Subject: Re: RLS related docs
To: Dean Rasheed <dean.a.rasheed@gmail.com>
References: <5744FA24.3030008@joeconway.com>
 <CAEZATCXGzy3P992CHtzf8Nh4_StTqGUzrVAsRzOjW=K6qrMSPg@mail.gmail.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
From: Joe Conway <mail@joeconway.com>
Openpgp: id=4EA5B4659ED59CC9538139A5332B7E68B699434A
Message-ID: <574CA905.2040101@joeconway.com>
Date: Mon, 30 May 2016 13:56:37 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.8.0
MIME-Version: 1.0
In-Reply-To: 
 <CAEZATCXGzy3P992CHtzf8Nh4_StTqGUzrVAsRzOjW=K6qrMSPg@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="mptxaqjFjqUJS47gtNblWC1hn4PqbwWO6"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--mptxaqjFjqUJS47gtNblWC1hn4PqbwWO6
From: Joe Conway <mail@joeconway.com>
To: Dean Rasheed <dean.a.rasheed@gmail.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Message-ID: <574CA905.2040101@joeconway.com>
Subject: Re: [HACKERS] RLS related docs
References: <5744FA24.3030008@joeconway.com>
 <CAEZATCXGzy3P992CHtzf8Nh4_StTqGUzrVAsRzOjW=K6qrMSPg@mail.gmail.com>
In-Reply-To: <CAEZATCXGzy3P992CHtzf8Nh4_StTqGUzrVAsRzOjW=K6qrMSPg@mail.gmail.com>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=utf-8

On 05/26/2016 12:26 AM, Dean Rasheed wrote:
> On 25 May 2016 at 02:04, Joe Conway <mail@joeconway.com> wrote:
>> Please see attached two proposed patches for the docs related to RLS:
>>
>> 1) Correction to pg_restore
>> 2) Additional mentions that "COPY FROM" does not allow RLS to be enabled
>>
>> Comments?
>>
>=20
> The pg_restore change looks good -- that was clearly wrong.
>=20
> Also, +1 for the new note in pg_dump.

Great, thanks!

> For COPY, I think perhaps it would be more logical to put the new note
> immediately after the third note which describes the privileges
> required, since it's kind of related, and then we can talk about the
> RLS policies required, e.g.:
>=20
>     If row-level security is enabled for the table, COPY table TO is
>     internally converted to COPY (SELECT * FROM table) TO, and the
>     relevant security policies are applied. Currently, COPY FROM is not
>     supported for tables with row-level security.

This sounds better than what I had, so I will do it that way.

Thanks,

Joe

--=20
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development


--mptxaqjFjqUJS47gtNblWC1hn4PqbwWO6
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBAgAGBQJXTKkFAAoJEDfy90M199hl1VgP/i8njDnOHoLoNoOS1Jlvi2uU
yPn88CwCMETTEA5I/MjZV1rhaCL+OYzHhk3vAqA/Ld99+oJHGspOG4tASPVGTncx
UStmxLj52B9WuyqwlgZvYNL6KYnyCbROtkQh6d3rPvNKT99IolE2AmzgIp/fgDz8
eRQuPQjUygYU8aftUCQyOmGdEui9+1ZcQoEqIFzmdNOV2n0QOL6Z1gvVKWvFTtgP
lTbepByGgR7eaBi4/zmjabiSBzMlsHISIziOjXGQW3Qo0UpMThYLs9NTZp7RLnHQ
eibDSDtqX3l1GLgQkpR/GLuHxmPkmXkGVUfGwX0mCmLUkzZ3bjsmMG4OGWJj0EwC
z3cp+q5x8M6SzmifXSovDxPl2eDhSKH7Hlenc24R7hsembD4GBZf1PkH1icvNLIw
nnKb6N86sW5Uc5jS2GLio5NFfnbRr3WpvnmRqY56YVq6y9e16Kcq5qQsBTqr/8tL
ZT7ve9Bn5x5k8zxneOtnOLEalDFxr8W212Vram8zxJuSi2RDbfc4jXybXS8VmA3u
TCNLxZ29LTfRYPwANxYRzYFwDjDvAJ9nkYgtQ8V/Brtb6aHN+Uj/4eZZklcC0nFL
lONT7pxQVpfNzaBup1y8BRfE+XFkzKJNNOm7T98n8l/iEqecDXiTHOpQzLTl9vPb
NfiWZ4umN900Yf9QSw0M
=3VMY
-----END PGP SIGNATURE-----

--mptxaqjFjqUJS47gtNblWC1hn4PqbwWO6--