Re: RLS for superuser

Greetings,

* Gaurav Tomar (gauravtomar14(at)gmail(dot)com) wrote:
> We are developing an application which will connect to the PostgreSQL 9.5
> at backend.
> We do not want any DB role/user including superuser to access the table
> data from the backend, only if the user is logging in from the application
> can see the data.

Superuser can bypass all security through other means (consider the
pageinspect extension, which allows direct reading of any page in the
database, or the pg_read_file() function which allows reading of whole
files directly, and there are many more ways).

> To achieve this we have created policies and enable RLS on the tables. By
> enabling the RLS and creating policies we are able to restrict all the DB
> user/role including table owner of the table but not able to restrict
> superuser.

The table owner will always be able to disable RLS on the table, or to
drop and recreate the table. I'm not sure how you feel that's
"restricting" the table owner, because it really isn't.

Leveraging SELinux and similar technologies is an approach to being
able to limit what a PG superuser could do, but that doesn't seem like
what you're looking for here.

Thanks!

Stephen