Re: Bug: RLS policy FOR SELECT is used to check new rows - Mailing list pgsql-hackers

From Laurenz Albe
Subject Re: Bug: RLS policy FOR SELECT is used to check new rows
Date
Msg-id cb96d8657a9d5dfc53a17d99e24e08e617ba11a5.camel@cybertec.at
Whole thread Raw
In response to Re: Bug: RLS policy FOR SELECT is used to check new rows  (Laurenz Albe <laurenz.albe@cybertec.at>)
Responses Re: Bug: RLS policy FOR SELECT is used to check new rows
List pgsql-hackers
On Wed, 2023-10-25 at 09:45 +0200, Laurenz Albe wrote:
> I can accept that the error is intentional, even though it violated the
> POLA for me.  I can buy into the argument that an UPDATE should not make
> a row seem to vanish.
>
> I cannot buy into the constraint argument.  If the table owner wanted to
> prevent you from causing a constraint violation error with a row you
> cannot see, she wouldn't have given you a FOR UPDATE policy that allows
> you to perform such an UPDATE.
>
> Anyway, it is probably too late to change a behavior that has been like
> that for a while and is not manifestly buggy.

I have thought some more about this, and I believe that if FOR SELECT
policies are used to check new rows, you should be allowed to specify
WITH CHECK on FOR SELECT policies.  Why not allow a user to specify
different conditions for fetching from a table and for new rows after
an UPDATE?

The attached patch does that.  What so you think?

Yours,
Laurenz Albe

Attachment

pgsql-hackers by date:

Previous
From: Nazir Bilal Yavuz
Date:
Subject: Re: Failure during Building Postgres in Windows with Meson
Next
From: "Tristan Partin"
Date:
Subject: Re: Failure during Building Postgres in Windows with Meson