Re: [HACKERS] RLS with check option - surprised design

2014-12-14 Thread Michael Paquier
On Sat, Nov 22, 2014 at 5:59 AM, Stephen Frost sfr...@snowman.net wrote: * Peter Geoghegan (p...@heroku.com) wrote: On Fri, Nov 21, 2014 at 6:57 AM, Stephen Frost sfr...@snowman.net wrote: [blah] [re-blah] [re-re-blah] This patch has already been committed, but there are still many concerns

Re: [HACKERS] RLS with check option - surprised design

2014-11-21 Thread Stephen Frost
* Peter Geoghegan (p...@heroku.com) wrote: On Sun, Oct 5, 2014 at 5:16 AM, Stephen Frost sfr...@snowman.net wrote: next a message: ERROR: new row violates WITH CHECK OPTION for data DETAIL: Failing row contains (2014-10-05 12:28:30.79652, petr, 1000). Doesn't inform about broken

Re: [HACKERS] RLS with check option - surprised design

2014-11-21 Thread Peter Geoghegan
On Fri, Nov 21, 2014 at 6:57 AM, Stephen Frost sfr...@snowman.net wrote: Are you sure this isn't just another example of an existing issue we have wrt column privileges..? I'm working on a patch already to address those issues in back-branches and will be considering what needs to be done for

Re: [HACKERS] RLS with check option - surprised design

2014-11-21 Thread Stephen Frost
* Peter Geoghegan (p...@heroku.com) wrote: On Fri, Nov 21, 2014 at 6:57 AM, Stephen Frost sfr...@snowman.net wrote: Are you sure this isn't just another example of an existing issue we have wrt column privileges..? I'm working on a patch already to address those issues in back-branches and

Re: [HACKERS] RLS with check option - surprised design

2014-11-19 Thread Peter Geoghegan
On Sun, Oct 5, 2014 at 5:16 AM, Stephen Frost sfr...@snowman.net wrote: next a message: ERROR: new row violates WITH CHECK OPTION for data DETAIL: Failing row contains (2014-10-05 12:28:30.79652, petr, 1000). Doesn't inform about broken policy. I'm guessing this is referring to the above

[HACKERS] RLS with check option - surprised design

2014-10-05 Thread Pavel Stehule
Hello I am playing with RLS. I created simple table table_data (inserted_by text, v integer); I created two policies create policy p1 on data with check (inserted_by = session_user); create policy p2 on data with check (v between 10 and 1000); I was surprised so p2 effectively disables p1;

Re: [HACKERS] RLS with check option - surprised design

2014-10-05 Thread Stephen Frost
* Pavel Stehule (pavel.steh...@gmail.com) wrote: I am playing with RLS. I created simple table table_data (inserted_by text, v integer); I created two policies create policy p1 on data with check (inserted_by = session_user); create policy p2 on data with check (v between 10 and 1000);

Re: [HACKERS] RLS with check option - surprised design

2014-10-05 Thread Pavel Stehule
2014-10-05 14:16 GMT+02:00 Stephen Frost sfr...@snowman.net: * Pavel Stehule (pavel.steh...@gmail.com) wrote: I am playing with RLS. I created simple table table_data (inserted_by text, v integer); I created two policies create policy p1 on data with check (inserted_by =

Re: [HACKERS] RLS with check option - surprised design

2014-10-05 Thread Stephen Frost
Pavel, * Pavel Stehule (pavel.steh...@gmail.com) wrote: Please, can you show me some use case, where OR has bigger sense than AND? [...] You might also have a policy which applies to all roles and then a more permissive policy for an 'admin' type of user- look at the Unix passwd example