Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite2d28c0

Browse files
committed
Perform RLS subquery checks as the right user when going via a view.
When accessing a table with RLS via a view, the RLS checks areperformed as the view owner. However, the code neglected to propagatethat to any subqueries in the RLS checks. Fix that by callingsetRuleCheckAsUser() for all RLS policy quals and withCheckOptionchecks for RTEs with RLS.Back-patch to 9.5 where RLS was added.Per bug #15708 from daurnimator.Discussion:https://postgr.es/m/15708-d65cab2ce9b1717a@postgresql.org
1 parent280e5f1 commite2d28c0

File tree

3 files changed

+61
-0
lines changed

3 files changed

+61
-0
lines changed

‎src/backend/rewrite/rowsecurity.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
#include"nodes/pg_list.h"
4848
#include"nodes/plannodes.h"
4949
#include"parser/parsetree.h"
50+
#include"rewrite/rewriteDefine.h"
5051
#include"rewrite/rewriteHandler.h"
5152
#include"rewrite/rewriteManip.h"
5253
#include"rewrite/rowsecurity.h"
@@ -381,6 +382,13 @@ get_row_security_policies(Query *root, RangeTblEntry *rte, int rt_index,
381382

382383
table_close(rel,NoLock);
383384

385+
/*
386+
* Copy checkAsUser to the row security quals and WithCheckOption checks,
387+
* in case they contain any subqueries referring to other relations.
388+
*/
389+
setRuleCheckAsUser((Node*)*securityQuals,rte->checkAsUser);
390+
setRuleCheckAsUser((Node*)*withCheckOptions,rte->checkAsUser);
391+
384392
/*
385393
* Mark this query as having row security, so plancache can invalidate it
386394
* when necessary (eg: role changes)

‎src/test/regress/expected/rowsecurity.out

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3910,6 +3910,33 @@ DROP OWNED BY regress_rls_dob_role1;
39103910
DROP POLICY p1 ON dob_t2; -- should succeed
39113911
DROP USER regress_rls_dob_role1;
39123912
DROP USER regress_rls_dob_role2;
3913+
-- Bug #15708: view + table with RLS should check policies as view owner
3914+
CREATE TABLE ref_tbl (a int);
3915+
INSERT INTO ref_tbl VALUES (1);
3916+
CREATE TABLE rls_tbl (a int);
3917+
INSERT INTO rls_tbl VALUES (10);
3918+
ALTER TABLE rls_tbl ENABLE ROW LEVEL SECURITY;
3919+
CREATE POLICY p1 ON rls_tbl USING (EXISTS (SELECT 1 FROM ref_tbl));
3920+
GRANT SELECT ON ref_tbl TO regress_rls_bob;
3921+
GRANT SELECT ON rls_tbl TO regress_rls_bob;
3922+
CREATE VIEW rls_view AS SELECT * FROM rls_tbl;
3923+
ALTER VIEW rls_view OWNER TO regress_rls_bob;
3924+
GRANT SELECT ON rls_view TO regress_rls_alice;
3925+
SET SESSION AUTHORIZATION regress_rls_alice;
3926+
SELECT * FROM ref_tbl; -- Permission denied
3927+
ERROR: permission denied for table ref_tbl
3928+
SELECT * FROM rls_tbl; -- Permission denied
3929+
ERROR: permission denied for table rls_tbl
3930+
SELECT * FROM rls_view; -- OK
3931+
a
3932+
----
3933+
10
3934+
(1 row)
3935+
3936+
RESET SESSION AUTHORIZATION;
3937+
DROP VIEW rls_view;
3938+
DROP TABLE rls_tbl;
3939+
DROP TABLE ref_tbl;
39133940
--
39143941
-- Clean up objects
39153942
--

‎src/test/regress/sql/rowsecurity.sql

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1764,6 +1764,32 @@ DROP POLICY p1 ON dob_t2; -- should succeed
17641764
DROPUSER regress_rls_dob_role1;
17651765
DROPUSER regress_rls_dob_role2;
17661766

1767+
-- Bug #15708: view + table with RLS should check policies as view owner
1768+
CREATETABLEref_tbl (aint);
1769+
INSERT INTO ref_tblVALUES (1);
1770+
1771+
CREATETABLErls_tbl (aint);
1772+
INSERT INTO rls_tblVALUES (10);
1773+
ALTERTABLE rls_tbl ENABLE ROW LEVEL SECURITY;
1774+
CREATE POLICY p1ON rls_tbl USING (EXISTS (SELECT1FROM ref_tbl));
1775+
1776+
GRANTSELECTON ref_tbl TO regress_rls_bob;
1777+
GRANTSELECTON rls_tbl TO regress_rls_bob;
1778+
1779+
CREATEVIEWrls_viewASSELECT*FROM rls_tbl;
1780+
ALTERVIEW rls_view OWNER TO regress_rls_bob;
1781+
GRANTSELECTON rls_view TO regress_rls_alice;
1782+
1783+
SET SESSION AUTHORIZATION regress_rls_alice;
1784+
SELECT*FROM ref_tbl;-- Permission denied
1785+
SELECT*FROM rls_tbl;-- Permission denied
1786+
SELECT*FROM rls_view;-- OK
1787+
RESET SESSION AUTHORIZATION;
1788+
1789+
DROPVIEW rls_view;
1790+
DROPTABLE rls_tbl;
1791+
DROPTABLE ref_tbl;
1792+
17671793
--
17681794
-- Clean up objects
17691795
--

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp