From: Bruno Wolff III <bruno@wolff.to>
To: James Taylor <jtx@hatesville.com>
Cc: pgsql-sql@postgresql.org
Subject: Re: Label Security
Date: Mon, 26 Jan 2004 20:24:16 -0600
Message-ID: <20040127022416.GA14179@wolff.to> (raw)
In-Reply-To: <BFFA4DDC-5062-11D8-AA39-000A95982628@hatesville.com>
References: <9A658A4A-5040-11D8-AA39-000A95982628@hatesville.com>
<20040126210633.GA22394@wolff.to>
<BFFA4DDC-5062-11D8-AA39-000A95982628@hatesville.com>
On Mon, Jan 26, 2004 at 16:50:06 -0800,
James Taylor <jtx@hatesville.com> wrote:
> Ok, so for example, say I add another column to the tables I want to
> have the row-level security on called 'security'. I would go ahead and
> designate
> different security levels for each user, (ex. Jane security 1000, Bill
> 2000, Joe 3000). Then, if I only want X user with security 1000 to
> view Y row, I set Y.security to 1000.
> Then, I give these users no access to the table, and create views for
> EACH user saying something to the effect of "select * from z where
> security=securitylevel", and grant access to the views only to the user
> itself.
You can refer to current_user in the view. This allows you to use one
view for all users. Though you still have to have some information
mapping users to rows they can access in the database.
> Couldn't a user then go into the console themselves and create a view
> giving them full access to the table?
You don't have to give them access to the table directly in order to
have the view work. When accessing a table through a view you have the
rights of the person who created the view.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: bruno@wolff.to, jtx@hatesville.com
Subject: Re: Label Security
In-Reply-To: <20040127022416.GA14179@wolff.to>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox