pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: Kohei KaiGai <kaigai@kaigai.gr.jp>
Cc: Dean Rasheed <dean.a.rasheed@gmail.com>
Cc: Florian Pflug <fgp@phlo.org>
Cc: PgHacker <pgsql-hackers@postgresql.org>
Subject: Re: [v9.3] Row-Level Security
Date: Mon, 22 Oct 2012 12:17:33 -0400
Message-ID: <2993.1350922653@sss.pgh.pa.us> (raw)
In-Reply-To: <CA+TgmoY6m-HCQfX8Qz8V5c9wbzqFU7GSpWaBDLcpb4o2sWtcEQ@mail.gmail.com>
References: <CADyhKSUXVffLJrmfMpi2xH=U+bFxu9Qa4w7kVhQoxkMfQOJ3yw@mail.gmail.com>
	<CA+TgmoZE3cD4-cWDK8M+UoiMQhoyzyp7s4xvbxgqFk2Su_G0yg@mail.gmail.com>
	<CADyhKSWB=evF9AnB683fNxfD8H80d6nzLcx6O81jewfnUwEeJw@mail.gmail.com>
	<CAEZATCVKpJmf7BDQps8rzwgo0k9Ei6u9i12RaLX-s8bEEY+eAw@mail.gmail.com>
	<CADyhKSWcd6i5c30-AzSZ1RSge4s7vw+nahi36Vf2g_UkwuA4sA@mail.gmail.com>
	<CADyhKSUEGdMeWKtAP6oFzn6e8QK9zFmhdqdpB_GF7O=sdADvAQ@mail.gmail.com>
	<CADyhKSU+Qwx6qkeELr=MbZ7Lz2Wpoqn9Uihff-OktJ_wogHEpw@mail.gmail.com>
	<CAEZATCUz7+QVudWbgnSrv-KbHRPq33Z07vdv1eYn+cDRMbazzQ@mail.gmail.com>
	<CADyhKSXHQxKYpnm4VizVnh=6Gv-TnxbjnucjWaH1am8zpvXY0Q@mail.gmail.com>
	<CADyhKSUFcMcwup1=ydvwghiy21Vn_OGzO-rX-VCBO1CSDNNTMQ@mail.gmail.com>
	<20121018181956.GL3763@alvh.no-ip.org>
	<CA+TgmoY6m-HCQfX8Qz8V5c9wbzqFU7GSpWaBDLcpb4o2sWtcEQ@mail.gmail.com>

Robert Haas <robertmhaas@gmail.com> writes:
> The documentation lists several documented limitations that I would
> like to analyze a little bit.  First, it says that row-level security
> policies are not applied on UPDATE or DELETE.  That sounds downright
> dangerous to me.  Is there some really compelling reason we're not
> doing it?

[ blink... ]  Isn't that a security hole big enough for a Mack truck?

	UPDATE tab SET foo = foo RETURNING *;

sucks out all the data just fine, if RLS doesn't apply to it.

Having said that, I fear that sensible row-level security for updates is
at least one order of magnitude harder than sensible row-level security
for selects.  We've speculated about how to define that in the past,
IIRC, but without any very satisfactory outcome.

			regards, tom lane




view thread (165+ messages)  latest in thread

Message-ID: <2993.1350922653@sss.pgh.pa.us>
Permalink:  ../2993.1350922653@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/2993.1350922653@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, robertmhaas@gmail.com, alvherre@2ndquadrant.com, kaigai@kaigai.gr.jp, dean.a.rasheed@gmail.com, fgp@phlo.org
  Subject: Re: [v9.3] Row-Level Security
  In-Reply-To: <2993.1350922653@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox