pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Greg Smith <greg@2ndQuadrant.com>
To: Greg Stark <stark@mit.edu>
Cc: Kohei KaiGai <kaigai@kaigai.gr.jp>
Cc: Josh Berkus <josh@agliodbs.com>
Cc: ktm@rice.edu <ktm@rice.edu>
Cc: Alexander Korotkov <aekorotkov@gmail.com>
Cc: Oleg Bartunov <obartunov@gmail.com>
Cc: PgHacker <pgsql-hackers@postgresql.org>
Subject: Re: [v9.4] row level security
Date: Sun, 01 Sep 2013 23:47:15 -0400
Message-ID: <52240A43.3000100@2ndQuadrant.com> (raw)
In-Reply-To: <CAM-w4HOSTZh+gZxtJt+qbiFzwFQHXMiAqZJs2rxe53H+6Nn1RA@mail.gmail.com>
References: <51E8A8C1.2050700@2ndQuadrant.com>
	<CADyhKSUpcYKNm3rQRwCFqkTZfO3_ZrqYKjAqDxKeA6WeLezSbw@mail.gmail.com>
	<20130829142321.GA30496@aart.rice.edu>
	<CADyhKSUD7qdQeTndZ6mDpp05V6MnRBzQO1FmYBq1+Zp37oyRrg@mail.gmail.com>
	<WM!685df689dd4d8f8c5349d5ef7b8e285db1e99ea32d22ab5d35f3981c29eac19dbd725c9b5e0227def9d782de274d1354!@asav-3.01.com>
	<521F7DFB.8060602@agliodbs.com>
	<CADyhKSW_o2nVWFytdTY84DUXZSuZkD_EtY2d8wAjR18UruOXYQ@mail.gmail.com>
	<WM!fb94ecb91cd381e69d8e4773d3810f48e4e0ef000525cc806c4ee509f215ce1a39c8c2a1c3ffde72ba2ddb1a07ebcdc9!@asav-2.01.com>
	<5220D832.7090104@agliodbs.com>
	<CADyhKSWMvA-Ri7zD2gvz9bq2GiDLPQ_Hqmq86A5AL2r+em9+pw@mail.gmail.com>
	<WM!12ab40873dea1bdff46421b93993af10c7940c289ac32373a30649be9839739492ccb794e20a8b018ced351a2e740d55!@asav-3.01.com>
	<52238206.2060705@agliodbs.com>
	<CADyhKSXKdH2u4qa0Tgv3qUmfuHA9MprDOVfjCxRQyqP+UcC=kg@mail.gmail.com>
	<CAM-w4HOSTZh+gZxtJt+qbiFzwFQHXMiAqZJs2rxe53H+6Nn1RA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 9/1/13 5:54 PM, Greg Stark wrote:
> So I think up above Tom is wrong about why it's ok that INSERT leaks
> keys when it reports a unique key violation. The reason why it's ok
> that there's a covert channel there is that the DBA can avoid that
> covert channel by being careful when creating unique constraints. He
> or she should be aware that creating a unique constraint implicitly
> provides a kind of limited access to data to users who have INSERT
> privilege even if they lack the real SELECT privilege.

And if someone can INSERT values that they can't actually see once 
they're committed, that's a similarly bad we should describe.  People 
should be dumping their trash in their neighbor's yard.  I think 
eventually this needs to be wrestled to the ground in a robust way.  I 
want to see if all unique violations might be changed to give less 
information in this sort of RLS context.

One rough early idea is to create a new error condition that means you 
hit something protected by RLS, but doesn't leak any more information 
than that.  Just a generic "Security restriction operation" that comes 
out of fishing for keys, inserting outside your area, etc.  I want to 
think through some use cases and review the code to see whether that 
concept helps or not.

-- 
Greg Smith   2ndQuadrant US    greg@2ndQuadrant.com   Baltimore, MD
PostgreSQL Training, Services, and 24x7 Support www.2ndQuadrant.com


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (165+ messages)  latest in thread

Message-ID: <52240A43.3000100@2ndQuadrant.com>
Permalink:  ../52240A43.3000100@2ndQuadrant.com/
Also on:    postgresql.org/message-id/52240A43.3000100@2ndQuadrant.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: greg@2ndQuadrant.com, stark@mit.edu, kaigai@kaigai.gr.jp, josh@agliodbs.com, ktm@rice.edu, aekorotkov@gmail.com, obartunov@gmail.com
  Subject: Re: [v9.4] row level security
  In-Reply-To: <52240A43.3000100@2ndQuadrant.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox