database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-13 07:41:39 +03:00
Code Activity

RLS: Keep deny policy when only restrictive exist

Browse Source 
Only remove the default deny policy when a permissive policy exists
(either from the hook or defined by the user).  If only restrictive
policies exist then no rows will be visible, as restrictive policies
shouldn't make rows visible.  To address this requirement, a single
"USING (true)" permissive policy can be created.

Update the test_rls_hooks regression tests to create the necessary
"USING (true)" permissive policy.

Back-patch to 9.5 where RLS was added.

Per discussion with Dean.
This commit is contained in:
Stephen Frost
2015-08-03 15:32:49 -04:00
parent ecc2d16bc9
commit dee0200f02
4 changed files with 30 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/backend/rewrite/rowsecurity.c
View File

@ -225,12 +225,18 @@ get_row_security_policies(Query *root, CmdType commandType, RangeTblEntry *rte,
}
/*
* If the only built-in policy is the default-deny one, and hook policies
* exist, then use the hook policies only and do not apply the
* If the only built-in policy is the default-deny one, and permissive hook
* policies exist, then use the hook policies only and do not apply the
* default-deny policy. Otherwise, we will apply both sets below.
*
* Note that we do not remove the defaultDeny policy if only *restrictive*
* policies exist as restrictive policies should only ever be reducing what
* is visible. Therefore, at least one permissive policy must exist which
* allows records to be seen before restrictive policies can remove rows
* from that set. A single "true" policy can be created to address this
* requirement, if necessary.
*/
if (defaultDeny &&
(hook_policies_restrictive != NIL || hook_policies_permissive != NIL))
if (defaultDeny && hook_policies_permissive != NIL)
{
rowsec_expr = NULL;
rowsec_with_check_expr = NULL;