2237 lines
71 KiB
Plaintext
2237 lines
71 KiB
Plaintext
--
|
|
-- Test of Row-level security feature
|
|
--
|
|
-- Clean up in case a prior regression run failed
|
|
-- Suppress NOTICE messages when users/groups don't exist
|
|
SET client_min_messages TO 'warning';
|
|
DROP USER IF EXISTS rls_regress_user0;
|
|
DROP USER IF EXISTS rls_regress_user1;
|
|
DROP USER IF EXISTS rls_regress_user2;
|
|
DROP USER IF EXISTS rls_regress_exempt_user;
|
|
DROP ROLE IF EXISTS rls_regress_group1;
|
|
DROP ROLE IF EXISTS rls_regress_group2;
|
|
DROP SCHEMA IF EXISTS rls_regress_schema CASCADE;
|
|
RESET client_min_messages;
|
|
-- initial setup
|
|
CREATE USER rls_regress_user0;
|
|
CREATE USER rls_regress_user1;
|
|
CREATE USER rls_regress_user2;
|
|
CREATE USER rls_regress_exempt_user BYPASSRLS;
|
|
CREATE ROLE rls_regress_group1 NOLOGIN;
|
|
CREATE ROLE rls_regress_group2 NOLOGIN;
|
|
GRANT rls_regress_group1 TO rls_regress_user1;
|
|
GRANT rls_regress_group2 TO rls_regress_user2;
|
|
CREATE SCHEMA rls_regress_schema;
|
|
GRANT ALL ON SCHEMA rls_regress_schema to public;
|
|
SET search_path = rls_regress_schema;
|
|
-- setup of malicious function
|
|
CREATE OR REPLACE FUNCTION f_leak(text) RETURNS bool
|
|
COST 0.0000001 LANGUAGE plpgsql
|
|
AS 'BEGIN RAISE NOTICE ''f_leak => %'', $1; RETURN true; END';
|
|
GRANT EXECUTE ON FUNCTION f_leak(text) TO public;
|
|
-- BASIC Row-Level Security Scenario
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE TABLE uaccount (
|
|
pguser name primary key,
|
|
seclv int
|
|
);
|
|
GRANT SELECT ON uaccount TO public;
|
|
INSERT INTO uaccount VALUES
|
|
('rls_regress_user0', 99),
|
|
('rls_regress_user1', 1),
|
|
('rls_regress_user2', 2),
|
|
('rls_regress_user3', 3);
|
|
CREATE TABLE category (
|
|
cid int primary key,
|
|
cname text
|
|
);
|
|
GRANT ALL ON category TO public;
|
|
INSERT INTO category VALUES
|
|
(11, 'novel'),
|
|
(22, 'science fiction'),
|
|
(33, 'technology'),
|
|
(44, 'manga');
|
|
CREATE TABLE document (
|
|
did int primary key,
|
|
cid int references category(cid),
|
|
dlevel int not null,
|
|
dauthor name,
|
|
dtitle text
|
|
);
|
|
GRANT ALL ON document TO public;
|
|
INSERT INTO document VALUES
|
|
( 1, 11, 1, 'rls_regress_user1', 'my first novel'),
|
|
( 2, 11, 2, 'rls_regress_user1', 'my second novel'),
|
|
( 3, 22, 2, 'rls_regress_user1', 'my science fiction'),
|
|
( 4, 44, 1, 'rls_regress_user1', 'my first manga'),
|
|
( 5, 44, 2, 'rls_regress_user1', 'my second manga'),
|
|
( 6, 22, 1, 'rls_regress_user2', 'great science fiction'),
|
|
( 7, 33, 2, 'rls_regress_user2', 'great technology book'),
|
|
( 8, 44, 1, 'rls_regress_user2', 'great manga');
|
|
ALTER TABLE document ENABLE ROW LEVEL SECURITY;
|
|
-- user's security level must be higher than or equal to document's
|
|
CREATE POLICY p1 ON document
|
|
USING (dlevel <= (SELECT seclv FROM uaccount WHERE pguser = current_user));
|
|
-- viewpoint from rls_regress_user1
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SET row_security TO ON;
|
|
SELECT * FROM document WHERE f_leak(dtitle) ORDER BY did;
|
|
NOTICE: f_leak => my first novel
|
|
NOTICE: f_leak => my first manga
|
|
NOTICE: f_leak => great science fiction
|
|
NOTICE: f_leak => great manga
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+-------------------+-----------------------
|
|
1 | 11 | 1 | rls_regress_user1 | my first novel
|
|
4 | 44 | 1 | rls_regress_user1 | my first manga
|
|
6 | 22 | 1 | rls_regress_user2 | great science fiction
|
|
8 | 44 | 1 | rls_regress_user2 | great manga
|
|
(4 rows)
|
|
|
|
SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle) ORDER BY did;
|
|
NOTICE: f_leak => my first novel
|
|
NOTICE: f_leak => my first manga
|
|
NOTICE: f_leak => great science fiction
|
|
NOTICE: f_leak => great manga
|
|
cid | did | dlevel | dauthor | dtitle | cname
|
|
-----+-----+--------+-------------------+-----------------------+-----------------
|
|
11 | 1 | 1 | rls_regress_user1 | my first novel | novel
|
|
44 | 4 | 1 | rls_regress_user1 | my first manga | manga
|
|
22 | 6 | 1 | rls_regress_user2 | great science fiction | science fiction
|
|
44 | 8 | 1 | rls_regress_user2 | great manga | manga
|
|
(4 rows)
|
|
|
|
-- viewpoint from rls_regress_user2
|
|
SET SESSION AUTHORIZATION rls_regress_user2;
|
|
SELECT * FROM document WHERE f_leak(dtitle) ORDER BY did;
|
|
NOTICE: f_leak => my first novel
|
|
NOTICE: f_leak => my second novel
|
|
NOTICE: f_leak => my science fiction
|
|
NOTICE: f_leak => my first manga
|
|
NOTICE: f_leak => my second manga
|
|
NOTICE: f_leak => great science fiction
|
|
NOTICE: f_leak => great technology book
|
|
NOTICE: f_leak => great manga
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+-------------------+-----------------------
|
|
1 | 11 | 1 | rls_regress_user1 | my first novel
|
|
2 | 11 | 2 | rls_regress_user1 | my second novel
|
|
3 | 22 | 2 | rls_regress_user1 | my science fiction
|
|
4 | 44 | 1 | rls_regress_user1 | my first manga
|
|
5 | 44 | 2 | rls_regress_user1 | my second manga
|
|
6 | 22 | 1 | rls_regress_user2 | great science fiction
|
|
7 | 33 | 2 | rls_regress_user2 | great technology book
|
|
8 | 44 | 1 | rls_regress_user2 | great manga
|
|
(8 rows)
|
|
|
|
SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle) ORDER BY did;
|
|
NOTICE: f_leak => my first novel
|
|
NOTICE: f_leak => my second novel
|
|
NOTICE: f_leak => my science fiction
|
|
NOTICE: f_leak => my first manga
|
|
NOTICE: f_leak => my second manga
|
|
NOTICE: f_leak => great science fiction
|
|
NOTICE: f_leak => great technology book
|
|
NOTICE: f_leak => great manga
|
|
cid | did | dlevel | dauthor | dtitle | cname
|
|
-----+-----+--------+-------------------+-----------------------+-----------------
|
|
11 | 1 | 1 | rls_regress_user1 | my first novel | novel
|
|
11 | 2 | 2 | rls_regress_user1 | my second novel | novel
|
|
22 | 3 | 2 | rls_regress_user1 | my science fiction | science fiction
|
|
44 | 4 | 1 | rls_regress_user1 | my first manga | manga
|
|
44 | 5 | 2 | rls_regress_user1 | my second manga | manga
|
|
22 | 6 | 1 | rls_regress_user2 | great science fiction | science fiction
|
|
33 | 7 | 2 | rls_regress_user2 | great technology book | technology
|
|
44 | 8 | 1 | rls_regress_user2 | great manga | manga
|
|
(8 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM document WHERE f_leak(dtitle);
|
|
QUERY PLAN
|
|
----------------------------------------------------------
|
|
Subquery Scan on document
|
|
Filter: f_leak(document.dtitle)
|
|
-> Seq Scan on document document_1
|
|
Filter: (dlevel <= $0)
|
|
InitPlan 1 (returns $0)
|
|
-> Index Scan using uaccount_pkey on uaccount
|
|
Index Cond: (pguser = "current_user"())
|
|
(7 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle);
|
|
QUERY PLAN
|
|
----------------------------------------------------------------------
|
|
Hash Join
|
|
Hash Cond: (category.cid = document.cid)
|
|
-> Seq Scan on category
|
|
-> Hash
|
|
-> Subquery Scan on document
|
|
Filter: f_leak(document.dtitle)
|
|
-> Seq Scan on document document_1
|
|
Filter: (dlevel <= $0)
|
|
InitPlan 1 (returns $0)
|
|
-> Index Scan using uaccount_pkey on uaccount
|
|
Index Cond: (pguser = "current_user"())
|
|
(11 rows)
|
|
|
|
-- only owner can change row-level security
|
|
ALTER POLICY p1 ON document USING (true); --fail
|
|
ERROR: must be owner of relation document
|
|
DROP POLICY p1 ON document; --fail
|
|
ERROR: must be owner of relation document
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
ALTER POLICY p1 ON document USING (dauthor = current_user);
|
|
-- viewpoint from rls_regress_user1 again
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM document WHERE f_leak(dtitle) ORDER BY did;
|
|
NOTICE: f_leak => my first novel
|
|
NOTICE: f_leak => my second novel
|
|
NOTICE: f_leak => my science fiction
|
|
NOTICE: f_leak => my first manga
|
|
NOTICE: f_leak => my second manga
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+-------------------+--------------------
|
|
1 | 11 | 1 | rls_regress_user1 | my first novel
|
|
2 | 11 | 2 | rls_regress_user1 | my second novel
|
|
3 | 22 | 2 | rls_regress_user1 | my science fiction
|
|
4 | 44 | 1 | rls_regress_user1 | my first manga
|
|
5 | 44 | 2 | rls_regress_user1 | my second manga
|
|
(5 rows)
|
|
|
|
SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle) ORDER by did;
|
|
NOTICE: f_leak => my first novel
|
|
NOTICE: f_leak => my second novel
|
|
NOTICE: f_leak => my science fiction
|
|
NOTICE: f_leak => my first manga
|
|
NOTICE: f_leak => my second manga
|
|
cid | did | dlevel | dauthor | dtitle | cname
|
|
-----+-----+--------+-------------------+--------------------+-----------------
|
|
11 | 1 | 1 | rls_regress_user1 | my first novel | novel
|
|
11 | 2 | 2 | rls_regress_user1 | my second novel | novel
|
|
22 | 3 | 2 | rls_regress_user1 | my science fiction | science fiction
|
|
44 | 4 | 1 | rls_regress_user1 | my first manga | manga
|
|
44 | 5 | 2 | rls_regress_user1 | my second manga | manga
|
|
(5 rows)
|
|
|
|
-- viewpoint from rls_regres_user2 again
|
|
SET SESSION AUTHORIZATION rls_regress_user2;
|
|
SELECT * FROM document WHERE f_leak(dtitle) ORDER BY did;
|
|
NOTICE: f_leak => great science fiction
|
|
NOTICE: f_leak => great technology book
|
|
NOTICE: f_leak => great manga
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+-------------------+-----------------------
|
|
6 | 22 | 1 | rls_regress_user2 | great science fiction
|
|
7 | 33 | 2 | rls_regress_user2 | great technology book
|
|
8 | 44 | 1 | rls_regress_user2 | great manga
|
|
(3 rows)
|
|
|
|
SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle) ORDER by did;
|
|
NOTICE: f_leak => great science fiction
|
|
NOTICE: f_leak => great technology book
|
|
NOTICE: f_leak => great manga
|
|
cid | did | dlevel | dauthor | dtitle | cname
|
|
-----+-----+--------+-------------------+-----------------------+-----------------
|
|
22 | 6 | 1 | rls_regress_user2 | great science fiction | science fiction
|
|
33 | 7 | 2 | rls_regress_user2 | great technology book | technology
|
|
44 | 8 | 1 | rls_regress_user2 | great manga | manga
|
|
(3 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM document WHERE f_leak(dtitle);
|
|
QUERY PLAN
|
|
----------------------------------------------
|
|
Subquery Scan on document
|
|
Filter: f_leak(document.dtitle)
|
|
-> Seq Scan on document document_1
|
|
Filter: (dauthor = "current_user"())
|
|
(4 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM document NATURAL JOIN category WHERE f_leak(dtitle);
|
|
QUERY PLAN
|
|
----------------------------------------------------
|
|
Nested Loop
|
|
-> Subquery Scan on document
|
|
Filter: f_leak(document.dtitle)
|
|
-> Seq Scan on document document_1
|
|
Filter: (dauthor = "current_user"())
|
|
-> Index Scan using category_pkey on category
|
|
Index Cond: (cid = document.cid)
|
|
(7 rows)
|
|
|
|
-- interaction of FK/PK constraints
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE POLICY p2 ON category
|
|
USING (CASE WHEN current_user = 'rls_regress_user1' THEN cid IN (11, 33)
|
|
WHEN current_user = 'rls_regress_user2' THEN cid IN (22, 44)
|
|
ELSE false END);
|
|
ALTER TABLE category ENABLE ROW LEVEL SECURITY;
|
|
-- cannot delete PK referenced by invisible FK
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid;
|
|
did | cid | dlevel | dauthor | dtitle | cid | cname
|
|
-----+-----+--------+-------------------+--------------------+-----+------------
|
|
2 | 11 | 2 | rls_regress_user1 | my second novel | 11 | novel
|
|
1 | 11 | 1 | rls_regress_user1 | my first novel | 11 | novel
|
|
| | | | | 33 | technology
|
|
5 | 44 | 2 | rls_regress_user1 | my second manga | |
|
|
4 | 44 | 1 | rls_regress_user1 | my first manga | |
|
|
3 | 22 | 2 | rls_regress_user1 | my science fiction | |
|
|
(6 rows)
|
|
|
|
DELETE FROM category WHERE cid = 33; -- fails with FK violation
|
|
ERROR: update or delete on table "category" violates foreign key constraint "document_cid_fkey" on table "document"
|
|
DETAIL: Key (cid)=(33) is still referenced from table "document".
|
|
-- can insert FK referencing invisible PK
|
|
SET SESSION AUTHORIZATION rls_regress_user2;
|
|
SELECT * FROM document d FULL OUTER JOIN category c on d.cid = c.cid;
|
|
did | cid | dlevel | dauthor | dtitle | cid | cname
|
|
-----+-----+--------+-------------------+-----------------------+-----+-----------------
|
|
6 | 22 | 1 | rls_regress_user2 | great science fiction | 22 | science fiction
|
|
8 | 44 | 1 | rls_regress_user2 | great manga | 44 | manga
|
|
7 | 33 | 2 | rls_regress_user2 | great technology book | |
|
|
(3 rows)
|
|
|
|
INSERT INTO document VALUES (10, 33, 1, current_user, 'hoge');
|
|
-- UNIQUE or PRIMARY KEY constraint violation DOES reveal presence of row
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
INSERT INTO document VALUES (8, 44, 1, 'rls_regress_user1', 'my third manga'); -- Must fail with unique violation, revealing presence of did we can't see
|
|
ERROR: duplicate key value violates unique constraint "document_pkey"
|
|
DETAIL: Key (did)=(8) already exists.
|
|
SELECT * FROM document WHERE did = 8; -- and confirm we can't see it
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+---------+--------
|
|
(0 rows)
|
|
|
|
-- database superuser does bypass RLS policy when enabled
|
|
RESET SESSION AUTHORIZATION;
|
|
SET row_security TO ON;
|
|
SELECT * FROM document;
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+-------------------+-----------------------
|
|
1 | 11 | 1 | rls_regress_user1 | my first novel
|
|
2 | 11 | 2 | rls_regress_user1 | my second novel
|
|
3 | 22 | 2 | rls_regress_user1 | my science fiction
|
|
4 | 44 | 1 | rls_regress_user1 | my first manga
|
|
5 | 44 | 2 | rls_regress_user1 | my second manga
|
|
6 | 22 | 1 | rls_regress_user2 | great science fiction
|
|
7 | 33 | 2 | rls_regress_user2 | great technology book
|
|
8 | 44 | 1 | rls_regress_user2 | great manga
|
|
10 | 33 | 1 | rls_regress_user2 | hoge
|
|
(9 rows)
|
|
|
|
SELECT * FROM category;
|
|
cid | cname
|
|
-----+-----------------
|
|
11 | novel
|
|
22 | science fiction
|
|
33 | technology
|
|
44 | manga
|
|
(4 rows)
|
|
|
|
-- database superuser does not bypass RLS policy when FORCE enabled.
|
|
RESET SESSION AUTHORIZATION;
|
|
SET row_security TO FORCE;
|
|
SELECT * FROM document;
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+---------+--------
|
|
(0 rows)
|
|
|
|
SELECT * FROM category;
|
|
cid | cname
|
|
-----+-------
|
|
(0 rows)
|
|
|
|
-- database superuser does bypass RLS policy when disabled
|
|
RESET SESSION AUTHORIZATION;
|
|
SET row_security TO OFF;
|
|
SELECT * FROM document;
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+-------------------+-----------------------
|
|
1 | 11 | 1 | rls_regress_user1 | my first novel
|
|
2 | 11 | 2 | rls_regress_user1 | my second novel
|
|
3 | 22 | 2 | rls_regress_user1 | my science fiction
|
|
4 | 44 | 1 | rls_regress_user1 | my first manga
|
|
5 | 44 | 2 | rls_regress_user1 | my second manga
|
|
6 | 22 | 1 | rls_regress_user2 | great science fiction
|
|
7 | 33 | 2 | rls_regress_user2 | great technology book
|
|
8 | 44 | 1 | rls_regress_user2 | great manga
|
|
10 | 33 | 1 | rls_regress_user2 | hoge
|
|
(9 rows)
|
|
|
|
SELECT * FROM category;
|
|
cid | cname
|
|
-----+-----------------
|
|
11 | novel
|
|
22 | science fiction
|
|
33 | technology
|
|
44 | manga
|
|
(4 rows)
|
|
|
|
-- database non-superuser with bypass privilege can bypass RLS policy when disabled
|
|
SET SESSION AUTHORIZATION rls_regress_exempt_user;
|
|
SET row_security TO OFF;
|
|
SELECT * FROM document;
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+-------------------+-----------------------
|
|
1 | 11 | 1 | rls_regress_user1 | my first novel
|
|
2 | 11 | 2 | rls_regress_user1 | my second novel
|
|
3 | 22 | 2 | rls_regress_user1 | my science fiction
|
|
4 | 44 | 1 | rls_regress_user1 | my first manga
|
|
5 | 44 | 2 | rls_regress_user1 | my second manga
|
|
6 | 22 | 1 | rls_regress_user2 | great science fiction
|
|
7 | 33 | 2 | rls_regress_user2 | great technology book
|
|
8 | 44 | 1 | rls_regress_user2 | great manga
|
|
10 | 33 | 1 | rls_regress_user2 | hoge
|
|
(9 rows)
|
|
|
|
SELECT * FROM category;
|
|
cid | cname
|
|
-----+-----------------
|
|
11 | novel
|
|
22 | science fiction
|
|
33 | technology
|
|
44 | manga
|
|
(4 rows)
|
|
|
|
-- RLS policy applies to table owner when FORCE enabled.
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
SET row_security TO FORCE;
|
|
SELECT * FROM document;
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+---------+--------
|
|
(0 rows)
|
|
|
|
SELECT * FROM category;
|
|
cid | cname
|
|
-----+-------
|
|
(0 rows)
|
|
|
|
-- RLS policy does not apply to table owner when RLS enabled.
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
SET row_security TO ON;
|
|
SELECT * FROM document;
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+-------------------+-----------------------
|
|
1 | 11 | 1 | rls_regress_user1 | my first novel
|
|
2 | 11 | 2 | rls_regress_user1 | my second novel
|
|
3 | 22 | 2 | rls_regress_user1 | my science fiction
|
|
4 | 44 | 1 | rls_regress_user1 | my first manga
|
|
5 | 44 | 2 | rls_regress_user1 | my second manga
|
|
6 | 22 | 1 | rls_regress_user2 | great science fiction
|
|
7 | 33 | 2 | rls_regress_user2 | great technology book
|
|
8 | 44 | 1 | rls_regress_user2 | great manga
|
|
10 | 33 | 1 | rls_regress_user2 | hoge
|
|
(9 rows)
|
|
|
|
SELECT * FROM category;
|
|
cid | cname
|
|
-----+-----------------
|
|
11 | novel
|
|
22 | science fiction
|
|
33 | technology
|
|
44 | manga
|
|
(4 rows)
|
|
|
|
-- RLS policy does not apply to table owner when RLS disabled.
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
SET row_security TO OFF;
|
|
SELECT * FROM document;
|
|
did | cid | dlevel | dauthor | dtitle
|
|
-----+-----+--------+-------------------+-----------------------
|
|
1 | 11 | 1 | rls_regress_user1 | my first novel
|
|
2 | 11 | 2 | rls_regress_user1 | my second novel
|
|
3 | 22 | 2 | rls_regress_user1 | my science fiction
|
|
4 | 44 | 1 | rls_regress_user1 | my first manga
|
|
5 | 44 | 2 | rls_regress_user1 | my second manga
|
|
6 | 22 | 1 | rls_regress_user2 | great science fiction
|
|
7 | 33 | 2 | rls_regress_user2 | great technology book
|
|
8 | 44 | 1 | rls_regress_user2 | great manga
|
|
10 | 33 | 1 | rls_regress_user2 | hoge
|
|
(9 rows)
|
|
|
|
SELECT * FROM category;
|
|
cid | cname
|
|
-----+-----------------
|
|
11 | novel
|
|
22 | science fiction
|
|
33 | technology
|
|
44 | manga
|
|
(4 rows)
|
|
|
|
--
|
|
-- Table inheritance and RLS policy
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
SET row_security TO ON;
|
|
CREATE TABLE t1 (a int, junk1 text, b text) WITH OIDS;
|
|
ALTER TABLE t1 DROP COLUMN junk1; -- just a disturbing factor
|
|
GRANT ALL ON t1 TO public;
|
|
COPY t1 FROM stdin WITH (oids);
|
|
CREATE TABLE t2 (c float) INHERITS (t1);
|
|
COPY t2 FROM stdin WITH (oids);
|
|
CREATE TABLE t3 (c text, b text, a int) WITH OIDS;
|
|
ALTER TABLE t3 INHERIT t1;
|
|
COPY t3(a,b,c) FROM stdin WITH (oids);
|
|
CREATE POLICY p1 ON t1 FOR ALL TO PUBLIC USING (a % 2 = 0); -- be even number
|
|
CREATE POLICY p2 ON t2 FOR ALL TO PUBLIC USING (a % 2 = 1); -- be odd number
|
|
ALTER TABLE t1 ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE t2 ENABLE ROW LEVEL SECURITY;
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM t1;
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
4 | ddd
|
|
2 | bcd
|
|
4 | def
|
|
2 | yyy
|
|
(5 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1;
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t2
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t3
|
|
Filter: ((a % 2) = 0)
|
|
(7 rows)
|
|
|
|
SELECT * FROM t1 WHERE f_leak(b);
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ddd
|
|
NOTICE: f_leak => bcd
|
|
NOTICE: f_leak => def
|
|
NOTICE: f_leak => yyy
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
4 | ddd
|
|
2 | bcd
|
|
4 | def
|
|
2 | yyy
|
|
(5 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------------
|
|
Subquery Scan on t1
|
|
Filter: f_leak(t1.b)
|
|
-> Append
|
|
-> Seq Scan on t1 t1_1
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t2
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t3
|
|
Filter: ((a % 2) = 0)
|
|
(9 rows)
|
|
|
|
-- reference to system column
|
|
SELECT oid, * FROM t1;
|
|
oid | a | b
|
|
-----+---+-----
|
|
102 | 2 | bbb
|
|
104 | 4 | ddd
|
|
202 | 2 | bcd
|
|
204 | 4 | def
|
|
302 | 2 | yyy
|
|
(5 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT *, t1 FROM t1;
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t2
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t3
|
|
Filter: ((a % 2) = 0)
|
|
(7 rows)
|
|
|
|
-- reference to whole-row reference
|
|
SELECT *, t1 FROM t1;
|
|
a | b | t1
|
|
---+-----+---------
|
|
2 | bbb | (2,bbb)
|
|
4 | ddd | (4,ddd)
|
|
2 | bcd | (2,bcd)
|
|
4 | def | (4,def)
|
|
2 | yyy | (2,yyy)
|
|
(5 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT *, t1 FROM t1;
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t2
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t3
|
|
Filter: ((a % 2) = 0)
|
|
(7 rows)
|
|
|
|
-- for share/update lock
|
|
SELECT * FROM t1 FOR SHARE;
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
4 | ddd
|
|
2 | bcd
|
|
4 | def
|
|
2 | yyy
|
|
(5 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1 FOR SHARE;
|
|
QUERY PLAN
|
|
-------------------------------------------------------
|
|
LockRows
|
|
-> Subquery Scan on t1
|
|
-> LockRows
|
|
-> Result
|
|
-> Append
|
|
-> Seq Scan on t1 t1_1
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t2
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t3
|
|
Filter: ((a % 2) = 0)
|
|
(11 rows)
|
|
|
|
SELECT * FROM t1 WHERE f_leak(b) FOR SHARE;
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ddd
|
|
NOTICE: f_leak => bcd
|
|
NOTICE: f_leak => def
|
|
NOTICE: f_leak => yyy
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
4 | ddd
|
|
2 | bcd
|
|
4 | def
|
|
2 | yyy
|
|
(5 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1 WHERE f_leak(b) FOR SHARE;
|
|
QUERY PLAN
|
|
-------------------------------------------------------
|
|
LockRows
|
|
-> Subquery Scan on t1
|
|
Filter: f_leak(t1.b)
|
|
-> LockRows
|
|
-> Result
|
|
-> Append
|
|
-> Seq Scan on t1 t1_1
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t2
|
|
Filter: ((a % 2) = 0)
|
|
-> Seq Scan on t3
|
|
Filter: ((a % 2) = 0)
|
|
(12 rows)
|
|
|
|
-- superuser is allowed to bypass RLS checks
|
|
RESET SESSION AUTHORIZATION;
|
|
SET row_security TO OFF;
|
|
SELECT * FROM t1 WHERE f_leak(b);
|
|
NOTICE: f_leak => aaa
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ccc
|
|
NOTICE: f_leak => ddd
|
|
NOTICE: f_leak => abc
|
|
NOTICE: f_leak => bcd
|
|
NOTICE: f_leak => cde
|
|
NOTICE: f_leak => def
|
|
NOTICE: f_leak => xxx
|
|
NOTICE: f_leak => yyy
|
|
NOTICE: f_leak => zzz
|
|
a | b
|
|
---+-----
|
|
1 | aaa
|
|
2 | bbb
|
|
3 | ccc
|
|
4 | ddd
|
|
1 | abc
|
|
2 | bcd
|
|
3 | cde
|
|
4 | def
|
|
1 | xxx
|
|
2 | yyy
|
|
3 | zzz
|
|
(11 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
---------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: f_leak(b)
|
|
-> Seq Scan on t2
|
|
Filter: f_leak(b)
|
|
-> Seq Scan on t3
|
|
Filter: f_leak(b)
|
|
(7 rows)
|
|
|
|
-- non-superuser with bypass privilege can bypass RLS policy when disabled
|
|
SET SESSION AUTHORIZATION rls_regress_exempt_user;
|
|
SET row_security TO OFF;
|
|
SELECT * FROM t1 WHERE f_leak(b);
|
|
NOTICE: f_leak => aaa
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ccc
|
|
NOTICE: f_leak => ddd
|
|
NOTICE: f_leak => abc
|
|
NOTICE: f_leak => bcd
|
|
NOTICE: f_leak => cde
|
|
NOTICE: f_leak => def
|
|
NOTICE: f_leak => xxx
|
|
NOTICE: f_leak => yyy
|
|
NOTICE: f_leak => zzz
|
|
a | b
|
|
---+-----
|
|
1 | aaa
|
|
2 | bbb
|
|
3 | ccc
|
|
4 | ddd
|
|
1 | abc
|
|
2 | bcd
|
|
3 | cde
|
|
4 | def
|
|
1 | xxx
|
|
2 | yyy
|
|
3 | zzz
|
|
(11 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
---------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: f_leak(b)
|
|
-> Seq Scan on t2
|
|
Filter: f_leak(b)
|
|
-> Seq Scan on t3
|
|
Filter: f_leak(b)
|
|
(7 rows)
|
|
|
|
----- Dependencies -----
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
SET row_security TO ON;
|
|
CREATE TABLE dependee (x integer, y integer);
|
|
CREATE TABLE dependent (x integer, y integer);
|
|
CREATE POLICY d1 ON dependent FOR ALL
|
|
TO PUBLIC
|
|
USING (x = (SELECT d.x FROM dependee d WHERE d.y = y));
|
|
DROP TABLE dependee; -- Should fail without CASCADE due to dependency on row-security qual?
|
|
ERROR: cannot drop table dependee because other objects depend on it
|
|
DETAIL: policy d1 on table dependent depends on table dependee
|
|
HINT: Use DROP ... CASCADE to drop the dependent objects too.
|
|
DROP TABLE dependee CASCADE;
|
|
NOTICE: drop cascades to policy d1 on table dependent
|
|
EXPLAIN (COSTS OFF) SELECT * FROM dependent; -- After drop, should be unqualified
|
|
QUERY PLAN
|
|
-----------------------
|
|
Seq Scan on dependent
|
|
(1 row)
|
|
|
|
----- RECURSION ----
|
|
--
|
|
-- Simple recursion
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE TABLE rec1 (x integer, y integer);
|
|
CREATE POLICY r1 ON rec1 USING (x = (SELECT r.x FROM rec1 r WHERE y = r.y));
|
|
ALTER TABLE rec1 ENABLE ROW LEVEL SECURITY;
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM rec1; -- fail, direct recursion
|
|
ERROR: infinite recursion detected in row-security policy for relation "rec1"
|
|
--
|
|
-- Mutual recursion
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE TABLE rec2 (a integer, b integer);
|
|
ALTER POLICY r1 ON rec1 USING (x = (SELECT a FROM rec2 WHERE b = y));
|
|
CREATE POLICY r2 ON rec2 USING (a = (SELECT x FROM rec1 WHERE y = b));
|
|
ALTER TABLE rec2 ENABLE ROW LEVEL SECURITY;
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM rec1; -- fail, mutual recursion
|
|
ERROR: infinite recursion detected in row-security policy for relation "rec1"
|
|
--
|
|
-- Mutual recursion via views
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
CREATE VIEW rec1v AS SELECT * FROM rec1;
|
|
CREATE VIEW rec2v AS SELECT * FROM rec2;
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
ALTER POLICY r1 ON rec1 USING (x = (SELECT a FROM rec2v WHERE b = y));
|
|
ALTER POLICY r2 ON rec2 USING (a = (SELECT x FROM rec1v WHERE y = b));
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM rec1; -- fail, mutual recursion via views
|
|
ERROR: infinite recursion detected in row-security policy for relation "rec1"
|
|
--
|
|
-- Mutual recursion via .s.b views
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
DROP VIEW rec1v, rec2v CASCADE;
|
|
NOTICE: drop cascades to 2 other objects
|
|
DETAIL: drop cascades to policy r1 on table rec1
|
|
drop cascades to policy r2 on table rec2
|
|
CREATE VIEW rec1v WITH (security_barrier) AS SELECT * FROM rec1;
|
|
CREATE VIEW rec2v WITH (security_barrier) AS SELECT * FROM rec2;
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE POLICY r1 ON rec1 USING (x = (SELECT a FROM rec2v WHERE b = y));
|
|
CREATE POLICY r2 ON rec2 USING (a = (SELECT x FROM rec1v WHERE y = b));
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM rec1; -- fail, mutual recursion via s.b. views
|
|
ERROR: infinite recursion detected in row-security policy for relation "rec1"
|
|
--
|
|
-- recursive RLS and VIEWs in policy
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE TABLE s1 (a int, b text);
|
|
INSERT INTO s1 (SELECT x, md5(x::text) FROM generate_series(-10,10) x);
|
|
CREATE TABLE s2 (x int, y text);
|
|
INSERT INTO s2 (SELECT x, md5(x::text) FROM generate_series(-6,6) x);
|
|
GRANT SELECT ON s1, s2 TO rls_regress_user1;
|
|
CREATE POLICY p1 ON s1 USING (a in (select x from s2 where y like '%2f%'));
|
|
CREATE POLICY p2 ON s2 USING (x in (select a from s1 where b like '%22%'));
|
|
CREATE POLICY p3 ON s1 FOR INSERT WITH CHECK (a = (SELECT a FROM s1));
|
|
ALTER TABLE s1 ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE s2 ENABLE ROW LEVEL SECURITY;
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
CREATE VIEW v2 AS SELECT * FROM s2 WHERE y like '%af%';
|
|
SELECT * FROM s1 WHERE f_leak(b); -- fail (infinite recursion)
|
|
ERROR: infinite recursion detected in row-security policy for relation "s1"
|
|
INSERT INTO s1 VALUES (1, 'foo'); -- fail (infinite recursion)
|
|
ERROR: infinite recursion detected in row-security policy for relation "s1"
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
DROP POLICY p3 on s1;
|
|
ALTER POLICY p2 ON s2 USING (x % 2 = 0);
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM s1 WHERE f_leak(b); -- OK
|
|
NOTICE: f_leak => c81e728d9d4c2f636f067f89cc14862c
|
|
NOTICE: f_leak => a87ff679a2f3e71d9181a67b7542122c
|
|
a | b
|
|
---+----------------------------------
|
|
2 | c81e728d9d4c2f636f067f89cc14862c
|
|
4 | a87ff679a2f3e71d9181a67b7542122c
|
|
(2 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM only s1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
----------------------------------------------------------
|
|
Subquery Scan on s1
|
|
Filter: f_leak(s1.b)
|
|
-> Hash Join
|
|
Hash Cond: (s1_1.a = s2.x)
|
|
-> Seq Scan on s1 s1_1
|
|
-> Hash
|
|
-> HashAggregate
|
|
Group Key: s2.x
|
|
-> Subquery Scan on s2
|
|
Filter: (s2.y ~~ '%2f%'::text)
|
|
-> Seq Scan on s2 s2_1
|
|
Filter: ((x % 2) = 0)
|
|
(12 rows)
|
|
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
ALTER POLICY p1 ON s1 USING (a in (select x from v2)); -- using VIEW in RLS policy
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM s1 WHERE f_leak(b); -- OK
|
|
NOTICE: f_leak => 0267aaf632e87a63288a08331f22c7c3
|
|
NOTICE: f_leak => 1679091c5a880faf6fb5e6087eb1b2dc
|
|
a | b
|
|
----+----------------------------------
|
|
-4 | 0267aaf632e87a63288a08331f22c7c3
|
|
6 | 1679091c5a880faf6fb5e6087eb1b2dc
|
|
(2 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM s1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
----------------------------------------------------------
|
|
Subquery Scan on s1
|
|
Filter: f_leak(s1.b)
|
|
-> Hash Join
|
|
Hash Cond: (s1_1.a = s2.x)
|
|
-> Seq Scan on s1 s1_1
|
|
-> Hash
|
|
-> HashAggregate
|
|
Group Key: s2.x
|
|
-> Subquery Scan on s2
|
|
Filter: (s2.y ~~ '%af%'::text)
|
|
-> Seq Scan on s2 s2_1
|
|
Filter: ((x % 2) = 0)
|
|
(12 rows)
|
|
|
|
SELECT (SELECT x FROM s1 LIMIT 1) xx, * FROM s2 WHERE y like '%28%';
|
|
xx | x | y
|
|
----+----+----------------------------------
|
|
-6 | -6 | 596a3d04481816330f07e4f97510c28f
|
|
-4 | -4 | 0267aaf632e87a63288a08331f22c7c3
|
|
2 | 2 | c81e728d9d4c2f636f067f89cc14862c
|
|
(3 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT (SELECT x FROM s1 LIMIT 1) xx, * FROM s2 WHERE y like '%28%';
|
|
QUERY PLAN
|
|
--------------------------------------------------------------------
|
|
Subquery Scan on s2
|
|
Filter: (s2.y ~~ '%28%'::text)
|
|
-> Seq Scan on s2 s2_1
|
|
Filter: ((x % 2) = 0)
|
|
SubPlan 1
|
|
-> Limit
|
|
-> Subquery Scan on s1
|
|
-> Nested Loop Semi Join
|
|
Join Filter: (s1_1.a = s2_2.x)
|
|
-> Seq Scan on s1 s1_1
|
|
-> Materialize
|
|
-> Subquery Scan on s2_2
|
|
Filter: (s2_2.y ~~ '%af%'::text)
|
|
-> Seq Scan on s2 s2_3
|
|
Filter: ((x % 2) = 0)
|
|
(15 rows)
|
|
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
ALTER POLICY p2 ON s2 USING (x in (select a from s1 where b like '%d2%'));
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM s1 WHERE f_leak(b); -- fail (infinite recursion via view)
|
|
ERROR: infinite recursion detected in row-security policy for relation "s1"
|
|
-- prepared statement with rls_regress_user0 privilege
|
|
PREPARE p1(int) AS SELECT * FROM t1 WHERE a <= $1;
|
|
EXECUTE p1(2);
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
2 | bcd
|
|
2 | yyy
|
|
(3 rows)
|
|
|
|
EXPLAIN (COSTS OFF) EXECUTE p1(2);
|
|
QUERY PLAN
|
|
----------------------------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: ((a <= 2) AND ((a % 2) = 0))
|
|
-> Seq Scan on t2
|
|
Filter: ((a <= 2) AND ((a % 2) = 0))
|
|
-> Seq Scan on t3
|
|
Filter: ((a <= 2) AND ((a % 2) = 0))
|
|
(7 rows)
|
|
|
|
-- superuser is allowed to bypass RLS checks
|
|
RESET SESSION AUTHORIZATION;
|
|
SET row_security TO OFF;
|
|
SELECT * FROM t1 WHERE f_leak(b);
|
|
NOTICE: f_leak => aaa
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ccc
|
|
NOTICE: f_leak => ddd
|
|
NOTICE: f_leak => abc
|
|
NOTICE: f_leak => bcd
|
|
NOTICE: f_leak => cde
|
|
NOTICE: f_leak => def
|
|
NOTICE: f_leak => xxx
|
|
NOTICE: f_leak => yyy
|
|
NOTICE: f_leak => zzz
|
|
a | b
|
|
---+-----
|
|
1 | aaa
|
|
2 | bbb
|
|
3 | ccc
|
|
4 | ddd
|
|
1 | abc
|
|
2 | bcd
|
|
3 | cde
|
|
4 | def
|
|
1 | xxx
|
|
2 | yyy
|
|
3 | zzz
|
|
(11 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
---------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: f_leak(b)
|
|
-> Seq Scan on t2
|
|
Filter: f_leak(b)
|
|
-> Seq Scan on t3
|
|
Filter: f_leak(b)
|
|
(7 rows)
|
|
|
|
-- plan cache should be invalidated
|
|
EXECUTE p1(2);
|
|
a | b
|
|
---+-----
|
|
1 | aaa
|
|
2 | bbb
|
|
1 | abc
|
|
2 | bcd
|
|
1 | xxx
|
|
2 | yyy
|
|
(6 rows)
|
|
|
|
EXPLAIN (COSTS OFF) EXECUTE p1(2);
|
|
QUERY PLAN
|
|
--------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: (a <= 2)
|
|
-> Seq Scan on t2
|
|
Filter: (a <= 2)
|
|
-> Seq Scan on t3
|
|
Filter: (a <= 2)
|
|
(7 rows)
|
|
|
|
PREPARE p2(int) AS SELECT * FROM t1 WHERE a = $1;
|
|
EXECUTE p2(2);
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
2 | bcd
|
|
2 | yyy
|
|
(3 rows)
|
|
|
|
EXPLAIN (COSTS OFF) EXECUTE p2(2);
|
|
QUERY PLAN
|
|
-------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: (a = 2)
|
|
-> Seq Scan on t2
|
|
Filter: (a = 2)
|
|
-> Seq Scan on t3
|
|
Filter: (a = 2)
|
|
(7 rows)
|
|
|
|
-- also, case when privilege switch from superuser
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SET row_security TO ON;
|
|
EXECUTE p2(2);
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
2 | bcd
|
|
2 | yyy
|
|
(3 rows)
|
|
|
|
EXPLAIN (COSTS OFF) EXECUTE p2(2);
|
|
QUERY PLAN
|
|
---------------------------------------------
|
|
Append
|
|
-> Seq Scan on t1
|
|
Filter: ((a = 2) AND ((a % 2) = 0))
|
|
-> Seq Scan on t2
|
|
Filter: ((a = 2) AND ((a % 2) = 0))
|
|
-> Seq Scan on t3
|
|
Filter: ((a = 2) AND ((a % 2) = 0))
|
|
(7 rows)
|
|
|
|
--
|
|
-- UPDATE / DELETE and Row-level security
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
EXPLAIN (COSTS OFF) UPDATE t1 SET b = b || b WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------------
|
|
Update on t1 t1_3
|
|
-> Subquery Scan on t1
|
|
Filter: f_leak(t1.b)
|
|
-> Seq Scan on t1 t1_4
|
|
Filter: ((a % 2) = 0)
|
|
-> Subquery Scan on t1_1
|
|
Filter: f_leak(t1_1.b)
|
|
-> Seq Scan on t2
|
|
Filter: ((a % 2) = 0)
|
|
-> Subquery Scan on t1_2
|
|
Filter: f_leak(t1_2.b)
|
|
-> Seq Scan on t3
|
|
Filter: ((a % 2) = 0)
|
|
(13 rows)
|
|
|
|
UPDATE t1 SET b = b || b WHERE f_leak(b);
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ddd
|
|
NOTICE: f_leak => bcd
|
|
NOTICE: f_leak => def
|
|
NOTICE: f_leak => yyy
|
|
EXPLAIN (COSTS OFF) UPDATE only t1 SET b = b || '_updt' WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------------
|
|
Update on t1 t1_1
|
|
-> Subquery Scan on t1
|
|
Filter: f_leak(t1.b)
|
|
-> Seq Scan on t1 t1_2
|
|
Filter: ((a % 2) = 0)
|
|
(5 rows)
|
|
|
|
UPDATE only t1 SET b = b || '_updt' WHERE f_leak(b);
|
|
NOTICE: f_leak => bbbbbb
|
|
NOTICE: f_leak => dddddd
|
|
-- returning clause with system column
|
|
UPDATE only t1 SET b = b WHERE f_leak(b) RETURNING oid, *, t1;
|
|
NOTICE: f_leak => bbbbbb_updt
|
|
NOTICE: f_leak => dddddd_updt
|
|
oid | a | b | t1
|
|
-----+---+-------------+-----------------
|
|
102 | 2 | bbbbbb_updt | (2,bbbbbb_updt)
|
|
104 | 4 | dddddd_updt | (4,dddddd_updt)
|
|
(2 rows)
|
|
|
|
UPDATE t1 SET b = b WHERE f_leak(b) RETURNING *;
|
|
NOTICE: f_leak => bbbbbb_updt
|
|
NOTICE: f_leak => dddddd_updt
|
|
NOTICE: f_leak => bcdbcd
|
|
NOTICE: f_leak => defdef
|
|
NOTICE: f_leak => yyyyyy
|
|
a | b
|
|
---+-------------
|
|
2 | bbbbbb_updt
|
|
4 | dddddd_updt
|
|
2 | bcdbcd
|
|
4 | defdef
|
|
2 | yyyyyy
|
|
(5 rows)
|
|
|
|
UPDATE t1 SET b = b WHERE f_leak(b) RETURNING oid, *, t1;
|
|
NOTICE: f_leak => bbbbbb_updt
|
|
NOTICE: f_leak => dddddd_updt
|
|
NOTICE: f_leak => bcdbcd
|
|
NOTICE: f_leak => defdef
|
|
NOTICE: f_leak => yyyyyy
|
|
oid | a | b | t1
|
|
-----+---+-------------+-----------------
|
|
102 | 2 | bbbbbb_updt | (2,bbbbbb_updt)
|
|
104 | 4 | dddddd_updt | (4,dddddd_updt)
|
|
202 | 2 | bcdbcd | (2,bcdbcd)
|
|
204 | 4 | defdef | (4,defdef)
|
|
302 | 2 | yyyyyy | (2,yyyyyy)
|
|
(5 rows)
|
|
|
|
RESET SESSION AUTHORIZATION;
|
|
SET row_security TO OFF;
|
|
SELECT * FROM t1;
|
|
a | b
|
|
---+-------------
|
|
1 | aaa
|
|
3 | ccc
|
|
2 | bbbbbb_updt
|
|
4 | dddddd_updt
|
|
1 | abc
|
|
3 | cde
|
|
2 | bcdbcd
|
|
4 | defdef
|
|
1 | xxx
|
|
3 | zzz
|
|
2 | yyyyyy
|
|
(11 rows)
|
|
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SET row_security TO ON;
|
|
EXPLAIN (COSTS OFF) DELETE FROM only t1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------------
|
|
Delete on t1 t1_1
|
|
-> Subquery Scan on t1
|
|
Filter: f_leak(t1.b)
|
|
-> Seq Scan on t1 t1_2
|
|
Filter: ((a % 2) = 0)
|
|
(5 rows)
|
|
|
|
EXPLAIN (COSTS OFF) DELETE FROM t1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------------
|
|
Delete on t1 t1_3
|
|
-> Subquery Scan on t1
|
|
Filter: f_leak(t1.b)
|
|
-> Seq Scan on t1 t1_4
|
|
Filter: ((a % 2) = 0)
|
|
-> Subquery Scan on t1_1
|
|
Filter: f_leak(t1_1.b)
|
|
-> Seq Scan on t2
|
|
Filter: ((a % 2) = 0)
|
|
-> Subquery Scan on t1_2
|
|
Filter: f_leak(t1_2.b)
|
|
-> Seq Scan on t3
|
|
Filter: ((a % 2) = 0)
|
|
(13 rows)
|
|
|
|
DELETE FROM only t1 WHERE f_leak(b) RETURNING oid, *, t1;
|
|
NOTICE: f_leak => bbbbbb_updt
|
|
NOTICE: f_leak => dddddd_updt
|
|
oid | a | b | t1
|
|
-----+---+-------------+-----------------
|
|
102 | 2 | bbbbbb_updt | (2,bbbbbb_updt)
|
|
104 | 4 | dddddd_updt | (4,dddddd_updt)
|
|
(2 rows)
|
|
|
|
DELETE FROM t1 WHERE f_leak(b) RETURNING oid, *, t1;
|
|
NOTICE: f_leak => bcdbcd
|
|
NOTICE: f_leak => defdef
|
|
NOTICE: f_leak => yyyyyy
|
|
oid | a | b | t1
|
|
-----+---+--------+------------
|
|
202 | 2 | bcdbcd | (2,bcdbcd)
|
|
204 | 4 | defdef | (4,defdef)
|
|
302 | 2 | yyyyyy | (2,yyyyyy)
|
|
(3 rows)
|
|
|
|
--
|
|
-- ROLE/GROUP
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE TABLE z1 (a int, b text);
|
|
GRANT SELECT ON z1 TO rls_regress_group1, rls_regress_group2,
|
|
rls_regress_user1, rls_regress_user2;
|
|
INSERT INTO z1 VALUES
|
|
(1, 'aaa'),
|
|
(2, 'bbb'),
|
|
(3, 'ccc'),
|
|
(4, 'ddd');
|
|
CREATE POLICY p1 ON z1 TO rls_regress_group1 USING (a % 2 = 0);
|
|
CREATE POLICY p2 ON z1 TO rls_regress_group2 USING (a % 2 = 1);
|
|
ALTER TABLE z1 ENABLE ROW LEVEL SECURITY;
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM z1 WHERE f_leak(b);
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ddd
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
4 | ddd
|
|
(2 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM z1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Subquery Scan on z1
|
|
Filter: f_leak(z1.b)
|
|
-> Seq Scan on z1 z1_1
|
|
Filter: ((a % 2) = 0)
|
|
(4 rows)
|
|
|
|
SET ROLE rls_regress_group1;
|
|
SELECT * FROM z1 WHERE f_leak(b);
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ddd
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
4 | ddd
|
|
(2 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM z1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Subquery Scan on z1
|
|
Filter: f_leak(z1.b)
|
|
-> Seq Scan on z1 z1_1
|
|
Filter: ((a % 2) = 0)
|
|
(4 rows)
|
|
|
|
SET SESSION AUTHORIZATION rls_regress_user2;
|
|
SELECT * FROM z1 WHERE f_leak(b);
|
|
NOTICE: f_leak => aaa
|
|
NOTICE: f_leak => ccc
|
|
a | b
|
|
---+-----
|
|
1 | aaa
|
|
3 | ccc
|
|
(2 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM z1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Subquery Scan on z1
|
|
Filter: f_leak(z1.b)
|
|
-> Seq Scan on z1 z1_1
|
|
Filter: ((a % 2) = 1)
|
|
(4 rows)
|
|
|
|
SET ROLE rls_regress_group2;
|
|
SELECT * FROM z1 WHERE f_leak(b);
|
|
NOTICE: f_leak => aaa
|
|
NOTICE: f_leak => ccc
|
|
a | b
|
|
---+-----
|
|
1 | aaa
|
|
3 | ccc
|
|
(2 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM z1 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Subquery Scan on z1
|
|
Filter: f_leak(z1.b)
|
|
-> Seq Scan on z1 z1_1
|
|
Filter: ((a % 2) = 1)
|
|
(4 rows)
|
|
|
|
--
|
|
-- Views should follow policy for view owner.
|
|
--
|
|
-- View and Table owner are the same.
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE VIEW rls_view AS SELECT * FROM z1 WHERE f_leak(b);
|
|
GRANT SELECT ON rls_view TO rls_regress_user1;
|
|
-- Query as role that is not owner of view or table. Should return all records.
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM rls_view;
|
|
NOTICE: f_leak => aaa
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ccc
|
|
NOTICE: f_leak => ddd
|
|
a | b
|
|
---+-----
|
|
1 | aaa
|
|
2 | bbb
|
|
3 | ccc
|
|
4 | ddd
|
|
(4 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM rls_view;
|
|
QUERY PLAN
|
|
---------------------
|
|
Seq Scan on z1
|
|
Filter: f_leak(b)
|
|
(2 rows)
|
|
|
|
-- Query as view/table owner. Should return all records.
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
SELECT * FROM rls_view;
|
|
NOTICE: f_leak => aaa
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ccc
|
|
NOTICE: f_leak => ddd
|
|
a | b
|
|
---+-----
|
|
1 | aaa
|
|
2 | bbb
|
|
3 | ccc
|
|
4 | ddd
|
|
(4 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM rls_view;
|
|
QUERY PLAN
|
|
---------------------
|
|
Seq Scan on z1
|
|
Filter: f_leak(b)
|
|
(2 rows)
|
|
|
|
DROP VIEW rls_view;
|
|
-- View and Table owners are different.
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
CREATE VIEW rls_view AS SELECT * FROM z1 WHERE f_leak(b);
|
|
GRANT SELECT ON rls_view TO rls_regress_user0;
|
|
-- Query as role that is not owner of view but is owner of table.
|
|
-- Should return records based on view owner policies.
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
SELECT * FROM rls_view;
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ddd
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
4 | ddd
|
|
(2 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM rls_view;
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Subquery Scan on z1
|
|
Filter: f_leak(z1.b)
|
|
-> Seq Scan on z1 z1_1
|
|
Filter: ((a % 2) = 0)
|
|
(4 rows)
|
|
|
|
-- Query as role that is not owner of table but is owner of view.
|
|
-- Should return records based on view owner policies.
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM rls_view;
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ddd
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
4 | ddd
|
|
(2 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM rls_view;
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Subquery Scan on z1
|
|
Filter: f_leak(z1.b)
|
|
-> Seq Scan on z1 z1_1
|
|
Filter: ((a % 2) = 0)
|
|
(4 rows)
|
|
|
|
-- Query as role that is not the owner of the table or view without permissions.
|
|
SET SESSION AUTHORIZATION rls_regress_user2;
|
|
SELECT * FROM rls_view; --fail - permission denied.
|
|
ERROR: permission denied for relation rls_view
|
|
EXPLAIN (COSTS OFF) SELECT * FROM rls_view; --fail - permission denied.
|
|
ERROR: permission denied for relation rls_view
|
|
-- Query as role that is not the owner of the table or view with permissions.
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
GRANT SELECT ON rls_view TO rls_regress_user2;
|
|
SELECT * FROM rls_view;
|
|
NOTICE: f_leak => bbb
|
|
NOTICE: f_leak => ddd
|
|
a | b
|
|
---+-----
|
|
2 | bbb
|
|
4 | ddd
|
|
(2 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM rls_view;
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Subquery Scan on z1
|
|
Filter: f_leak(z1.b)
|
|
-> Seq Scan on z1 z1_1
|
|
Filter: ((a % 2) = 0)
|
|
(4 rows)
|
|
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
DROP VIEW rls_view;
|
|
--
|
|
-- Command specific
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE TABLE x1 (a int, b text, c text);
|
|
GRANT ALL ON x1 TO PUBLIC;
|
|
INSERT INTO x1 VALUES
|
|
(1, 'abc', 'rls_regress_user1'),
|
|
(2, 'bcd', 'rls_regress_user1'),
|
|
(3, 'cde', 'rls_regress_user2'),
|
|
(4, 'def', 'rls_regress_user2'),
|
|
(5, 'efg', 'rls_regress_user1'),
|
|
(6, 'fgh', 'rls_regress_user1'),
|
|
(7, 'fgh', 'rls_regress_user2'),
|
|
(8, 'fgh', 'rls_regress_user2');
|
|
CREATE POLICY p0 ON x1 FOR ALL USING (c = current_user);
|
|
CREATE POLICY p1 ON x1 FOR SELECT USING (a % 2 = 0);
|
|
CREATE POLICY p2 ON x1 FOR INSERT WITH CHECK (a % 2 = 1);
|
|
CREATE POLICY p3 ON x1 FOR UPDATE USING (a % 2 = 0);
|
|
CREATE POLICY p4 ON x1 FOR DELETE USING (a < 8);
|
|
ALTER TABLE x1 ENABLE ROW LEVEL SECURITY;
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM x1 WHERE f_leak(b) ORDER BY a ASC;
|
|
NOTICE: f_leak => abc
|
|
NOTICE: f_leak => bcd
|
|
NOTICE: f_leak => def
|
|
NOTICE: f_leak => efg
|
|
NOTICE: f_leak => fgh
|
|
NOTICE: f_leak => fgh
|
|
a | b | c
|
|
---+-----+-------------------
|
|
1 | abc | rls_regress_user1
|
|
2 | bcd | rls_regress_user1
|
|
4 | def | rls_regress_user2
|
|
5 | efg | rls_regress_user1
|
|
6 | fgh | rls_regress_user1
|
|
8 | fgh | rls_regress_user2
|
|
(6 rows)
|
|
|
|
UPDATE x1 SET b = b || '_updt' WHERE f_leak(b) RETURNING *;
|
|
NOTICE: f_leak => abc
|
|
NOTICE: f_leak => bcd
|
|
NOTICE: f_leak => def
|
|
NOTICE: f_leak => efg
|
|
NOTICE: f_leak => fgh
|
|
NOTICE: f_leak => fgh
|
|
a | b | c
|
|
---+----------+-------------------
|
|
1 | abc_updt | rls_regress_user1
|
|
2 | bcd_updt | rls_regress_user1
|
|
4 | def_updt | rls_regress_user2
|
|
5 | efg_updt | rls_regress_user1
|
|
6 | fgh_updt | rls_regress_user1
|
|
8 | fgh_updt | rls_regress_user2
|
|
(6 rows)
|
|
|
|
SET SESSION AUTHORIZATION rls_regress_user2;
|
|
SELECT * FROM x1 WHERE f_leak(b) ORDER BY a ASC;
|
|
NOTICE: f_leak => cde
|
|
NOTICE: f_leak => fgh
|
|
NOTICE: f_leak => bcd_updt
|
|
NOTICE: f_leak => def_updt
|
|
NOTICE: f_leak => fgh_updt
|
|
NOTICE: f_leak => fgh_updt
|
|
a | b | c
|
|
---+----------+-------------------
|
|
2 | bcd_updt | rls_regress_user1
|
|
3 | cde | rls_regress_user2
|
|
4 | def_updt | rls_regress_user2
|
|
6 | fgh_updt | rls_regress_user1
|
|
7 | fgh | rls_regress_user2
|
|
8 | fgh_updt | rls_regress_user2
|
|
(6 rows)
|
|
|
|
UPDATE x1 SET b = b || '_updt' WHERE f_leak(b) RETURNING *;
|
|
NOTICE: f_leak => cde
|
|
NOTICE: f_leak => fgh
|
|
NOTICE: f_leak => bcd_updt
|
|
NOTICE: f_leak => def_updt
|
|
NOTICE: f_leak => fgh_updt
|
|
NOTICE: f_leak => fgh_updt
|
|
a | b | c
|
|
---+---------------+-------------------
|
|
3 | cde_updt | rls_regress_user2
|
|
7 | fgh_updt | rls_regress_user2
|
|
2 | bcd_updt_updt | rls_regress_user1
|
|
4 | def_updt_updt | rls_regress_user2
|
|
6 | fgh_updt_updt | rls_regress_user1
|
|
8 | fgh_updt_updt | rls_regress_user2
|
|
(6 rows)
|
|
|
|
DELETE FROM x1 WHERE f_leak(b) RETURNING *;
|
|
NOTICE: f_leak => abc_updt
|
|
NOTICE: f_leak => efg_updt
|
|
NOTICE: f_leak => cde_updt
|
|
NOTICE: f_leak => fgh_updt
|
|
NOTICE: f_leak => bcd_updt_updt
|
|
NOTICE: f_leak => def_updt_updt
|
|
NOTICE: f_leak => fgh_updt_updt
|
|
NOTICE: f_leak => fgh_updt_updt
|
|
a | b | c
|
|
---+---------------+-------------------
|
|
1 | abc_updt | rls_regress_user1
|
|
5 | efg_updt | rls_regress_user1
|
|
3 | cde_updt | rls_regress_user2
|
|
7 | fgh_updt | rls_regress_user2
|
|
2 | bcd_updt_updt | rls_regress_user1
|
|
4 | def_updt_updt | rls_regress_user2
|
|
6 | fgh_updt_updt | rls_regress_user1
|
|
8 | fgh_updt_updt | rls_regress_user2
|
|
(8 rows)
|
|
|
|
--
|
|
-- Duplicate Policy Names
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE TABLE y1 (a int, b text);
|
|
CREATE TABLE y2 (a int, b text);
|
|
GRANT ALL ON y1, y2 TO rls_regress_user1;
|
|
CREATE POLICY p1 ON y1 FOR ALL USING (a % 2 = 0);
|
|
CREATE POLICY p2 ON y1 FOR SELECT USING (a > 2);
|
|
CREATE POLICY p1 ON y1 FOR SELECT USING (a % 2 = 1); --fail
|
|
ERROR: policy "p1" for relation "y1" already exists
|
|
CREATE POLICY p1 ON y2 FOR ALL USING (a % 2 = 0); --OK
|
|
ALTER TABLE y1 ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE y2 ENABLE ROW LEVEL SECURITY;
|
|
--
|
|
-- Expression structure with SBV
|
|
--
|
|
-- Create view as table owner. RLS should NOT be applied.
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE VIEW rls_sbv WITH (security_barrier) AS
|
|
SELECT * FROM y1 WHERE f_leak(b);
|
|
EXPLAIN (COSTS OFF) SELECT * FROM rls_sbv WHERE (a = 1);
|
|
QUERY PLAN
|
|
-----------------------------------
|
|
Seq Scan on y1
|
|
Filter: (f_leak(b) AND (a = 1))
|
|
(2 rows)
|
|
|
|
DROP VIEW rls_sbv;
|
|
-- Create view as role that does not own table. RLS should be applied.
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
CREATE VIEW rls_sbv WITH (security_barrier) AS
|
|
SELECT * FROM y1 WHERE f_leak(b);
|
|
EXPLAIN (COSTS OFF) SELECT * FROM rls_sbv WHERE (a = 1);
|
|
QUERY PLAN
|
|
----------------------------------------------------------
|
|
Subquery Scan on y1
|
|
Filter: f_leak(y1.b)
|
|
-> Seq Scan on y1 y1_1
|
|
Filter: ((a = 1) AND ((a > 2) OR ((a % 2) = 0)))
|
|
(4 rows)
|
|
|
|
DROP VIEW rls_sbv;
|
|
--
|
|
-- Expression structure
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
INSERT INTO y2 (SELECT x, md5(x::text) FROM generate_series(0,20) x);
|
|
CREATE POLICY p2 ON y2 USING (a % 3 = 0);
|
|
CREATE POLICY p3 ON y2 USING (a % 4 = 0);
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM y2 WHERE f_leak(b);
|
|
NOTICE: f_leak => cfcd208495d565ef66e7dff9f98764da
|
|
NOTICE: f_leak => c81e728d9d4c2f636f067f89cc14862c
|
|
NOTICE: f_leak => eccbc87e4b5ce2fe28308fd9f2a7baf3
|
|
NOTICE: f_leak => a87ff679a2f3e71d9181a67b7542122c
|
|
NOTICE: f_leak => 1679091c5a880faf6fb5e6087eb1b2dc
|
|
NOTICE: f_leak => c9f0f895fb98ab9159f51fd0297e236d
|
|
NOTICE: f_leak => 45c48cce2e2d7fbdea1afc51c7c6ad26
|
|
NOTICE: f_leak => d3d9446802a44259755d38e6d163e820
|
|
NOTICE: f_leak => c20ad4d76fe97759aa27a0c99bff6710
|
|
NOTICE: f_leak => aab3238922bcc25a6f606eb525ffdc56
|
|
NOTICE: f_leak => 9bf31c7ff062936a96d3c8bd1f8f2ff3
|
|
NOTICE: f_leak => c74d97b01eae257e44aa9d5bade97baf
|
|
NOTICE: f_leak => 6f4922f45568161a8cdf4ad2299f6d23
|
|
NOTICE: f_leak => 98f13708210194c475687be6106a3b84
|
|
a | b
|
|
----+----------------------------------
|
|
0 | cfcd208495d565ef66e7dff9f98764da
|
|
2 | c81e728d9d4c2f636f067f89cc14862c
|
|
3 | eccbc87e4b5ce2fe28308fd9f2a7baf3
|
|
4 | a87ff679a2f3e71d9181a67b7542122c
|
|
6 | 1679091c5a880faf6fb5e6087eb1b2dc
|
|
8 | c9f0f895fb98ab9159f51fd0297e236d
|
|
9 | 45c48cce2e2d7fbdea1afc51c7c6ad26
|
|
10 | d3d9446802a44259755d38e6d163e820
|
|
12 | c20ad4d76fe97759aa27a0c99bff6710
|
|
14 | aab3238922bcc25a6f606eb525ffdc56
|
|
15 | 9bf31c7ff062936a96d3c8bd1f8f2ff3
|
|
16 | c74d97b01eae257e44aa9d5bade97baf
|
|
18 | 6f4922f45568161a8cdf4ad2299f6d23
|
|
20 | 98f13708210194c475687be6106a3b84
|
|
(14 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM y2 WHERE f_leak(b);
|
|
QUERY PLAN
|
|
-------------------------------------------------------------------
|
|
Subquery Scan on y2
|
|
Filter: f_leak(y2.b)
|
|
-> Seq Scan on y2 y2_1
|
|
Filter: (((a % 4) = 0) OR ((a % 3) = 0) OR ((a % 2) = 0))
|
|
(4 rows)
|
|
|
|
--
|
|
-- Plancache invalidate on user change.
|
|
--
|
|
RESET SESSION AUTHORIZATION;
|
|
DROP TABLE t1 CASCADE;
|
|
NOTICE: drop cascades to 2 other objects
|
|
DETAIL: drop cascades to table t2
|
|
drop cascades to table t3
|
|
CREATE TABLE t1 (a integer);
|
|
GRANT SELECT ON t1 TO rls_regress_user1, rls_regress_user2;
|
|
CREATE POLICY p1 ON t1 TO rls_regress_user1 USING ((a % 2) = 0);
|
|
CREATE POLICY p2 ON t1 TO rls_regress_user2 USING ((a % 4) = 0);
|
|
ALTER TABLE t1 ENABLE ROW LEVEL SECURITY;
|
|
SET ROLE rls_regress_user1;
|
|
PREPARE role_inval AS SELECT * FROM t1;
|
|
EXPLAIN (COSTS OFF) EXECUTE role_inval;
|
|
QUERY PLAN
|
|
-------------------------
|
|
Seq Scan on t1
|
|
Filter: ((a % 2) = 0)
|
|
(2 rows)
|
|
|
|
SET ROLE rls_regress_user2;
|
|
EXPLAIN (COSTS OFF) EXECUTE role_inval;
|
|
QUERY PLAN
|
|
-------------------------
|
|
Seq Scan on t1
|
|
Filter: ((a % 4) = 0)
|
|
(2 rows)
|
|
|
|
--
|
|
-- CTE and RLS
|
|
--
|
|
RESET SESSION AUTHORIZATION;
|
|
DROP TABLE t1 CASCADE;
|
|
CREATE TABLE t1 (a integer, b text);
|
|
CREATE POLICY p1 ON t1 USING (a % 2 = 0);
|
|
ALTER TABLE t1 ENABLE ROW LEVEL SECURITY;
|
|
GRANT ALL ON t1 TO rls_regress_user1;
|
|
INSERT INTO t1 (SELECT x, md5(x::text) FROM generate_series(0,20) x);
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
WITH cte1 AS (SELECT * FROM t1 WHERE f_leak(b)) SELECT * FROM cte1;
|
|
NOTICE: f_leak => cfcd208495d565ef66e7dff9f98764da
|
|
NOTICE: f_leak => c81e728d9d4c2f636f067f89cc14862c
|
|
NOTICE: f_leak => a87ff679a2f3e71d9181a67b7542122c
|
|
NOTICE: f_leak => 1679091c5a880faf6fb5e6087eb1b2dc
|
|
NOTICE: f_leak => c9f0f895fb98ab9159f51fd0297e236d
|
|
NOTICE: f_leak => d3d9446802a44259755d38e6d163e820
|
|
NOTICE: f_leak => c20ad4d76fe97759aa27a0c99bff6710
|
|
NOTICE: f_leak => aab3238922bcc25a6f606eb525ffdc56
|
|
NOTICE: f_leak => c74d97b01eae257e44aa9d5bade97baf
|
|
NOTICE: f_leak => 6f4922f45568161a8cdf4ad2299f6d23
|
|
NOTICE: f_leak => 98f13708210194c475687be6106a3b84
|
|
a | b
|
|
----+----------------------------------
|
|
0 | cfcd208495d565ef66e7dff9f98764da
|
|
2 | c81e728d9d4c2f636f067f89cc14862c
|
|
4 | a87ff679a2f3e71d9181a67b7542122c
|
|
6 | 1679091c5a880faf6fb5e6087eb1b2dc
|
|
8 | c9f0f895fb98ab9159f51fd0297e236d
|
|
10 | d3d9446802a44259755d38e6d163e820
|
|
12 | c20ad4d76fe97759aa27a0c99bff6710
|
|
14 | aab3238922bcc25a6f606eb525ffdc56
|
|
16 | c74d97b01eae257e44aa9d5bade97baf
|
|
18 | 6f4922f45568161a8cdf4ad2299f6d23
|
|
20 | 98f13708210194c475687be6106a3b84
|
|
(11 rows)
|
|
|
|
EXPLAIN (COSTS OFF) WITH cte1 AS (SELECT * FROM t1 WHERE f_leak(b)) SELECT * FROM cte1;
|
|
QUERY PLAN
|
|
---------------------------------------
|
|
CTE Scan on cte1
|
|
CTE cte1
|
|
-> Subquery Scan on t1
|
|
Filter: f_leak(t1.b)
|
|
-> Seq Scan on t1 t1_1
|
|
Filter: ((a % 2) = 0)
|
|
(6 rows)
|
|
|
|
WITH cte1 AS (UPDATE t1 SET a = a + 1 RETURNING *) SELECT * FROM cte1; --fail
|
|
ERROR: new row violates WITH CHECK OPTION for "t1"
|
|
DETAIL: Failing row contains (1, cfcd208495d565ef66e7dff9f98764da).
|
|
WITH cte1 AS (UPDATE t1 SET a = a RETURNING *) SELECT * FROM cte1; --ok
|
|
a | b
|
|
----+----------------------------------
|
|
0 | cfcd208495d565ef66e7dff9f98764da
|
|
2 | c81e728d9d4c2f636f067f89cc14862c
|
|
4 | a87ff679a2f3e71d9181a67b7542122c
|
|
6 | 1679091c5a880faf6fb5e6087eb1b2dc
|
|
8 | c9f0f895fb98ab9159f51fd0297e236d
|
|
10 | d3d9446802a44259755d38e6d163e820
|
|
12 | c20ad4d76fe97759aa27a0c99bff6710
|
|
14 | aab3238922bcc25a6f606eb525ffdc56
|
|
16 | c74d97b01eae257e44aa9d5bade97baf
|
|
18 | 6f4922f45568161a8cdf4ad2299f6d23
|
|
20 | 98f13708210194c475687be6106a3b84
|
|
(11 rows)
|
|
|
|
WITH cte1 AS (INSERT INTO t1 VALUES (21, 'Fail') RETURNING *) SELECT * FROM cte1; --fail
|
|
ERROR: new row violates WITH CHECK OPTION for "t1"
|
|
DETAIL: Failing row contains (21, Fail).
|
|
WITH cte1 AS (INSERT INTO t1 VALUES (20, 'Success') RETURNING *) SELECT * FROM cte1; --ok
|
|
a | b
|
|
----+---------
|
|
20 | Success
|
|
(1 row)
|
|
|
|
--
|
|
-- Rename Policy
|
|
--
|
|
RESET SESSION AUTHORIZATION;
|
|
ALTER POLICY p1 ON t1 RENAME TO p1; --fail
|
|
ERROR: row-policy "p1" for table "t1" already exists
|
|
SELECT rsecpolname, relname
|
|
FROM pg_rowsecurity rs
|
|
JOIN pg_class pc ON (pc.oid = rs.rsecrelid)
|
|
WHERE relname = 't1';
|
|
rsecpolname | relname
|
|
-------------+---------
|
|
p1 | t1
|
|
(1 row)
|
|
|
|
ALTER POLICY p1 ON t1 RENAME TO p2; --ok
|
|
SELECT rsecpolname, relname
|
|
FROM pg_rowsecurity rs
|
|
JOIN pg_class pc ON (pc.oid = rs.rsecrelid)
|
|
WHERE relname = 't1';
|
|
rsecpolname | relname
|
|
-------------+---------
|
|
p2 | t1
|
|
(1 row)
|
|
|
|
--
|
|
-- Check INSERT SELECT
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
CREATE TABLE t2 (a integer, b text);
|
|
INSERT INTO t2 (SELECT * FROM t1);
|
|
EXPLAIN (COSTS OFF) INSERT INTO t2 (SELECT * FROM t1);
|
|
QUERY PLAN
|
|
-------------------------------
|
|
Insert on t2
|
|
-> Seq Scan on t1
|
|
Filter: ((a % 2) = 0)
|
|
(3 rows)
|
|
|
|
SELECT * FROM t2;
|
|
a | b
|
|
----+----------------------------------
|
|
0 | cfcd208495d565ef66e7dff9f98764da
|
|
2 | c81e728d9d4c2f636f067f89cc14862c
|
|
4 | a87ff679a2f3e71d9181a67b7542122c
|
|
6 | 1679091c5a880faf6fb5e6087eb1b2dc
|
|
8 | c9f0f895fb98ab9159f51fd0297e236d
|
|
10 | d3d9446802a44259755d38e6d163e820
|
|
12 | c20ad4d76fe97759aa27a0c99bff6710
|
|
14 | aab3238922bcc25a6f606eb525ffdc56
|
|
16 | c74d97b01eae257e44aa9d5bade97baf
|
|
18 | 6f4922f45568161a8cdf4ad2299f6d23
|
|
20 | 98f13708210194c475687be6106a3b84
|
|
20 | Success
|
|
(12 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t2;
|
|
QUERY PLAN
|
|
----------------
|
|
Seq Scan on t2
|
|
(1 row)
|
|
|
|
CREATE TABLE t3 AS SELECT * FROM t1;
|
|
SELECT * FROM t3;
|
|
a | b
|
|
----+----------------------------------
|
|
0 | cfcd208495d565ef66e7dff9f98764da
|
|
2 | c81e728d9d4c2f636f067f89cc14862c
|
|
4 | a87ff679a2f3e71d9181a67b7542122c
|
|
6 | 1679091c5a880faf6fb5e6087eb1b2dc
|
|
8 | c9f0f895fb98ab9159f51fd0297e236d
|
|
10 | d3d9446802a44259755d38e6d163e820
|
|
12 | c20ad4d76fe97759aa27a0c99bff6710
|
|
14 | aab3238922bcc25a6f606eb525ffdc56
|
|
16 | c74d97b01eae257e44aa9d5bade97baf
|
|
18 | 6f4922f45568161a8cdf4ad2299f6d23
|
|
20 | 98f13708210194c475687be6106a3b84
|
|
20 | Success
|
|
(12 rows)
|
|
|
|
SELECT * INTO t4 FROM t1;
|
|
SELECT * FROM t4;
|
|
a | b
|
|
----+----------------------------------
|
|
0 | cfcd208495d565ef66e7dff9f98764da
|
|
2 | c81e728d9d4c2f636f067f89cc14862c
|
|
4 | a87ff679a2f3e71d9181a67b7542122c
|
|
6 | 1679091c5a880faf6fb5e6087eb1b2dc
|
|
8 | c9f0f895fb98ab9159f51fd0297e236d
|
|
10 | d3d9446802a44259755d38e6d163e820
|
|
12 | c20ad4d76fe97759aa27a0c99bff6710
|
|
14 | aab3238922bcc25a6f606eb525ffdc56
|
|
16 | c74d97b01eae257e44aa9d5bade97baf
|
|
18 | 6f4922f45568161a8cdf4ad2299f6d23
|
|
20 | 98f13708210194c475687be6106a3b84
|
|
20 | Success
|
|
(12 rows)
|
|
|
|
--
|
|
-- RLS with JOIN
|
|
--
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE TABLE blog (id integer, author text, post text);
|
|
CREATE TABLE comment (blog_id integer, message text);
|
|
GRANT ALL ON blog, comment TO rls_regress_user1;
|
|
CREATE POLICY blog_1 ON blog USING (id % 2 = 0);
|
|
ALTER TABLE blog ENABLE ROW LEVEL SECURITY;
|
|
INSERT INTO blog VALUES
|
|
(1, 'alice', 'blog #1'),
|
|
(2, 'bob', 'blog #1'),
|
|
(3, 'alice', 'blog #2'),
|
|
(4, 'alice', 'blog #3'),
|
|
(5, 'john', 'blog #1');
|
|
INSERT INTO comment VALUES
|
|
(1, 'cool blog'),
|
|
(1, 'fun blog'),
|
|
(3, 'crazy blog'),
|
|
(5, 'what?'),
|
|
(4, 'insane!'),
|
|
(2, 'who did it?');
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
-- Check RLS JOIN with Non-RLS.
|
|
SELECT id, author, message FROM blog JOIN comment ON id = blog_id;
|
|
id | author | message
|
|
----+--------+-------------
|
|
4 | alice | insane!
|
|
2 | bob | who did it?
|
|
(2 rows)
|
|
|
|
-- Check Non-RLS JOIN with RLS.
|
|
SELECT id, author, message FROM comment JOIN blog ON id = blog_id;
|
|
id | author | message
|
|
----+--------+-------------
|
|
4 | alice | insane!
|
|
2 | bob | who did it?
|
|
(2 rows)
|
|
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
CREATE POLICY comment_1 ON comment USING (blog_id < 4);
|
|
ALTER TABLE comment ENABLE ROW LEVEL SECURITY;
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
-- Check RLS JOIN RLS
|
|
SELECT id, author, message FROM blog JOIN comment ON id = blog_id;
|
|
id | author | message
|
|
----+--------+-------------
|
|
2 | bob | who did it?
|
|
(1 row)
|
|
|
|
SELECT id, author, message FROM comment JOIN blog ON id = blog_id;
|
|
id | author | message
|
|
----+--------+-------------
|
|
2 | bob | who did it?
|
|
(1 row)
|
|
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
DROP TABLE blog, comment;
|
|
--
|
|
-- Default Deny Policy
|
|
--
|
|
RESET SESSION AUTHORIZATION;
|
|
DROP POLICY p2 ON t1;
|
|
ALTER TABLE t1 OWNER TO rls_regress_user0;
|
|
-- Check that default deny does not apply to superuser.
|
|
RESET SESSION AUTHORIZATION;
|
|
SELECT * FROM t1;
|
|
a | b
|
|
----+----------------------------------
|
|
1 | c4ca4238a0b923820dcc509a6f75849b
|
|
3 | eccbc87e4b5ce2fe28308fd9f2a7baf3
|
|
5 | e4da3b7fbbce2345d7772b0674a318d5
|
|
7 | 8f14e45fceea167a5a36dedd4bea2543
|
|
9 | 45c48cce2e2d7fbdea1afc51c7c6ad26
|
|
11 | 6512bd43d9caa6e02c990b0a82652dca
|
|
13 | c51ce410c124a10e0db5e4b97fc2af39
|
|
15 | 9bf31c7ff062936a96d3c8bd1f8f2ff3
|
|
17 | 70efdf2ec9b086079795c442636b55fb
|
|
19 | 1f0e3dad99908345f7439f8ffabdffc4
|
|
0 | cfcd208495d565ef66e7dff9f98764da
|
|
2 | c81e728d9d4c2f636f067f89cc14862c
|
|
4 | a87ff679a2f3e71d9181a67b7542122c
|
|
6 | 1679091c5a880faf6fb5e6087eb1b2dc
|
|
8 | c9f0f895fb98ab9159f51fd0297e236d
|
|
10 | d3d9446802a44259755d38e6d163e820
|
|
12 | c20ad4d76fe97759aa27a0c99bff6710
|
|
14 | aab3238922bcc25a6f606eb525ffdc56
|
|
16 | c74d97b01eae257e44aa9d5bade97baf
|
|
18 | 6f4922f45568161a8cdf4ad2299f6d23
|
|
20 | 98f13708210194c475687be6106a3b84
|
|
20 | Success
|
|
(22 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1;
|
|
QUERY PLAN
|
|
----------------
|
|
Seq Scan on t1
|
|
(1 row)
|
|
|
|
-- Check that default deny does not apply to table owner.
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
SELECT * FROM t1;
|
|
a | b
|
|
----+----------------------------------
|
|
1 | c4ca4238a0b923820dcc509a6f75849b
|
|
3 | eccbc87e4b5ce2fe28308fd9f2a7baf3
|
|
5 | e4da3b7fbbce2345d7772b0674a318d5
|
|
7 | 8f14e45fceea167a5a36dedd4bea2543
|
|
9 | 45c48cce2e2d7fbdea1afc51c7c6ad26
|
|
11 | 6512bd43d9caa6e02c990b0a82652dca
|
|
13 | c51ce410c124a10e0db5e4b97fc2af39
|
|
15 | 9bf31c7ff062936a96d3c8bd1f8f2ff3
|
|
17 | 70efdf2ec9b086079795c442636b55fb
|
|
19 | 1f0e3dad99908345f7439f8ffabdffc4
|
|
0 | cfcd208495d565ef66e7dff9f98764da
|
|
2 | c81e728d9d4c2f636f067f89cc14862c
|
|
4 | a87ff679a2f3e71d9181a67b7542122c
|
|
6 | 1679091c5a880faf6fb5e6087eb1b2dc
|
|
8 | c9f0f895fb98ab9159f51fd0297e236d
|
|
10 | d3d9446802a44259755d38e6d163e820
|
|
12 | c20ad4d76fe97759aa27a0c99bff6710
|
|
14 | aab3238922bcc25a6f606eb525ffdc56
|
|
16 | c74d97b01eae257e44aa9d5bade97baf
|
|
18 | 6f4922f45568161a8cdf4ad2299f6d23
|
|
20 | 98f13708210194c475687be6106a3b84
|
|
20 | Success
|
|
(22 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1;
|
|
QUERY PLAN
|
|
----------------
|
|
Seq Scan on t1
|
|
(1 row)
|
|
|
|
-- Check that default deny does apply to superuser when RLS force.
|
|
SET row_security TO FORCE;
|
|
RESET SESSION AUTHORIZATION;
|
|
SELECT * FROM t1;
|
|
a | b
|
|
---+---
|
|
(0 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1;
|
|
QUERY PLAN
|
|
--------------------------
|
|
Result
|
|
One-Time Filter: false
|
|
(2 rows)
|
|
|
|
-- Check that default deny does apply to table owner when RLS force.
|
|
SET SESSION AUTHORIZATION rls_regress_user0;
|
|
SELECT * FROM t1;
|
|
a | b
|
|
---+---
|
|
(0 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1;
|
|
QUERY PLAN
|
|
--------------------------
|
|
Result
|
|
One-Time Filter: false
|
|
(2 rows)
|
|
|
|
-- Check that default deny applies to non-owner/non-superuser when RLS on.
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SET row_security TO ON;
|
|
SELECT * FROM t1;
|
|
a | b
|
|
---+---
|
|
(0 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1;
|
|
QUERY PLAN
|
|
--------------------------
|
|
Result
|
|
One-Time Filter: false
|
|
(2 rows)
|
|
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SELECT * FROM t1;
|
|
a | b
|
|
---+---
|
|
(0 rows)
|
|
|
|
EXPLAIN (COSTS OFF) SELECT * FROM t1;
|
|
QUERY PLAN
|
|
--------------------------
|
|
Result
|
|
One-Time Filter: false
|
|
(2 rows)
|
|
|
|
--
|
|
-- Event Triggers
|
|
--
|
|
RESET SESSION AUTHORIZATION;
|
|
CREATE TABLE event_trigger_test (a integer, b text);
|
|
CREATE OR REPLACE FUNCTION start_command()
|
|
RETURNS event_trigger AS $$
|
|
BEGIN
|
|
RAISE NOTICE '% - ddl_command_start', tg_tag;
|
|
END;
|
|
$$ LANGUAGE plpgsql;
|
|
CREATE OR REPLACE FUNCTION end_command()
|
|
RETURNS event_trigger AS $$
|
|
BEGIN
|
|
RAISE NOTICE '% - ddl_command_end', tg_tag;
|
|
END;
|
|
$$ LANGUAGE plpgsql;
|
|
CREATE OR REPLACE FUNCTION drop_sql_command()
|
|
RETURNS event_trigger AS $$
|
|
BEGIN
|
|
RAISE NOTICE '% - sql_drop', tg_tag;
|
|
END;
|
|
$$ LANGUAGE plpgsql;
|
|
CREATE EVENT TRIGGER start_rls_command ON ddl_command_start
|
|
WHEN TAG IN ('CREATE POLICY', 'ALTER POLICY', 'DROP POLICY') EXECUTE PROCEDURE start_command();
|
|
CREATE EVENT TRIGGER end_rls_command ON ddl_command_end
|
|
WHEN TAG IN ('CREATE POLICY', 'ALTER POLICY', 'DROP POLICY') EXECUTE PROCEDURE end_command();
|
|
CREATE EVENT TRIGGER sql_drop_command ON sql_drop
|
|
WHEN TAG IN ('DROP POLICY') EXECUTE PROCEDURE drop_sql_command();
|
|
CREATE POLICY p1 ON event_trigger_test USING (FALSE);
|
|
NOTICE: CREATE POLICY - ddl_command_start
|
|
NOTICE: CREATE POLICY - ddl_command_end
|
|
ALTER POLICY p1 ON event_trigger_test USING (TRUE);
|
|
NOTICE: ALTER POLICY - ddl_command_start
|
|
NOTICE: ALTER POLICY - ddl_command_end
|
|
ALTER POLICY p1 ON event_trigger_test RENAME TO p2;
|
|
NOTICE: ALTER POLICY - ddl_command_start
|
|
NOTICE: ALTER POLICY - ddl_command_end
|
|
DROP POLICY p2 ON event_trigger_test;
|
|
NOTICE: DROP POLICY - ddl_command_start
|
|
NOTICE: DROP POLICY - sql_drop
|
|
NOTICE: DROP POLICY - ddl_command_end
|
|
DROP EVENT TRIGGER start_rls_command;
|
|
DROP EVENT TRIGGER end_rls_command;
|
|
DROP EVENT TRIGGER sql_drop_command;
|
|
--
|
|
-- COPY TO/FROM
|
|
--
|
|
RESET SESSION AUTHORIZATION;
|
|
DROP TABLE copy_t CASCADE;
|
|
ERROR: table "copy_t" does not exist
|
|
CREATE TABLE copy_t (a integer, b text);
|
|
CREATE POLICY p1 ON copy_t USING (a % 2 = 0);
|
|
ALTER TABLE copy_t ENABLE ROW LEVEL SECURITY;
|
|
GRANT ALL ON copy_t TO rls_regress_user1, rls_regress_exempt_user;
|
|
INSERT INTO copy_t (SELECT x, md5(x::text) FROM generate_series(0,10) x);
|
|
-- Check COPY TO as Superuser/owner.
|
|
RESET SESSION AUTHORIZATION;
|
|
SET row_security TO OFF;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ',';
|
|
0,cfcd208495d565ef66e7dff9f98764da
|
|
1,c4ca4238a0b923820dcc509a6f75849b
|
|
2,c81e728d9d4c2f636f067f89cc14862c
|
|
3,eccbc87e4b5ce2fe28308fd9f2a7baf3
|
|
4,a87ff679a2f3e71d9181a67b7542122c
|
|
5,e4da3b7fbbce2345d7772b0674a318d5
|
|
6,1679091c5a880faf6fb5e6087eb1b2dc
|
|
7,8f14e45fceea167a5a36dedd4bea2543
|
|
8,c9f0f895fb98ab9159f51fd0297e236d
|
|
9,45c48cce2e2d7fbdea1afc51c7c6ad26
|
|
10,d3d9446802a44259755d38e6d163e820
|
|
SET row_security TO ON;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ',';
|
|
0,cfcd208495d565ef66e7dff9f98764da
|
|
1,c4ca4238a0b923820dcc509a6f75849b
|
|
2,c81e728d9d4c2f636f067f89cc14862c
|
|
3,eccbc87e4b5ce2fe28308fd9f2a7baf3
|
|
4,a87ff679a2f3e71d9181a67b7542122c
|
|
5,e4da3b7fbbce2345d7772b0674a318d5
|
|
6,1679091c5a880faf6fb5e6087eb1b2dc
|
|
7,8f14e45fceea167a5a36dedd4bea2543
|
|
8,c9f0f895fb98ab9159f51fd0297e236d
|
|
9,45c48cce2e2d7fbdea1afc51c7c6ad26
|
|
10,d3d9446802a44259755d38e6d163e820
|
|
SET row_security TO FORCE;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ',';
|
|
0,cfcd208495d565ef66e7dff9f98764da
|
|
2,c81e728d9d4c2f636f067f89cc14862c
|
|
4,a87ff679a2f3e71d9181a67b7542122c
|
|
6,1679091c5a880faf6fb5e6087eb1b2dc
|
|
8,c9f0f895fb98ab9159f51fd0297e236d
|
|
10,d3d9446802a44259755d38e6d163e820
|
|
-- Check COPY TO as user with permissions.
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SET row_security TO OFF;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --fail - insufficient to bypass rls
|
|
ERROR: insufficient privilege to bypass row security.
|
|
SET row_security TO ON;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --ok
|
|
0,cfcd208495d565ef66e7dff9f98764da
|
|
2,c81e728d9d4c2f636f067f89cc14862c
|
|
4,a87ff679a2f3e71d9181a67b7542122c
|
|
6,1679091c5a880faf6fb5e6087eb1b2dc
|
|
8,c9f0f895fb98ab9159f51fd0297e236d
|
|
10,d3d9446802a44259755d38e6d163e820
|
|
SET row_security TO FORCE;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --ok
|
|
0,cfcd208495d565ef66e7dff9f98764da
|
|
2,c81e728d9d4c2f636f067f89cc14862c
|
|
4,a87ff679a2f3e71d9181a67b7542122c
|
|
6,1679091c5a880faf6fb5e6087eb1b2dc
|
|
8,c9f0f895fb98ab9159f51fd0297e236d
|
|
10,d3d9446802a44259755d38e6d163e820
|
|
-- Check COPY TO as user with permissions and BYPASSRLS
|
|
SET SESSION AUTHORIZATION rls_regress_exempt_user;
|
|
SET row_security TO OFF;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --ok
|
|
0,cfcd208495d565ef66e7dff9f98764da
|
|
1,c4ca4238a0b923820dcc509a6f75849b
|
|
2,c81e728d9d4c2f636f067f89cc14862c
|
|
3,eccbc87e4b5ce2fe28308fd9f2a7baf3
|
|
4,a87ff679a2f3e71d9181a67b7542122c
|
|
5,e4da3b7fbbce2345d7772b0674a318d5
|
|
6,1679091c5a880faf6fb5e6087eb1b2dc
|
|
7,8f14e45fceea167a5a36dedd4bea2543
|
|
8,c9f0f895fb98ab9159f51fd0297e236d
|
|
9,45c48cce2e2d7fbdea1afc51c7c6ad26
|
|
10,d3d9446802a44259755d38e6d163e820
|
|
SET row_security TO ON;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --ok
|
|
0,cfcd208495d565ef66e7dff9f98764da
|
|
2,c81e728d9d4c2f636f067f89cc14862c
|
|
4,a87ff679a2f3e71d9181a67b7542122c
|
|
6,1679091c5a880faf6fb5e6087eb1b2dc
|
|
8,c9f0f895fb98ab9159f51fd0297e236d
|
|
10,d3d9446802a44259755d38e6d163e820
|
|
SET row_security TO FORCE;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --ok
|
|
0,cfcd208495d565ef66e7dff9f98764da
|
|
2,c81e728d9d4c2f636f067f89cc14862c
|
|
4,a87ff679a2f3e71d9181a67b7542122c
|
|
6,1679091c5a880faf6fb5e6087eb1b2dc
|
|
8,c9f0f895fb98ab9159f51fd0297e236d
|
|
10,d3d9446802a44259755d38e6d163e820
|
|
-- Check COPY TO as user without permissions.SET row_security TO OFF;
|
|
SET SESSION AUTHORIZATION rls_regress_user2;
|
|
SET row_security TO OFF;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --fail - insufficient to bypass rls
|
|
ERROR: insufficient privilege to bypass row security.
|
|
SET row_security TO ON;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --fail - permission denied
|
|
ERROR: permission denied for relation copy_t
|
|
SET row_security TO FORCE;
|
|
COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --fail - permission denied
|
|
ERROR: permission denied for relation copy_t
|
|
-- Check COPY FROM as Superuser/owner.
|
|
RESET SESSION AUTHORIZATION;
|
|
SET row_security TO OFF;
|
|
COPY copy_t FROM STDIN; --ok
|
|
SET row_security TO ON;
|
|
COPY copy_t FROM STDIN; --ok
|
|
SET row_security TO FORCE;
|
|
COPY copy_t FROM STDIN; --fail - COPY FROM not supported by RLS.
|
|
ERROR: COPY FROM not supported with row security.
|
|
HINT: Use direct INSERT statements instead.
|
|
-- Check COPY FROM as user with permissions.
|
|
SET SESSION AUTHORIZATION rls_regress_user1;
|
|
SET row_security TO OFF;
|
|
COPY copy_t FROM STDIN; --fail - insufficient privilege to bypass rls.
|
|
ERROR: insufficient privilege to bypass row security.
|
|
SET row_security TO ON;
|
|
COPY copy_t FROM STDIN; --fail - COPY FROM not supported by RLS.
|
|
ERROR: COPY FROM not supported with row security.
|
|
HINT: Use direct INSERT statements instead.
|
|
SET row_security TO FORCE;
|
|
COPY copy_t FROM STDIN; --fail - COPY FROM not supported by RLS.
|
|
ERROR: COPY FROM not supported with row security.
|
|
HINT: Use direct INSERT statements instead.
|
|
-- Check COPY TO as user with permissions and BYPASSRLS
|
|
SET SESSION AUTHORIZATION rls_regress_exempt_user;
|
|
SET row_security TO OFF;
|
|
COPY copy_t FROM STDIN; --ok
|
|
SET row_security TO ON;
|
|
COPY copy_t FROM STDIN; --fail - COPY FROM not supported by RLS.
|
|
ERROR: COPY FROM not supported with row security.
|
|
HINT: Use direct INSERT statements instead.
|
|
SET row_security TO FORCE;
|
|
COPY copy_t FROM STDIN; --fail - COPY FROM not supported by RLS.
|
|
ERROR: COPY FROM not supported with row security.
|
|
HINT: Use direct INSERT statements instead.
|
|
-- Check COPY FROM as user without permissions.
|
|
SET SESSION AUTHORIZATION rls_regress_user2;
|
|
SET row_security TO OFF;
|
|
COPY copy_t FROM STDIN; --fail - permission denied.
|
|
ERROR: permission denied for relation copy_t
|
|
SET row_security TO ON;
|
|
COPY copy_t FROM STDIN; --fail - permission denied.
|
|
ERROR: permission denied for relation copy_t
|
|
SET row_security TO FORCE;
|
|
COPY copy_t FROM STDIN; --fail - permission denied.
|
|
ERROR: permission denied for relation copy_t
|
|
RESET SESSION AUTHORIZATION;
|
|
DROP TABLE copy_t;
|
|
--
|
|
-- Clean up objects
|
|
--
|
|
RESET SESSION AUTHORIZATION;
|
|
DROP SCHEMA rls_regress_schema CASCADE;
|
|
NOTICE: drop cascades to 24 other objects
|
|
DETAIL: drop cascades to function f_leak(text)
|
|
drop cascades to table uaccount
|
|
drop cascades to table category
|
|
drop cascades to table document
|
|
drop cascades to table dependent
|
|
drop cascades to table rec1
|
|
drop cascades to table rec2
|
|
drop cascades to view rec1v
|
|
drop cascades to view rec2v
|
|
drop cascades to table s1
|
|
drop cascades to table s2
|
|
drop cascades to view v2
|
|
drop cascades to table z1
|
|
drop cascades to table x1
|
|
drop cascades to table y1
|
|
drop cascades to table y2
|
|
drop cascades to table t1
|
|
drop cascades to table t2
|
|
drop cascades to table t3
|
|
drop cascades to table t4
|
|
drop cascades to table event_trigger_test
|
|
drop cascades to function start_command()
|
|
drop cascades to function end_command()
|
|
drop cascades to function drop_sql_command()
|
|
DROP USER rls_regress_user0;
|
|
DROP USER rls_regress_user1;
|
|
DROP USER rls_regress_user2;
|