DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:cc:content-type;
	b=T0wXXyJdXnuybAqT1Xv2lK1/uuaK+7Zn8DQALPSvE40cT/ZNYsfVxNvlMAoA+63z18
	jeuIJW5GN7oqXfyr5Mc+lvWfMYFG1wY1+w5sJJ79vvUMLff9K0MC3CrFlJROl3Fr0h4S
	eRbWbznct8NAkvxsjlo9MPNR6dqK/DbUws7Ps=
MIME-Version: 1.0
In-Reply-To: <4B26E910.4060604@ak.jp.nec.com>
References: <20091212203003.GL17756@tamriel.snowman.net>
	<4B24AAED.2080706@kaigai.gr.jp>
	<603c8f070912130411q765c7e9aw371b468229b8e32@mail.gmail.com>
	<4B25C5B2.9010108@ak.jp.nec.com>
	<603c8f070912132135l43bdf060sa5207b5a4d2c918c@mail.gmail.com>
	<4B25DE99.2050801@ak.jp.nec.com>
	<603c8f070912140318i6bbc1d63o9e81d409d0b342b6@mail.gmail.com>
	<4B2626ED.7030104@kaigai.gr.jp>
	<20091214134714.GS17756@tamriel.snowman.net>
	<4B26E910.4060604@ak.jp.nec.com>
Date: Mon, 14 Dec 2009 22:32:20 -0500
Message-ID: <603c8f070912141932k3ed0621cqc1051dfbf92a329f@mail.gmail.com>
Subject: Re: Row-Level Security
From: Robert Haas <robertmhaas@gmail.com>
To: KaiGai Kohei <kaigai@ak.jp.nec.com>
Cc: Stephen Frost <sfrost@snowman.net>, KaiGai Kohei <kaigai@kaigai.gr.jp>,
	Josh Berkus <josh@agliodbs.com>, pgsql-hackers@postgresql.org
Content-Type: text/plain; charset=ISO-8859-1

2009/12/14 KaiGai Kohei <kaigai@ak.jp.nec.com>:
> IIRC, one headache issue is that user may provide well indexable conditions,
> such as "SELECT * FROM view_x WHERE id = 1234". In this case, if we strictly
> keep the order of evaluation between inside and outside of the view, its
> performance penalty will over reasonable tradeoff to the better security.

If you don't allow the indexable qual to be pushed down into the view
in this situation, performance will be wretched.  I think we need to
distinguish between trusted and untrusted operations.  Everything in
the view definition is trusted.  And some other things... perhaps
access methods and some/most/all system catalog functions... are
trusted.  Other stuff is untrusted, and can't be pushed down.

I think there was a previous discussion of this when Heikki first
posted the issue to -hackers.

...Robert