diff options
| author | Stephen Frost <sfrost@snowman.net> | 2015-10-04 21:05:18 -0400 |
|---|---|---|
| committer | Stephen Frost <sfrost@snowman.net> | 2015-10-04 21:05:18 -0400 |
| commit | 90f334d2ca1a8bae2d0cd8a0898fb8ef90257565 (patch) | |
| tree | 2619e5544fbeb3ae65c462a3a9dd3f1a97d8ca11 /src/include/miscadmin.h | |
| parent | e78dc6b829219cacaccc59957b5375585e919099 (diff) | |
ALTER TABLE .. FORCE ROW LEVEL SECURITY
To allow users to force RLS to always be applied, even for table owners,
add ALTER TABLE .. FORCE ROW LEVEL SECURITY.
row_security=off overrides FORCE ROW LEVEL SECURITY, to ensure pg_dump
output is complete (by default).
Also add SECURITY_NOFORCE_RLS context to avoid data corruption when
ALTER TABLE .. FORCE ROW SECURITY is being used. The
SECURITY_NOFORCE_RLS security context is used only during referential
integrity checks and is only considered in check_enable_rls() after we
have already checked that the current user is the owner of the relation
(which should always be the case during referential integrity checks).
Back-patch to 9.5 where RLS was added.
Diffstat (limited to 'src/include/miscadmin.h')
| -rw-r--r-- | src/include/miscadmin.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/include/miscadmin.h b/src/include/miscadmin.h index ff695aae276..77cf8d71de7 100644 --- a/src/include/miscadmin.h +++ b/src/include/miscadmin.h @@ -287,6 +287,7 @@ extern int trace_recovery(int trace_level); /* flags to be OR'd to form sec_context */ #define SECURITY_LOCAL_USERID_CHANGE 0x0001 #define SECURITY_RESTRICTED_OPERATION 0x0002 +#define SECURITY_NOFORCE_RLS 0x0004 extern char *DatabasePath; @@ -305,6 +306,7 @@ extern void GetUserIdAndSecContext(Oid *userid, int *sec_context); extern void SetUserIdAndSecContext(Oid userid, int sec_context); extern bool InLocalUserIdChange(void); extern bool InSecurityRestrictedOperation(void); +extern bool InNoForceRLSOperation(void); extern void GetUserIdAndContext(Oid *userid, bool *sec_def_context); extern void SetUserIdAndContext(Oid userid, bool sec_def_context); extern void InitializeSessionUserId(const char *rolename, Oid useroid); |