| From: | Stephen Frost <sfrost(at)snowman(dot)net> |
|---|---|
| To: | Simon Charette <charette(dot)s(at)gmail(dot)com> |
| Cc: | Joe Conway <mail(at)joeconway(dot)com>, Charles Clavadetscher <clavadetscher(at)swisspug(dot)org>, pgsql-general(at)postgresql(dot)org |
| Subject: | Re: Recursive row level security policy |
| Date: | 2016-12-17 19:04:27 |
| Message-ID: | 20161217190427.GQ18360@tamriel.snowman.net |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-general |
Simon,
* Simon Charette (charette(dot)s(at)gmail(dot)com) wrote:
> Ahh makes sense, thanks for the explanation!
>
> I was assuming USING() clauses were executed in the context of the
> owner of the policy, by passing RLS.
No, as with views, a USING() clause is executed as the caller not the
owner of the relation. Security Definer functions can be used to
execute actions in the policy as another user.
Note that RLS won't be applied for the table owner either (unless the
relation has 'FORCE RLS' enabled for it), so you don't have to have
functions which are run as superuser to use the approach Joe
recommended.
Thanks!
Stephen
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Joe Conway | 2016-12-17 19:23:26 | Re: Recursive row level security policy |
| Previous Message | Simon Charette | 2016-12-17 18:25:06 | Re: Recursive row level security policy |