Date: Thu, 8 Dec 2016 08:54:00 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Gaurav Tomar <gauravtomar14@gmail.com>
Cc: pgsql-sql@postgresql.org
Subject: Re: RLS for superuser
Message-ID: <20161208135359.GB23417@tamriel.snowman.net>
References: 
 <CAByYU3SCUxbA=cepB=L+LYNyQY+bCF+2ONcAjZQBHduiBuk7hA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="k9EanI4qvbxMqdC7"
Content-Disposition: inline
In-Reply-To: 
 <CAByYU3SCUxbA=cepB=L+LYNyQY+bCF+2ONcAjZQBHduiBuk7hA@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-sql-owner@postgresql.org


--k9EanI4qvbxMqdC7
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Greetings,

* Gaurav Tomar (gauravtomar14@gmail.com) wrote:
> We are developing an application which will connect to the PostgreSQL 9.5
> at backend.
> We do not want any DB role/user including superuser to access the table
> data from the backend, only if the user is logging in from the application
> can see the data.

Superuser can bypass all security through other means (consider the
pageinspect extension, which allows direct reading of any page in the
database, or the pg_read_file() function which allows reading of whole
files directly, and there are many more ways).

> To achieve this we have created policies and enable RLS on the tables. By
> enabling the RLS and creating policies we are able to restrict all the DB
> user/role including table owner of the table but not able to restrict
> superuser.

The table owner will always be able to disable RLS on the table, or to
drop and recreate the table.  I'm not sure how you feel that's
"restricting" the table owner, because it really isn't.

Leveraging SELinux and similar technologies is an approach to being
able to limit what a PG superuser could do, but that doesn't seem like
what you're looking for here.

Thanks!

Stephen

--k9EanI4qvbxMqdC7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJYSWX3AAoJEO1sijiDR2RVXvcP/0FA3eAPyDyxdvcCfB3gtMQH
FDi5J5leszih3bt3yKYWUz5n4S1JNPvyfe7BK1NXqtpbFZg8vAa7W2ZWR7fGFuE1
xtnll7ggMiIAKT6ynZAUlYI46gY5Jjhrn6zwli5AUtPTe7ZM0NtqLcYIYw/l0lJO
3q6G3yep1R9jdP17SW7klsuW2gsLEPGi3By/uETJIVrnYQ7hNxfKy48PYyMSC9SB
RvU9DN3sXtUa2p/vWCxCJSNwvMXtRMnl3XRKTIBAQW2ZlNWDqbmA6r48yR2M9uIa
kMQICyfPjs1XBRGAWAAOmUwBjTx0MmTxP941I8fBeckUaySEwzq8IgP0f/5qRCDi
D+7CCX+R9xTjV1quKgZuoTPTxEB7OrNWWC0CZxH6y753lBWngmq4DI2XUBbKq3x6
bMNbUuPrn01nKncBGjuFNEPxhrZ0QEuNJA7+sd8tPxM5ctjOchne082EX0soI3aU
rQPPSJF/AK5FJRHRWE3osokgjQA6MoUCvdVYN1hDXG7l6tgUbuAuTKR47dq+RHnY
/j7r83AxZmCRpe10nMtiYYdKCstxEfbJ7yfeSWSDIYikRblb2usPr0ZmnmixWECM
qEti+A0ONu5hO379arqw7ctyjtxQi+H+N4nLlUs5IaT+SJ6NyJDQ5d4DULW8nbu0
9nEdAe65GbtFEiNOQdKG
=cfpX
-----END PGP SIGNATURE-----

--k9EanI4qvbxMqdC7--