From: | PG Bug reporting form <noreply(at)postgresql(dot)org> |
---|---|
To: | pgsql-bugs(at)lists(dot)postgresql(dot)org |
Cc: | quae(at)daurnimator(dot)com |
Subject: | BUG #15708: RLS 'using' running as wrong user when called from a view |
Date: | 2019-03-20 23:53:56 |
Message-ID: | 15708-d65cab2ce9b1717a@postgresql.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-bugs pgsql-hackers |
The following bug has been logged on the website:
Bug reference: 15708
Logged by: Daurnimator
Email address: quae(at)daurnimator(dot)com
PostgreSQL version: 11.2
Operating system: linux
Description:
(from https://gist.github.com/daurnimator/b1d2c16359e346a466b3093ae2757acf
)
This fails, seemingly because the RLS on 'bar' is being checked by alice,
instead of the view owner bob:
```sql
create role alice;
create table bar(a integer);
alter table bar enable row level security;
create table qux(b integer);
create role bob;
create policy blahblah on bar to bob
using(exists(select 1 from qux));
grant select on table bar to bob;
grant select on table qux to bob;
create view foo as select * from bar;
alter view foo owner to bob;
grant select on table foo to alice;
-- grant select on table qux to alice; -- shouldn't be required
set role alice;
select * from foo;
```
```
$ psql -f rls_trouble.sql
CREATE ROLE
CREATE TABLE
ALTER TABLE
CREATE TABLE
CREATE ROLE
CREATE POLICY
GRANT
GRANT
CREATE VIEW
ALTER VIEW
GRANT
SET
psql:rls_trouble.sql:18: ERROR: permission denied for table qux
```
If we add an indirection via another view, then I get the result I
expected...
```sql
create role alice;
create table bar(a integer);
alter table bar enable row level security;
create table qux(b integer);
-- if we add a layer of indirection it works.... wat?
create view indirection as select * from bar;
create role bob;
create policy blahblah on bar to bob
using(exists(select 1 from qux));
grant select on table bar to bob;
grant select on table indirection to bob;
grant select on table qux to bob;
create view foo as select * from indirection;
alter view foo owner to bob;
grant select on table foo to alice;
set role alice;
select * from foo;
```
From | Date | Subject | |
---|---|---|---|
Next Message | Jonathan S. Katz | 2019-03-21 00:20:17 | Re: BUG #15706: Support Services page out of date |
Previous Message | Euler Taveira | 2019-03-20 23:11:25 | Re: BUG #15706: Support Services page out of date |
From | Date | Subject | |
---|---|---|---|
Next Message | Haribabu Kommi | 2019-03-21 00:36:42 | MSVC Build support with visual studio 2019 |
Previous Message | Tatsuo Ishii | 2019-03-20 23:41:32 | Re: PostgreSQL pollutes the file system |