From: | Craig Ringer <craig(at)2ndquadrant(dot)com> |
---|---|
To: | Dean Rasheed <dean(dot)a(dot)rasheed(at)gmail(dot)com> |
Cc: | Stephen Frost <sfrost(at)snowman(dot)net>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Row security violation error is misleading |
Date: | 2015-04-09 13:33:16 |
Message-ID: | CAMsr+YEFNJOT+R7zSMZoBqoDhAU-++i2swKS5NpuMSYB4U+qCw@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On 9 April 2015 at 14:56, Dean Rasheed <dean(dot)a(dot)rasheed(at)gmail(dot)com> wrote:
> On 8 April 2015 at 16:27, Stephen Frost <sfrost(at)snowman(dot)net> wrote:
> > * Dean Rasheed (dean(dot)a(dot)rasheed(at)gmail(dot)com) wrote:
> >> I actually re-used the sql status code 42501 -
> >> ERRCODE_INSUFFICIENT_PRIVILEGE for a RLS check failure because of the
> >> parallel with permissions checks, but I quite like Craig's idea of
> >> inventing a new status code for this, so that it can be more easily
> >> distinguished from a lack of GRANTed privileges.
> >
> > As I mentioned to Kevin, I'm not sure that this is really a useful
> > distinction. I'm quite curious if other systems provide that
> > distinction between grant violations and policy violations. If they do
> > then that would certainly bolster the argument to provide the
> > distinction in PG.
> >
>
> OK, on further reflection I think that's probably right.
>
> ERRCODE_INSUFFICIENT_PRIVILEGE is certainly more appropriate than
> anything based on a WCO violation, because it reflects the fact that
> the current user isn't allowed to perform the insert/update, but
> another user might be allowed, so this is a privilege problem, not a
> data error.
>
I'd be OK with that too. Reusing WCO's code for something that isn't really
"with check option" at all was my concern, really.
--
Craig Ringer http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services
From | Date | Subject | |
---|---|---|---|
Next Message | Alvaro Herrera | 2015-04-09 13:41:36 | Re: "rejected" vs "returned with feedback" in new CF app |
Previous Message | Craig Ringer | 2015-04-09 13:29:56 | Re: pg_restore -t should match views, matviews, and foreign tables |