Skip to content

Commit 143b39c

Browse files
sfrostsfrost
committed
Rename pg_rowsecurity -> pg_policy and other fixes
As pointed out by Robert, we should really have named pg_rowsecurity pg_policy, as the objects stored in that catalog are policies. This patch fixes that and updates the column names to start with 'pol' to match the new catalog name. The security consideration for COPY with row level security, also pointed out by Robert, has also been addressed by remembering and re-checking the OID of the relation initially referenced during COPY processing, to make sure it hasn't changed under us by the time we finish planning out the query which has been built. Robert and Alvaro also commented on missing OCLASS and OBJECT entries for POLICY (formerly ROWSECURITY or POLICY, depending) in various places. This patch fixes that too, which also happens to add the ability to COMMENT on policies. In passing, attempt to improve the consistency of messages, comments, and documentation as well. This removes various incarnations of 'row-security', 'row-level security', 'Row-security', etc, in favor of 'policy', 'row level security' or 'row_security' as appropriate. Happy Thanksgiving!
1 parent 1812ee5 commit 143b39c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+616
-545
lines changed

‎doc/src/sgml/catalogs.sgml

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -239,8 +239,8 @@
239239
</row>
240240

241241
<row>
242-
<entry><link linkend="catalog-pg-rowsecurity"><structname>pg_rowsecurity</structname></link></entry>
243-
<entry>table row-level security policies</entry>
242+
<entry><link linkend="catalog-pg-policy"><structname>pg_policy</structname></link></entry>
243+
<entry>table policies</entry>
244244
</row>
245245

246246
<row>
@@ -1944,8 +1944,8 @@
19441944
<entry><type>bool</type></entry>
19451945
<entry></entry>
19461946
<entry>
1947-
True if table has row-security enabled; see
1948-
<link linkend="catalog-pg-rowsecurity"><structname>pg_rowsecurity</structname></link> catalog
1947+
True if table has row level security enabled; see
1948+
<link linkend="catalog-pg-policy"><structname>pg_policy</structname></link> catalog
19491949
</entry>
19501950
</row>
19511951

@@ -5342,15 +5342,15 @@
53425342
</table>
53435343
</sect1>
53445344

5345-
<sect1 id="catalog-pg-rowsecurity">
5346-
<title><structname>pg_rowsecurity</structname></title>
5345+
<sect1 id="catalog-pg-policy">
5346+
<title><structname>pg_policy</structname></title>
53475347

5348-
<indexterm zone="catalog-pg-rowsecurity">
5349-
<primary>pg_rowsecurity</primary>
5348+
<indexterm zone="catalog-pg-policy">
5349+
<primary>pg_policy</primary>
53505350
</indexterm>
53515351

53525352
<para>
5353-
The catalog <structname>pg_rowsecurity</structname> stores row-level
5353+
The catalog <structname>pg_policy</structname> stores row-level
53545354
security policies for each table. A policy includes the kind of
53555355
command which it applies to (or all commands), the roles which it
53565356
applies to, the expression to be added as a security-barrier
@@ -5361,7 +5361,7 @@
53615361

53625362
<table>
53635363

5364-
<title><structname>pg_rowsecurity</structname> Columns</title>
5364+
<title><structname>pg_policy</structname> Columns</title>
53655365

53665366
<tgroup cols="4">
53675367
<thead>
@@ -5375,42 +5375,42 @@
53755375

53765376
<tbody>
53775377
<row>
5378-
<entry><structfield>rsecpolname</structfield></entry>
5378+
<entry><structfield>polname</structfield></entry>
53795379
<entry><type>name</type></entry>
53805380
<entry></entry>
5381-
<entry>The name of the row-security policy</entry>
5381+
<entry>The name of the policy</entry>
53825382
</row>
53835383

53845384
<row>
5385-
<entry><structfield>rsecrelid</structfield></entry>
5385+
<entry><structfield>polrelid</structfield></entry>
53865386
<entry><type>oid</type></entry>
53875387
<entry><literal><link linkend="catalog-pg-class"><structname>pg_class</structname></link>.oid</literal></entry>
5388-
<entry>The table to which the row-security policy belongs</entry>
5388+
<entry>The table to which the policy belongs</entry>
53895389
</row>
53905390

53915391
<row>
5392-
<entry><structfield>rseccmd</structfield></entry>
5392+
<entry><structfield>polcmd</structfield></entry>
53935393
<entry><type>char</type></entry>
53945394
<entry></entry>
5395-
<entry>The command type to which the row-security policy is applied.</entry>
5395+
<entry>The command type to which the policy is applied.</entry>
53965396
</row>
53975397

53985398
<row>
5399-
<entry><structfield>rsecroles</structfield></entry>
5399+
<entry><structfield>polroles</structfield></entry>
54005400
<entry><type>char</type></entry>
54015401
<entry></entry>
5402-
<entry>The roles to which the row-security policy is applied.</entry>
5402+
<entry>The roles to which the policy is applied.</entry>
54035403
</row>
54045404

54055405
<row>
5406-
<entry><structfield>rsecqual</structfield></entry>
5406+
<entry><structfield>polqual</structfield></entry>
54075407
<entry><type>pg_node_tree</type></entry>
54085408
<entry></entry>
54095409
<entry>The expression tree to be added to the security barrier qualifications for queries which use the table.</entry>
54105410
</row>
54115411

54125412
<row>
5413-
<entry><structfield>rsecwithcheck</structfield></entry>
5413+
<entry><structfield>polwithcheck</structfield></entry>
54145414
<entry><type>pg_node_tree</type></entry>
54155415
<entry></entry>
54165416
<entry>The expression tree to be added to the with check qualifications for queries which attempt to add rows to the table.</entry>
@@ -5423,8 +5423,8 @@
54235423
<note>
54245424
<para>
54255425
<literal>pg_class.relrowsecurity</literal>
5426-
True if the table has row-security enabled. Policies will not be applied
5427-
unless row-security is enabled on the table.
5426+
True if the table has row security enabled. Policies will not be applied
5427+
unless row security is enabled on the table.
54285428
</para>
54295429
</note>
54305430

‎doc/src/sgml/ddl.sgml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1558,8 +1558,8 @@ REVOKE ALL ON accounts FROM PUBLIC;
15581558

15591559
<para>
15601560
To specify which rows are visible and what rows can be added to the
1561-
table with row security, an expression is required which returns a
1562-
boolean result. This expression will be evaluated for each row prior
1561+
table with row level security, an expression is required which returns
1562+
a boolean result. This expression will be evaluated for each row prior
15631563
to other conditionals or functions which are part of the query. The
15641564
one exception to this rule are <literal>leakproof</literal> functions,
15651565
which are guaranteed to not leak information. Two expressions may be

‎doc/src/sgml/ref/alter_policy.sgml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ PostgreSQL documentation
1616

1717
<refnamediv>
1818
<refname>ALTER POLICY</refname>
19-
<refpurpose>change the definition of a row-security policy</refpurpose>
19+
<refpurpose>change the definition of a policy</refpurpose>
2020
</refnamediv>
2121

2222
<refsynopsisdiv>
@@ -34,7 +34,7 @@ ALTER POLICY <replaceable class="parameter">name</replaceable> ON <replaceable c
3434

3535
<para>
3636
<command>ALTER POLICY</command> changes the <replaceable class="parameter">
37-
definition</replaceable> of an existing row-security policy.
37+
definition</replaceable> of an existing policy.
3838
</para>
3939

4040
<para>

‎doc/src/sgml/ref/create_policy.sgml

Lines changed: 24 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ PostgreSQL documentation
1616

1717
<refnamediv>
1818
<refname>CREATE POLICY</refname>
19-
<refpurpose>define a new row-security policy for a table</refpurpose>
19+
<refpurpose>define a new policy for a table</refpurpose>
2020
</refnamediv>
2121

2222
<refsynopsisdiv>
@@ -33,14 +33,13 @@ CREATE POLICY <replaceable class="parameter">name</replaceable> ON <replaceable
3333
<title>Description</title>
3434

3535
<para>
36-
The <command>CREATE POLICY</command> command defines a new row-security
37-
policy for a table. Note that row-security must also be enabled on the
38-
table using <command>ALTER TABLE</command> in order for created policies
39-
to be applied.
36+
The <command>CREATE POLICY</command> command defines a new policy for a
37+
table. Note that row level security must also be enabled on the table using
38+
<command>ALTER TABLE</command> in order for created policies to be applied.
4039
</para>
4140

4241
<para>
43-
A row-security policy is an expression which is added to the security-barrier
42+
A policy is an expression which is added to the security-barrier
4443
qualifications of queries which are run against the table the policy is on,
4544
or an expression which is added to the with-check options for a table and
4645
which is applied to rows which would be added to the table.
@@ -49,7 +48,7 @@ CREATE POLICY <replaceable class="parameter">name</replaceable> ON <replaceable
4948
expression will be evaluated against the rows which are going to be added to
5049
the table. By adding policies to a table, a user can limit the rows which a
5150
given user can select, insert, update, or delete. This capability is also
52-
known as Row-Level Security or RLS.
51+
known as Row Level Security or RLS.
5352
</para>
5453

5554
<para>
@@ -66,22 +65,22 @@ CREATE POLICY <replaceable class="parameter">name</replaceable> ON <replaceable
6665
</para>
6766

6867
<para>
69-
Note that while row-security policies will be applied for explicit queries
70-
against tables in the system, they are not applied when the system is
71-
performing internal referential integrity checks or validating constraints.
72-
This means there are indirect ways to determine that a given value exists.
73-
An example of this is attempting to insert a duplicate value
74-
into a column which is the primary key or has a unique constraint. If the
75-
insert fails then the user can infer that the value already exists (this
76-
example assumes that the user is permitted by policy to insert
77-
records which they are not allowed to see). Another example is where a user
78-
is allowed to insert into a table which references another, otherwise hidden
79-
table. Existence can be determined by the user inserting values into the
80-
referencing table, where success would indicate that the value exists in the
81-
referenced table. These issues can be addressed by carefully crafting
82-
policies which prevent users from being able to insert, delete, or update
83-
records at all which might possibly indicate a value they are not otherwise
84-
able to see, or by using generated values (e.g.: surrogate keys) instead.
68+
Note that while policies will be applied for explicit queries against tables
69+
in the system, they are not applied when the system is performing internal
70+
referential integrity checks or validating constraints. This means there are
71+
indirect ways to determine that a given value exists. An example of this is
72+
attempting to insert a duplicate value into a column which is the primary key
73+
or has a unique constraint. If the insert fails then the user can infer that
74+
the value already exists (this example assumes that the user is permitted by
75+
policy to insert records which they are not allowed to see). Another example
76+
is where a user is allowed to insert into a table which references another,
77+
otherwise hidden table. Existence can be determined by the user inserting
78+
values into the referencing table, where success would indicate that the
79+
value exists in the referenced table. These issues can be addressed by
80+
carefully crafting policies which prevent users from being able to insert,
81+
delete, or update records at all which might possibly indicate a value they
82+
are not otherwise able to see, or by using generated values (e.g.: surrogate
83+
keys) instead.
8584
</para>
8685

8786
<para>
@@ -291,8 +290,8 @@ CREATE POLICY <replaceable class="parameter">name</replaceable> ON <replaceable
291290

292291
<para>
293292
In order to maintain <firstterm>referential integrity</firstterm> between
294-
two related tables, row-security policies are not applied when the system
295-
performs checks on foreign key constraints.
293+
two related tables, policies are not applied when the system performs
294+
checks on foreign key constraints.
296295
</para>
297296

298297
</refsect1>

‎doc/src/sgml/ref/drop_policy.sgml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ PostgreSQL documentation
1616

1717
<refnamediv>
1818
<refname>DROP POLICY</refname>
19-
<refpurpose>remove a row-security policy from a table</refpurpose>
19+
<refpurpose>remove a policy from a table</refpurpose>
2020
</refnamediv>
2121

2222
<refsynopsisdiv>
@@ -29,11 +29,11 @@ DROP POLICY [ IF EXISTS ] <replaceable class="parameter">name</replaceable> ON <
2929
<title>Description</title>
3030

3131
<para>
32-
<command>DROP POLICY</command> removes the specified row-security policy
33-
from the table. Note that if the last policy is removed for a table and
34-
the table still has ROW POLICY enabled via <command>ALTER TABLE</command>,
35-
then the default-deny policy will be used. <command>ALTER TABLE</command>
36-
can be used to disable row security for a table using
32+
<command>DROP POLICY</command> removes the specified policy from the table.
33+
Note that if the last policy is removed for a table and the table still has
34+
row level security enabled via <command>ALTER TABLE</command>, then the
35+
default-deny policy will be used. <command>ALTER TABLE</command> can be used
36+
to disable row level security for a table using
3737
<literal>DISABLE ROW SECURITY</literal>, whether policies for the table
3838
exist or not.
3939
</para>
@@ -80,8 +80,8 @@ DROP POLICY [ IF EXISTS ] <replaceable class="parameter">name</replaceable> ON <
8080
<title>Examples</title>
8181

8282
<para>
83-
To drop the row-security policy called <literal>p1</literal> on the
84-
table named <literal>my_table</literal>:
83+
To drop the policy called <literal>p1</literal> on the table named
84+
<literal>my_table</literal>:
8585

8686
<programlisting>
8787
DROP POLICY p1 ON my_table;

‎doc/src/sgml/rules.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2133,7 +2133,7 @@ SELECT * FROM phone_number WHERE tricky(person, phone);
21332133
</para>
21342134

21352135
<para>
2136-
When it is necessary for a view to provide row-level security, the
2136+
When it is necessary for a view to provide row level security, the
21372137
<literal>security_barrier</literal> attribute should be applied to
21382138
the view. This prevents maliciously-chosen functions and operators from
21392139
being invoked on rows until after the view has done its work. For

‎src/backend/catalog/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ POSTGRES_BKI_SRCS = $(addprefix $(top_srcdir)/src/include/catalog/,\
3939
pg_ts_config.h pg_ts_config_map.h pg_ts_dict.h \
4040
pg_ts_parser.h pg_ts_template.h pg_extension.h \
4141
pg_foreign_data_wrapper.h pg_foreign_server.h pg_user_mapping.h \
42-
pg_foreign_table.h pg_rowsecurity.h \
42+
pg_foreign_table.h pg_policy.h \
4343
pg_default_acl.h pg_seclabel.h pg_shseclabel.h pg_collation.h pg_range.h \
4444
toasting.h indexing.h \
4545
)

‎src/backend/catalog/dependency.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@
4343
#include "catalog/pg_opclass.h"
4444
#include "catalog/pg_operator.h"
4545
#include "catalog/pg_opfamily.h"
46+
#include "catalog/pg_policy.h"
4647
#include "catalog/pg_proc.h"
4748
#include "catalog/pg_rewrite.h"
48-
#include "catalog/pg_rowsecurity.h"
4949
#include "catalog/pg_tablespace.h"
5050
#include "catalog/pg_trigger.h"
5151
#include "catalog/pg_ts_config.h"
@@ -156,7 +156,8 @@ static const Oid object_classes[MAX_OCLASS] = {
156156
UserMappingRelationId, /* OCLASS_USER_MAPPING */
157157
DefaultAclRelationId, /* OCLASS_DEFACL */
158158
ExtensionRelationId, /* OCLASS_EXTENSION */
159-
EventTriggerRelationId /* OCLASS_EVENT_TRIGGER */
159+
EventTriggerRelationId, /* OCLASS_EVENT_TRIGGER */
160+
PolicyRelationId /* OCLASS_POLICY */
160161
};
161162

162163

@@ -1251,7 +1252,7 @@ doDeletion(const ObjectAddress *object, int flags)
12511252
RemoveEventTriggerById(object->objectId);
12521253
break;
12531254

1254-
case OCLASS_ROWSECURITY:
1255+
case OCLASS_POLICY:
12551256
RemovePolicyById(object->objectId);
12561257
break;
12571258

@@ -2361,8 +2362,8 @@ getObjectClass(const ObjectAddress *object)
23612362
case EventTriggerRelationId:
23622363
return OCLASS_EVENT_TRIGGER;
23632364

2364-
case RowSecurityRelationId:
2365-
return OCLASS_ROWSECURITY;
2365+
case PolicyRelationId:
2366+
return OCLASS_POLICY;
23662367
}
23672368

23682369
/* shouldn't get here */

0 commit comments

Comments
 (0)