpqIDuv+plxktaIxfcjkwmHqI8IkxMZOJ5dEJTDKhQS
bCGCwHekmfjT92rrrmv/BGsUUMDEMV3tqwZ/GRag//gYkbqswS3MumzwXo91RHxg
XZJCvaCSNHR+DE3lrPr0JbK941VOhQb+0Xz4Lrmu49qEi2LZ3FaiFIzFgJJidZ5D
wdvmFNK/JkCZqR4BNVzLbxK8CjUt5g7IN21v9cGOz7CBEUNDoNEGfedJGpgCQ5BH
MhzDP46OskhaD9057trw
=SHMO
-----END PGP SIGNATURE-----

--xerIaS36q9GmCXXMBMvH9QtkrI4hLI5ng--