Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit8f43965

Browse files
committed
RLS: Keep deny policy when only restrictive exist
Only remove the default deny policy when a permissive policy exists(either from the hook or defined by the user). If only restrictivepolicies exist then no rows will be visible, as restrictive policiesshouldn't make rows visible. To address this requirement, a single"USING (true)" permissive policy can be created.Update the test_rls_hooks regression tests to create the necessary"USING (true)" permissive policy.Back-patch to 9.5 where RLS was added.Per discussion with Dean.
1 parent58b30d9 commit8f43965

File tree

4 files changed

+30
-4
lines changed

4 files changed

+30
-4
lines changed

‎src/backend/rewrite/rowsecurity.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -225,12 +225,18 @@ get_row_security_policies(Query *root, CmdType commandType, RangeTblEntry *rte,
225225
}
226226

227227
/*
228-
* If the only built-in policy is the default-deny one, andhook policies
229-
* exist, then use the hook policies only and do not apply the
228+
* If the only built-in policy is the default-deny one, andpermissive hook
229+
*policiesexist, then use the hook policies only and do not apply the
230230
* default-deny policy. Otherwise, we will apply both sets below.
231+
*
232+
* Note that we do not remove the defaultDeny policy if only *restrictive*
233+
* policies exist as restrictive policies should only ever be reducing what
234+
* is visible. Therefore, at least one permissive policy must exist which
235+
* allows records to be seen before restrictive policies can remove rows
236+
* from that set. A single "true" policy can be created to address this
237+
* requirement, if necessary.
231238
*/
232-
if (defaultDeny&&
233-
(hook_policies_restrictive!=NIL||hook_policies_permissive!=NIL))
239+
if (defaultDeny&&hook_policies_permissive!=NIL)
234240
{
235241
rowsec_expr=NULL;
236242
rowsec_with_check_expr=NULL;

‎src/test/modules/test_rls_hooks/expected/test_rls_hooks.out

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ CREATE TABLE rls_test_restrictive (
1313
supervisor name,
1414
data integer
1515
);
16+
-- At least one permissive policy must exist, otherwise
17+
-- the default deny policy will be applied. For
18+
-- testing the only-restrictive-policies from the hook,
19+
-- create a simple 'allow all' policy.
20+
CREATE POLICY p1 ON rls_test_restrictive USING (true);
1621
-- initial test data
1722
INSERT INTO rls_test_restrictive VALUES ('r1','s1',1);
1823
INSERT INTO rls_test_restrictive VALUES ('r2','s2',2);
@@ -109,6 +114,8 @@ RESET ROLE;
109114
-- Create "internal" policies, to check that the policies from
110115
-- the hooks are combined correctly.
111116
CREATE POLICY p1 ON rls_test_permissive USING (data % 2 = 0);
117+
-- Remove the original allow-all policy
118+
DROP POLICY p1 ON rls_test_restrictive;
112119
CREATE POLICY p1 ON rls_test_restrictive USING (data % 2 = 0);
113120
CREATE POLICY p1 ON rls_test_both USING (data % 2 = 0);
114121
SET ROLE r1;

‎src/test/modules/test_rls_hooks/sql/test_rls_hooks.sql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,12 @@ CREATE TABLE rls_test_restrictive (
1717
datainteger
1818
);
1919

20+
-- At least one permissive policy must exist, otherwise
21+
-- the default deny policy will be applied. For
22+
-- testing the only-restrictive-policies from the hook,
23+
-- create a simple 'allow all' policy.
24+
CREATE POLICY p1ON rls_test_restrictive USING (true);
25+
2026
-- initial test data
2127
INSERT INTO rls_test_restrictiveVALUES ('r1','s1',1);
2228
INSERT INTO rls_test_restrictiveVALUES ('r2','s2',2);
@@ -101,6 +107,8 @@ RESET ROLE;
101107
-- the hooks are combined correctly.
102108
CREATE POLICY p1ON rls_test_permissive USING (data %2=0);
103109

110+
-- Remove the original allow-all policy
111+
DROP POLICY p1ON rls_test_restrictive;
104112
CREATE POLICY p1ON rls_test_restrictive USING (data %2=0);
105113

106114
CREATE POLICY p1ON rls_test_both USING (data %2=0);

‎src/test/modules/test_rls_hooks/test_rls_hooks.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,11 @@ test_rls_hooks_permissive(CmdType cmdtype, Relation relation)
119119

120120
/*
121121
* Return restrictive policies to be added
122+
*
123+
* Note that a permissive policy must exist or the default-deny policy
124+
* will be included and nothing will be visible. If no filtering should
125+
* be done except for the restrictive policy, then a single "USING (true)"
126+
* permissive policy can be used; see the regression tests.
122127
*/
123128
List*
124129
test_rls_hooks_restrictive(CmdTypecmdtype,Relationrelation)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp