database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-16 06:01:02 +03:00
Code Activity

Enforce ALL/SELECT policies in RETURNING for RLS

Browse Source 
For the UPDATE/DELETE RETURNING case, filter the records which are not
visible to the user through ALL or SELECT policies from those considered
for the UPDATE or DELETE.  This is similar to how the GRANT system
works, which prevents RETURNING unless the caller has SELECT rights on
the relation.

Per discussion with Robert, Dean, Tom, and Kevin.

Back-patch to 9.5 where RLS was introduced.
This commit is contained in:
Stephen Frost
2015-09-15 15:49:31 -04:00
parent 22eaf35c1d
commit 4f3b2a8883
2 changed files with 74 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
src/backend/rewrite/rowsecurity.c
View File

@ -186,6 +186,33 @@ get_row_security_policies(Query *root, RangeTblEntry *rte, int rt_index,
securityQuals,
hasSubLinks);
/*
* For the target relation, when there is a returning list, we need to
* collect up CMD_SELECT policies and add them via add_security_quals.
* This is because, for the RETURNING case, we have to filter any records
* which are not visible through an ALL or SELECT USING policy.
*
* We don't need to worry about the non-target relation case because we are
* checking the ALL and SELECT policies for those relations anyway (see
* above).
*/
if (root->returningList != NIL &&
(commandType == CMD_UPDATE || commandType == CMD_DELETE))
{
List *returning_permissive_policies;
List *returning_restrictive_policies;
get_policies_for_relation(rel, CMD_SELECT, user_id,
&returning_permissive_policies,
&returning_restrictive_policies);
add_security_quals(rt_index,
returning_permissive_policies,
returning_restrictive_policies,
securityQuals,
hasSubLinks);
}
/*
* For INSERT and UPDATE, add withCheckOptions to verify that any new
* records added are consistent with the security policies. This will use
@ -233,6 +260,26 @@ get_row_security_policies(Query *root, RangeTblEntry *rte, int rt_index,
withCheckOptions,
hasSubLinks);
/*
* Get and add ALL/SELECT policies, if there is a RETURNING clause,
* also as WCO policies, again, to avoid silently dropping data.
*/
if (root->returningList != NIL)
{
List *conflict_returning_permissive_policies = NIL;
List *conflict_returning_restrictive_policies = NIL;
get_policies_for_relation(rel, CMD_SELECT, user_id,
&conflict_returning_permissive_policies,
&conflict_returning_restrictive_policies);
add_with_check_options(rel, rt_index,
WCO_RLS_CONFLICT_CHECK,
conflict_returning_permissive_policies,
conflict_returning_restrictive_policies,
withCheckOptions,
hasSubLinks);
}
/* Enforce the WITH CHECK clauses of the UPDATE policies */
add_with_check_options(rel, rt_index,
WCO_RLS_UPDATE_CHECK,