Re: unclear about row-level security USING vs. CHECK

From: "Charles Clavadetscher" <clavadetscher(at)swisspug(dot)org>
To: "'Robert Haas'" <robertmhaas(at)gmail(dot)com>, "'Stephen Frost'" <sfrost(at)snowman(dot)net>
Cc: "'Peter Eisentraut'" <peter_e(at)gmx(dot)net>, "'pgsql-hackers'" <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: unclear about row-level security USING vs. CHECK
Date: 2015-09-29 06:00:13
Message-ID: 048f01d0fa7c$23a68a30$6af39e90$@swisspug.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

I had not seen this.

> -----Original Message-----
> From: pgsql-hackers-owner(at)postgresql(dot)org [mailto:pgsql-hackers-owner(at)postgresql(dot)org] On Behalf Of Robert Haas
> Sent: Montag, 28. September 2015 21:43
> To: Stephen Frost <sfrost(at)snowman(dot)net>
> Cc: Peter Eisentraut <peter_e(at)gmx(dot)net>; pgsql-hackers <pgsql-hackers(at)postgresql(dot)org>; Charles Clavadetscher
> <clavadetscher(at)swisspug(dot)org>
> Subject: Re: [HACKERS] unclear about row-level security USING vs. CHECK
>
> On Mon, Sep 28, 2015 at 3:15 PM, Stephen Frost <sfrost(at)snowman(dot)net> wrote:
> > I listed out the various alternatives but didn't end up getting any
> > responses to it. I'm still of the opinion that the documentation is the
> > main thing which needs improving here, but we can also change CREATE
> > POLICY, et al, to require an explicit WITH CHECK clause for the commands
> > where that makes sense if that's the consensus.
>
> My vote is to remove the behavior where USING flows over to WITH
> CHECK. So you only get a WITH CHECK policy if you explicitly specify
> one.
>
> If there's some other consensus, OK, but tempus fugit.

If the behaviof of USING doesn't flow to WITH CHECK is the same as making WITH CHECK mandatory for ALL and UPDATE, I guess. Otherwise there would be a partially unspecified behavior. Or am I misunderstanding your idea?

Charles

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Etsuro Fujita 2015-09-29 07:36:02 Re: Foreign join pushdown vs EvalPlanQual
Previous Message Etsuro Fujita 2015-09-29 05:55:59 Re: Comment update to pathnode.c