RLS makes COPY TO process child tables - Mailing list pgsql-hackers

While working on [1] I noticed that if RLS gets enabled, the COPY TO command
includes the contents of child table into the result, although the
documentation says it should not:

    "COPY TO can be used only with plain tables, not views, and does not
    copy rows from child tables or child partitions. For example, COPY
    table TO copies the same rows as SELECT * FROM ONLY table. The syntax
    COPY (SELECT * FROM table) TO ... can be used to dump all of the rows
    in an inheritance hierarchy, partitioned table, or view."

A test case is attached (rls.sql) as well as fix proposal
(copy_rls_no_inh.diff).

[1] https://commitfest.postgresql.org/41/3641/

-- 
Antonin Houska
Web: https://www.cybertec-postgresql.com

create table a(i int);
insert into a values (1);

create table a1() inherits(a);
insert into a1 values (1);

-- Only the parent table is copied, as the documentation claims.
copy a to stdout;

alter table a enable row level security;
create role u;
create policy pol_perm on a as permissive for select to u using (true);
grant select on table a to u;
set role u;

-- Both "a" and "a1" appears in the output.
copy a to stdout;
diff --git a/src/backend/commands/copy.c b/src/backend/commands/copy.c
index e34f583ea7..3b8c25dadd 100644
--- a/src/backend/commands/copy.c
+++ b/src/backend/commands/copy.c
@@ -249,6 +249,7 @@ DoCopy(ParseState *pstate, const CopyStmt *stmt,
             from = makeRangeVar(get_namespace_name(RelationGetNamespace(rel)),
                                 pstrdup(RelationGetRelationName(rel)),
                                 -1);
+            from->inh = false;
 
             /* Build query */
             select = makeNode(SelectStmt);