From: | Stephen Frost <sfrost(at)snowman(dot)net> |
---|---|
To: | Robert Haas <robertmhaas(at)gmail(dot)com> |
Cc: | Simon Riggs <simon(at)2ndquadrant(dot)com>, Kohei KaiGai <kaigai(at)kaigai(dot)gr(dot)jp>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Review of Row Level Security |
Date: | 2012-12-20 20:43:09 |
Message-ID: | 20121220204309.GK12354@tamriel.snowman.net |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
* Robert Haas (robertmhaas(at)gmail(dot)com) wrote:
> > * "Applies to all commands" should not be implemented via triggers.
> > Complex, slow, unacceptable thing to force upon users. Doing that begs
> > the question of why we would have the feature at all, since we already
> > have triggers and barrier views.
I would rather neither requires writing custom triggers but rather both
are supported through this feature.
> I agree that it is questionable whether we need this feature given
> that we already have security barrier views.
This I don't agree with- the plan has long been to have PG-specific RLS
first and then to support SELinux capabilities on top of it. We didn't
want to have SELinux-specific functionality that couldn't be achieved
without SELinux being involved, and I continue to agree with that.
There are many situations, environments, and individuals that would
view having to implement RLS through views and triggers as being
far-and-away too painful and error-prone to rely on.
Thanks,
Stephen
From | Date | Subject | |
---|---|---|---|
Next Message | Kohei KaiGai | 2012-12-20 20:55:20 | Re: Review of Row Level Security |
Previous Message | Kohei KaiGai | 2012-12-20 20:36:26 | Re: Review of Row Level Security |