Re: API change advice: Passing plan invalidation info from the rewriter into the planner?

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: API change advice: Passing plan invalidation info from the rewriter into the planner?
Дата
Msg-id 7872.1402442651@sss.pgh.pa.us
обсуждение исходный текст
Ответ на Re: API change advice: Passing plan invalidation info from the rewriter into the planner?  (Craig Ringer <craig@2ndquadrant.com>)
Ответы Re: API change advice: Passing plan invalidation info from the rewriter into the planner?  (Craig Ringer <craig@2ndquadrant.com>)
Список pgsql-hackers
Craig Ringer <craig@2ndquadrant.com> writes:
> On 06/11/2014 02:19 AM, Tom Lane wrote:
>> Could we put the "if superuser then ok" test into the RLS condition test
>> and thereby not need more than one plan at all?

> Only if we put it in another level of security barrier subquery, because
> otherwise the planner might execute the other quals (including possible
> user defined functions) before the superuser test. Which was the whole
> reason for the superuser test in the first place.

Is the point of that that the table owner might have put trojan-horse
functions into the RLS qual?  If so, why are we only concerned about
defending the superuser and not other users?  Seems like the right fix
would be to insist that functions in the RLS qual run as the table owner.
Granted, that might be painful to do.  But it still seems like "we only
need to do this for superusers" is designing with blinkers on.
        regards, tom lane



В списке pgsql-hackers по дате отправления:

Предыдущее
От: Tom Lane
Дата:
Сообщение: Re: [GENERAL] Question about partial functional indexes and the query planner
Следующее
От: Craig Ringer
Дата:
Сообщение: Re: API change advice: Passing plan invalidation info from the rewriter into the planner?