Re: [HACKERS] Partitioned tables vs GRANT - Mailing list pgsql-hackers

From Tom Lane
Subject Re: [HACKERS] Partitioned tables vs GRANT
Date
Msg-id 27428.1491612088@sss.pgh.pa.us
Whole thread Raw
In response to Re: [HACKERS] Partitioned tables vs GRANT  (Keith Fiske <keith@omniti.com>)
Responses Re: [HACKERS] Partitioned tables vs GRANT  (Keith Fiske <keith@omniti.com>)
List pgsql-hackers
Keith Fiske <keith@omniti.com> writes:
> On Fri, Apr 7, 2017 at 2:46 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> Joe Conway <mail@joeconway.com> writes:
>>> Apparently INSERT and SELECT on the parent partitioned table skip normal
>>> acl checks on the partitions. Is that intended behavior?

>> Yes, this matches normal inheritance behavior.

> Should that really be normal partitioning behavior though?

Yes, it should.  Consider the alternatives:

1. Owner must remember to run around and grant permissions on all child
tables along with the parent.

2. The system silently(?) doesn't show you some rows that are supposed
to be visible when scanning the parent table.

If you want RLS, use RLS; this is not that, and is not a good substitute.

(We've been around on this topic before, btw.  See the archives.)
        regards, tom lane



pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: [HACKERS] WAL logging problem in 9.4.3?
Next
From: Andres Freund
Date:
Subject: Re: [HACKERS] Vacuum: allow usage of more than 1GB of work mem