Horton
Menu

Re: Non-superuser subscription owners

Mark Dilger <mark.dilger@enterprisedb.com>

View thread
From: Mark Dilger <mark.dilger@enterprisedb.com>
To: Jeff Davis <pgsql@j-davis.com>
Cc: Amit Kapila <amit.kapila16@gmail.com>, Andrew Dunstan <andrew@dunslane.net>, PostgreSQL-development <pgsql-hackers@postgresql.org>, Robert Haas <robertmhaas@gmail.com>
Date: 2021-12-15T20:23:02Z
Lists: pgsql-hackers

Attachments


> On Nov 24, 2021, at 4:30 PM, Jeff Davis <pgsql@j-davis.com> wrote:
> 
> We need to do permission checking for WITH CHECK OPTION and RLS. The
> patch right now allows the subscription to write data that an RLS
> policy forbids.

Version 4 of the patch, attached, no longer allows RLS to be circumvented, but does so in a course-grained fashion.  If the target table has row-level security policies which are enforced against the subscription owner, the replication draws an error, much as with a permissions failure.  This seems sufficient for now, as superusers, roles with bypassrls, and target table owners should be able to replicate as before.  We may want to revisit this later, perhaps if/when we address your ExecInsert question, below.

> 
> A couple other points:
> 
> * We shouldn't refer to the behavior of previous versions in the docs
> unless there's a compelling reason

Fixed.

> * Do we need to be smarter about partitioned tables, where an insert
> can turn into an update?

Indeed, the logic of apply_handle_tuple_routing() required a bit of refactoring.  Fixed in v4.

> * Should we refactor to borrow logic from ExecInsert so that it's less
> likely that we miss something in the future?

Let's just punt on this for now.

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Fix possible crash in tablesync worker.

  2. Display 'password_required' option for \dRs+ command.

  3. Restart the apply worker if the 'password_required' option is changed.

  4. Fix possible logical replication crash.

  5. Add new predefined role pg_create_subscription.

  6. Expand AclMode to 64 bits

  7. More cleanup of a2ab9c06ea.

  8. Respect permissions within logical replication.

  9. Improve table locking behavior in the face of current DDL.