From: Antonin Houska <ah@cybertec.at>
To: pgsql-hackers@postgresql.org
Subject: RLS makes COPY TO process child tables
Date: Wed, 01 Feb 2023 12:45:57 +0100
Message-ID: <3472.1675251957@antos> (raw)
While working on [1] I noticed that if RLS gets enabled, the COPY TO command
includes the contents of child table into the result, although the
documentation says it should not:
"COPY TO can be used only with plain tables, not views, and does not
copy rows from child tables or child partitions. For example, COPY
table TO copies the same rows as SELECT * FROM ONLY table. The syntax
COPY (SELECT * FROM table) TO ... can be used to dump all of the rows
in an inheritance hierarchy, partitioned table, or view."
A test case is attached (rls.sql) as well as fix proposal
(copy_rls_no_inh.diff).
[1] https://commitfest.postgresql.org/41/3641/
--
Antonin Houska
Web: https://www.cybertec-postgresql.com
create table a(i int);
insert into a values (1);
create table a1() inherits(a);
insert into a1 values (1);
-- Only the parent table is copied, as the documentation claims.
copy a to stdout;
alter table a enable row level security;
create role u;
create policy pol_perm on a as permissive for select to u using (true);
grant select on table a to u;
set role u;
-- Both "a" and "a1" appears in the output.
copy a to stdout;
Attachments:
[text/plain] rls.sql (425B, ../3472.1675251957@antos/2-rls.sql)
download | inline:
create table a(i int);
insert into a values (1);
create table a1() inherits(a);
insert into a1 values (1);
-- Only the parent table is copied, as the documentation claims.
copy a to stdout;
alter table a enable row level security;
create role u;
create policy pol_perm on a as permissive for select to u using (true);
grant select on table a to u;
set role u;
-- Both "a" and "a1" appears in the output.
copy a to stdout;
[text/x-diff] copy_rls_no_inh.diff (458B, ../3472.1675251957@antos/3-copy_rls_no_inh.diff)
download | inline diff:diff --git a/src/backend/commands/copy.c b/src/backend/commands/copy.cindex e34f583ea7..3b8c25dadd 100644--- a/src/backend/commands/copy.c+++ b/src/backend/commands/copy.c@@ -249,6 +249,7 @@ DoCopy(ParseState *pstate, const CopyStmt *stmt,
from = makeRangeVar(get_namespace_name(RelationGetNamespace(rel)),
pstrdup(RelationGetRelationName(rel)),
-1);
+ from->inh = false;
/* Build query */
select = makeNode(SelectStmt);
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: ah@cybertec.at
Subject: Re: RLS makes COPY TO process child tables
In-Reply-To: <3472.1675251957@antos>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox