Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitd66bb04

Browse files
committed
Ensure COPY TO on an RLS-enabled table copies no more than it should.
The COPY documentation is quite clear that "COPY relation TO" copiesrows from only the named table, not any inheritance children it mayhave. However, if you enabled row-level security on the table thenthis stopped being true, because the code forgot to apply the ONLYmodifier in the "SELECT ... FROM relation" query that it constructsin order to allow RLS predicates to be attached. Fix that.Report and patch by Antonin Houska (comment adjustments and test caseby me). Back-patch to all supported branches.Discussion:https://postgr.es/m/3472.1675251957@antos
1 parentc45dc7f commitd66bb04

File tree

4 files changed

+77
-3
lines changed

4 files changed

+77
-3
lines changed

‎src/backend/commands/copy.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,11 +244,14 @@ DoCopy(ParseState *pstate, const CopyStmt *stmt,
244244

245245
/*
246246
* Build RangeVar for from clause, fully qualified based on the
247-
* relation which we have opened and locked.
247+
* relation which we have opened and locked. Use "ONLY" so that
248+
* COPY retrieves rows from only the target table not any
249+
* inheritance children, the same as when RLS doesn't apply.
248250
*/
249251
from=makeRangeVar(get_namespace_name(RelationGetNamespace(rel)),
250252
pstrdup(RelationGetRelationName(rel)),
251253
-1);
254+
from->inh= false;/* apply ONLY */
252255

253256
/* Build query */
254257
select=makeNode(SelectStmt);

‎src/backend/commands/copyto.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -524,8 +524,8 @@ BeginCopyTo(ParseState *pstate,
524524
/*
525525
* With row-level security and a user using "COPY relation TO", we
526526
* have to convert the "COPY relation TO" to a query-based COPY (eg:
527-
* "COPY (SELECT * FROM relation) TO"), to allow the rewriter to add
528-
* in any RLS clauses.
527+
* "COPY (SELECT * FROMONLYrelation) TO"), to allow the rewriter to
528+
*addin any RLS clauses.
529529
*
530530
* When this happens, we are passed in the relid of the originally
531531
* found relation (which we have locked). As the planner will look up

‎src/test/regress/expected/rowsecurity.out

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3691,6 +3691,42 @@ ERROR: permission denied for table copy_rel_to
36913691
SET row_security TO ON;
36923692
COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --fail - permission denied
36933693
ERROR: permission denied for table copy_rel_to
3694+
-- Check behavior with a child table.
3695+
RESET SESSION AUTHORIZATION;
3696+
SET row_security TO ON;
3697+
CREATE TABLE copy_rel_to_child () INHERITS (copy_rel_to);
3698+
INSERT INTO copy_rel_to_child VALUES (1, 'one'), (2, 'two');
3699+
-- Check COPY TO as Superuser/owner.
3700+
RESET SESSION AUTHORIZATION;
3701+
SET row_security TO OFF;
3702+
COPY copy_rel_to TO STDOUT WITH DELIMITER ',';
3703+
1,c4ca4238a0b923820dcc509a6f75849b
3704+
SET row_security TO ON;
3705+
COPY copy_rel_to TO STDOUT WITH DELIMITER ',';
3706+
1,c4ca4238a0b923820dcc509a6f75849b
3707+
-- Check COPY TO as user with permissions.
3708+
SET SESSION AUTHORIZATION regress_rls_bob;
3709+
SET row_security TO OFF;
3710+
COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --fail - would be affected by RLS
3711+
ERROR: query would be affected by row-level security policy for table "copy_rel_to"
3712+
SET row_security TO ON;
3713+
COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --ok
3714+
-- Check COPY TO as user with permissions and BYPASSRLS
3715+
SET SESSION AUTHORIZATION regress_rls_exempt_user;
3716+
SET row_security TO OFF;
3717+
COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --ok
3718+
1,c4ca4238a0b923820dcc509a6f75849b
3719+
SET row_security TO ON;
3720+
COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --ok
3721+
1,c4ca4238a0b923820dcc509a6f75849b
3722+
-- Check COPY TO as user without permissions. SET row_security TO OFF;
3723+
SET SESSION AUTHORIZATION regress_rls_carol;
3724+
SET row_security TO OFF;
3725+
COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --fail - permission denied
3726+
ERROR: permission denied for table copy_rel_to
3727+
SET row_security TO ON;
3728+
COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --fail - permission denied
3729+
ERROR: permission denied for table copy_rel_to
36943730
-- Check COPY FROM as Superuser/owner.
36953731
RESET SESSION AUTHORIZATION;
36963732
SET row_security TO OFF;
@@ -3721,6 +3757,7 @@ ERROR: permission denied for table copy_t
37213757
RESET SESSION AUTHORIZATION;
37223758
DROP TABLE copy_t;
37233759
DROP TABLE copy_rel_to CASCADE;
3760+
NOTICE: drop cascades to table copy_rel_to_child
37243761
-- Check WHERE CURRENT OF
37253762
SET SESSION AUTHORIZATION regress_rls_alice;
37263763
CREATE TABLE current_check (currentid int, payload text, rlsuser text);

‎src/test/regress/sql/rowsecurity.sql

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1543,6 +1543,40 @@ COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --fail - permission denied
15431543
SET row_security TOON;
15441544
COPY copy_rel_to TO STDOUT WITH DELIMITER',';--fail - permission denied
15451545

1546+
-- Check behavior with a child table.
1547+
RESET SESSION AUTHORIZATION;
1548+
SET row_security TOON;
1549+
CREATETABLEcopy_rel_to_child () INHERITS (copy_rel_to);
1550+
INSERT INTO copy_rel_to_childVALUES (1,'one'), (2,'two');
1551+
1552+
-- Check COPY TO as Superuser/owner.
1553+
RESET SESSION AUTHORIZATION;
1554+
SET row_security TO OFF;
1555+
COPY copy_rel_to TO STDOUT WITH DELIMITER',';
1556+
SET row_security TOON;
1557+
COPY copy_rel_to TO STDOUT WITH DELIMITER',';
1558+
1559+
-- Check COPY TO as user with permissions.
1560+
SET SESSION AUTHORIZATION regress_rls_bob;
1561+
SET row_security TO OFF;
1562+
COPY copy_rel_to TO STDOUT WITH DELIMITER',';--fail - would be affected by RLS
1563+
SET row_security TOON;
1564+
COPY copy_rel_to TO STDOUT WITH DELIMITER',';--ok
1565+
1566+
-- Check COPY TO as user with permissions and BYPASSRLS
1567+
SET SESSION AUTHORIZATION regress_rls_exempt_user;
1568+
SET row_security TO OFF;
1569+
COPY copy_rel_to TO STDOUT WITH DELIMITER',';--ok
1570+
SET row_security TOON;
1571+
COPY copy_rel_to TO STDOUT WITH DELIMITER',';--ok
1572+
1573+
-- Check COPY TO as user without permissions. SET row_security TO OFF;
1574+
SET SESSION AUTHORIZATION regress_rls_carol;
1575+
SET row_security TO OFF;
1576+
COPY copy_rel_to TO STDOUT WITH DELIMITER',';--fail - permission denied
1577+
SET row_security TOON;
1578+
COPY copy_rel_to TO STDOUT WITH DELIMITER',';--fail - permission denied
1579+
15461580
-- Check COPY FROM as Superuser/owner.
15471581
RESET SESSION AUTHORIZATION;
15481582
SET row_security TO OFF;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp