MIME-Version: 1.0
References: 
 <CAJTYsWWdeBkoH5g8D-k9LDw9ciqsMxb21EJSiFXAzP4J=XyxOQ@mail.gmail.com>
 <CAJTYsWXOT5M+2zFsum3PRNCZQXQ0xK8nV2NhYf9rsnw-t4poeA@mail.gmail.com>
 <CA+renyUhNj7PSq+qYgTv+avAi73f2eURgjJPLJMnyUHLbEDTrQ@mail.gmail.com>
In-Reply-To: 
 <CA+renyUhNj7PSq+qYgTv+avAi73f2eURgjJPLJMnyUHLbEDTrQ@mail.gmail.com>
From: Ayush Tiwari <ayushtiwari.slg01@gmail.com>
Date: Fri, 5 Jun 2026 22:16:57 +0530
Message-ID: 
 <CAJTYsWVQu7p4WoXSSyU1npTp6wz9AUiS1-HS_yKogqvQUCDuZQ@mail.gmail.com>
Subject: Re: Enforce INSERT RLS checks for FOR PORTION OF leftovers?
To: Paul A Jungwirth <pj@illuminatedcomputing.com>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
 Peter Eisentraut <peter@eisentraut.org>
Content-Type: multipart/alternative; boundary="000000000000650a1a06538469e3"
Archived-At: 
 <https://www.postgresql.org/message-id/CAJTYsWVQu7p4WoXSSyU1npTp6wz9AUiS1-HS_yKogqvQUCDuZQ%40mail.gmail.com>
Precedence: bulk

--000000000000650a1a06538469e3
Content-Type: text/plain; charset="UTF-8"

Hi,

On Sat, 16 May 2026 at 22:20, Paul A Jungwirth <pj@illuminatedcomputing.com>
wrote:

Skipping the RLS checks to insert the leftovers seems like the correct
> behavior to me, since we are skipping the ACL checks (per the
> standard). Shouldn't it be consistent?
>
> I think the reason we skip the checks is that semantically, the
> leftovers aren't changing anything: they are preserving the history
> that is already there.
>
> I'm happy to write a doc patch to make this explicit. Does anyone
> disagree about the correct behavior though?
>

I'd treat them separately.  Skipping INSERT ACL is a standard-driven
call about command privilege; RLS WITH CHECK is a per-row predicate
on the data, and the leftover really is a new heap tuple written by
the current role.

With `WITH CHECK (name <> 'denied')` and a pre-existing 'denied' row
(loaded by COPY or before the policy), UPDATE FOR PORTION OF that
touches only the range column writes leftovers the role could not
have INSERTed directly.  That's the part that bothers me, especially
since RLS tends to be deployed as a hard security boundary rather
than something users expect to opt out of per statement type.
Please correct me if I'm wrong here.

Regards,
Ayush

--000000000000650a1a06538469e3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hi,</div><br><div class=3D"gmail_quote gm=
ail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Sat, 16 May 2=
026 at 22:20, Paul A Jungwirth &lt;<a href=3D"mailto:pj@illuminatedcomputin=
g.com">pj@illuminatedcomputing.com</a>&gt; wrote:</div><div dir=3D"ltr" cla=
ss=3D"gmail_attr"><br></div><blockquote class=3D"gmail_quote" style=3D"marg=
in:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1e=
x">
Skipping the RLS checks to insert the leftovers seems like the correct<br>
behavior to me, since we are skipping the ACL checks (per the<br>
standard). Shouldn&#39;t it be consistent?<br>
<br>
I think the reason we skip the checks is that semantically, the<br>
leftovers aren&#39;t changing anything: they are preserving the history<br>
that is already there.<br>
<br>
I&#39;m happy to write a doc patch to make this explicit. Does anyone<br>
disagree about the correct behavior though?<br></blockquote><div><br></div>=
I&#39;d treat them separately.=C2=A0 Skipping INSERT ACL is a standard-driv=
en<br>call about command privilege; RLS WITH CHECK is a per-row predicate<b=
r>on the data, and the leftover really is a new heap tuple written by<br>th=
e current role.<br><br>With `WITH CHECK (name &lt;&gt; &#39;denied&#39;)` a=
nd a pre-existing &#39;denied&#39; row<br>(loaded by COPY or before the pol=
icy), UPDATE FOR PORTION OF that<br>touches only the range column writes le=
ftovers the role could not<br>have INSERTed directly.=C2=A0 That&#39;s the =
part that bothers me, especially<br>since RLS tends to be deployed as a har=
d security boundary rather<br><div>than something users expect to opt out o=
f per statement type.=C2=A0</div><div>Please correct me if I&#39;m wrong he=
re.</div><div><br></div><div>Regards,<br>Ayush</div></div></div>

--000000000000650a1a06538469e3--