mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-09-15 21:00:20 +02:00
0bf22e0c8b
In prepend_row_security_policies(), defaultDeny was always true, so if there were any hook policies, the RLS policies on the table would just get discarded. Fixed to start off with defaultDeny as false and then properly set later if we detect that only the default deny policy exists for the internal policies. The infinite recursion detection in fireRIRrules() didn't properly manage the activeRIRs list in the case of WCOs, so it would incorrectly report infinite recusion if the same relation with RLS appeared more than once in the rtable, for example "UPDATE t ... FROM t ...". Further, the RLS expansion code in fireRIRrules() was handling RLS in the main loop through the rtable, which lead to RTEs being visited twice if they contained sublink subqueries, which prepend_row_security_policies() attempted to handle by exiting early if the RTE already had securityQuals. That doesn't work, however, since if the query involved a security barrier view on top of a table with RLS, the RTE would already have securityQuals (from the view) by the time fireRIRrules() was invoked, and so the table's RLS policies would be ignored. This is fixed in fireRIRrules() by handling RLS in a separate loop at the end, after dealing with any other sublink subqueries, thus ensuring that each RTE is only visited once for RLS expansion. The inheritance planner code didn't correctly handle non-target relations with RLS, which would get turned into subqueries during planning. Thus an update of the form "UPDATE t1 ... FROM t2 ..." where t1 has inheritance and t2 has RLS quals would fail. Fix by making sure to copy in and update the securityQuals when they exist for non-target relations. process_policies() was adding WCOs to non-target relations, which is unnecessary, and could lead to a lot of wasted time in the rewriter and the planner. Fix by only adding WCO policies when working on the result relation. Also in process_policies, we should be copying the USING policies to the WITH CHECK policies on a per-policy basis, fix by moving the copying up into the per-policy loop. Lastly, as noted by Dean, we were simply adding policies returned by the hook provided to the list of quals being AND'd, meaning that they would actually restrict records returned and there was no option to have internal policies and hook-based policies work together permissively (as all internal policies currently work). Instead, explicitly add support for both permissive and restrictive policies by having a hook for each and combining the results appropriately. To ensure this is all done correctly, add a new test module (test_rls_hooks) to test the various combinations of internal, permissive, and restrictive hook policies. Largely from Dean Rasheed (thanks!): CAEZATCVmFUfUOwwhnBTcgi6AquyjQ0-1fyKd0T3xBWJvn+xsFA@mail.gmail.com Author: Dean Rasheed, though I added the new hooks and test module.
49 lines
1.7 KiB
C
49 lines
1.7 KiB
C
/* -------------------------------------------------------------------------
|
|
*
|
|
* rowsecurity.h
|
|
*
|
|
* prototypes for rewrite/rowsecurity.c and the structures for managing
|
|
* the row security policies for relations in relcache.
|
|
*
|
|
* Portions Copyright (c) 1996-2015, PostgreSQL Global Development Group
|
|
* Portions Copyright (c) 1994, Regents of the University of California
|
|
*
|
|
* -------------------------------------------------------------------------
|
|
*/
|
|
#ifndef ROWSECURITY_H
|
|
#define ROWSECURITY_H
|
|
|
|
#include "nodes/parsenodes.h"
|
|
#include "utils/array.h"
|
|
#include "utils/relcache.h"
|
|
|
|
typedef struct RowSecurityPolicy
|
|
{
|
|
Oid policy_id; /* OID of the policy */
|
|
char *policy_name; /* Name of the policy */
|
|
char polcmd; /* Type of command policy is for */
|
|
ArrayType *roles; /* Array of roles policy is for */
|
|
Expr *qual; /* Expression to filter rows */
|
|
Expr *with_check_qual; /* Expression to limit rows allowed */
|
|
bool hassublinks; /* If either expression has sublinks */
|
|
} RowSecurityPolicy;
|
|
|
|
typedef struct RowSecurityDesc
|
|
{
|
|
MemoryContext rscxt; /* row security memory context */
|
|
List *policies; /* list of row security policies */
|
|
} RowSecurityDesc;
|
|
|
|
typedef List *(*row_security_policy_hook_type)(CmdType cmdtype,
|
|
Relation relation);
|
|
|
|
extern PGDLLIMPORT row_security_policy_hook_type row_security_policy_hook_permissive;
|
|
|
|
extern PGDLLIMPORT row_security_policy_hook_type row_security_policy_hook_restrictive;
|
|
|
|
extern void get_row_security_policies(Query* root, RangeTblEntry* rte, int rt_index,
|
|
List **securityQuals, List **withCheckOptions,
|
|
bool *hasRowSecurity, bool *hasSubLinks);
|
|
|
|
#endif /* ROWSECURITY_H */
|