On Tue, Oct 6, 2015 at 10:29 PM, Stephen Frost <sfr...@snowman.net> wrote:
> * Haribabu Kommi (kommi.harib...@gmail.com) wrote:
>> On Tue, Oct 6, 2015 at 10:56 AM, Haribabu Kommi
>> <kommi.harib...@gmail.com> wrote:
>> > Here I attached an updated version of the patch with the following changes.
>> I found some problems related to providing multi-tenancy on a system
>> catalog view.
>> This is because, system catalog view uses the owner that is created
>> the user instead
>> of the current user by storing the user information in "checkAsUser"
>> field in RangeTblEntry
> Right, when querying through a view to tables underneath, we use the
> permissions of the view owner. View creators should be generally aware
> of this already.
> I agree that it adds complications to the multi-tenancy idea since the
> system views, today, allow viewing of all objects. There are two ways
> to address that:
> Modify the system catalog views to include the same constraints that the
> policies on the tables do
> Allow RLS policies against views and then create the necessary policies
> on the views in the catalog.
> My inclination is to work towards the latter as that's a capability we'd
> like to have anyway.
Thanks for the solutions to handle the problem.
Currently I thought of providing two multi-tenancy solutions to the user.
1. Tenancy at shared system catalog tables level
2. Tenancy at database system catalog tables.
User can create views on system catalog tables, even though I want to provide
tenancy on those views also. I will do further analysis and provide
details of which
solution gives the benefit of two tenancy levels and then I can proceed for
implementation after discussion.
Sent via pgsql-hackers mailing list (firstname.lastname@example.org)
To make changes to your subscription: