From: KaiGai Kohei <kaigai@ak.jp.nec.com>
To: Robert Haas <robertmhaas@gmail.com>
Cc: KaiGai Kohei <kaigai@kaigai.gr.jp>
Cc: Josh Berkus <josh@agliodbs.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: pgsql-hackers@postgresql.org
Subject: Re: Row-Level Security
Date: Mon, 14 Dec 2009 17:58:16 +0900
Message-ID: <4B25FE28.40709@ak.jp.nec.com> (raw)
In-Reply-To: <4B25DE99.2050801@ak.jp.nec.com>
References: <20091212203003.GL17756@tamriel.snowman.net>
<4B24381F.7050407@agliodbs.com>
<603c8f070912121918i59f807e3n5ed4d4699227e43@mail.gmail.com>
<4B24AAED.2080706@kaigai.gr.jp>
<603c8f070912130411q765c7e9aw371b468229b8e32@mail.gmail.com>
<4B25C5B2.9010108@ak.jp.nec.com>
<603c8f070912132135l43bdf060sa5207b5a4d2c918c@mail.gmail.com>
<4B25DE99.2050801@ak.jp.nec.com>
One more issue I found.
What row-level policy should be applied on inherited tables?
If inconsistent policy is applied on the parent and child table,
we can see different result set, although a part of result set
in the parent table come from the child table.
My idea is to copy row-level policies to inherited tables from the
parent table. We can additional row-level policy on the inherited
tables, but all the condition is chained by AND, so here is no
inconsistency.
Even if the inherited table has multiple parents, all the row-level
policies shall be applied, so here is no inconsistency.
(Needless to say, child table have same columns, so we can apply
same row-level policies.)
Thanks,
--
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: kaigai@ak.jp.nec.com, robertmhaas@gmail.com, kaigai@kaigai.gr.jp, josh@agliodbs.com, sfrost@snowman.net
Subject: Re: Row-Level Security
In-Reply-To: <4B25FE28.40709@ak.jp.nec.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox