Re: RLS for superuser

agora inbox for pgsql-sql@postgresql.org  
help / color / mirror / Atom feed

From: MS (direkt) <martin.stoecker@stb-datenservice.de>
To: pgsql-sql@postgresql.org
Subject: Re: RLS for superuser
Date: Thu, 8 Dec 2016 08:38:34 +0100
Message-ID: <03f83676-a337-ed9b-069a-a36076c0e2d0@stb-datenservice.de> (raw)
In-Reply-To: <CAByYU3SCUxbA=cepB=L+LYNyQY+bCF+2ONcAjZQBHduiBuk7hA@mail.gmail.com>
References: <CAByYU3SCUxbA=cepB=L+LYNyQY+bCF+2ONcAjZQBHduiBuk7hA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-sql>

Hi Gaurav,

you can't restrict superuser rights via RLS.
IMHO that's obvious because superuser will do administrative task like
dump_all and so on.

Regards Martin

Am 08.12.2016 um 08:32 schrieb Gaurav Tomar:
> Hi All,
>
> We are developing an application which will connect to the PostgreSQL
> 9.5 at backend.
> We do not want any DB role/user including superuser to access the
> table data from the backend, only if the user is logging in from the
> application can see the data.
>
> To achieve this we have created policies and enable RLS on the tables.
> By enabling the RLS and creating policies we are able to restrict all
> the DB user/role including table owner of the table but not able to
> restrict superuser. 
>
> Regards,
>
> Gaurav
>
> +91 876 265 4621
>

-- 
Widdersdorfer Str. 415, 50933 Köln; Tel. +49 / 221 / 9544 010
HRB Köln HRB 75439, Geschäftsführer: S. Böhland, S. Rosenbauer

view thread (3+ messages)  latest in thread

Message-ID: <03f83676-a337-ed9b-069a-a36076c0e2d0@stb-datenservice.de>
Permalink:  ../03f83676-a337-ed9b-069a-a36076c0e2d0@stb-datenservice.de/
Also on:    postgresql.org/message-id/03f83676-a337-ed9b-069a-a36076c0e2d0@stb-datenservice.de

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: martin.stoecker@stb-datenservice.de
  Subject: Re: RLS for superuser
  In-Reply-To: <03f83676-a337-ed9b-069a-a36076c0e2d0@stb-datenservice.de>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox