Re: Add support for restrictive RLS policies

On Thu, Sep 1, 2016 at 12:04 PM, Stephen Frost <sfrost(at)snowman(dot)net> wrote:
> As outlined in the commit message, this adds support for restrictive RLS
> policies. We've had this in the backend since 9.5, but they were only
> available via hooks and therefore extensions. This adds support for
> them to be configured through regular DDL commands. These policies are,
> essentially "AND"d instead of "OR"d.
>
> Includes updates to the catalog, grammer, psql, pg_dump, and regression
> tests. Documentation will be added soon, but until then, would be great
> to get feedback on the grammer, catalog and code changes.

I don't like CREATE RESTRICT POLICY much. It's not very good grammar,
for one thing. I think putting the word RESTRICT, or maybe AS
RESTRICT, somewhere later in the command would be better.

I also think that it is very strange to have the grammar keyword be
"restrict" but the internal flag be called "permissive". It would be
better to have the sense of those flags match.

(This is not intended as a full review, just a quick comment.)

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company