From 842faa714c0454d67e523f5a0b6df6500e9bc1a5 Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Sat, 12 Apr 2014 21:04:58 -0400 Subject: Make security barrier views automatically updatable Views which are marked as security_barrier must have their quals applied before any user-defined quals are called, to prevent user-defined functions from being able to see rows which the security barrier view is intended to prevent them from seeing. Remove the restriction on security barrier views being automatically updatable by adding a new securityQuals list to the RTE structure which keeps track of the quals from security barrier views at each level, independently of the user-supplied quals. When RTEs are later discovered which have securityQuals populated, they are turned into subquery RTEs which are marked as security_barrier to prevent any user-supplied quals being pushed down (modulo LEAKPROOF quals). Dean Rasheed, reviewed by Craig Ringer, Simon Riggs, KaiGai Kohei --- doc/src/sgml/ref/create_view.sgml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/ref/create_view.sgml b/doc/src/sgml/ref/create_view.sgml index 57bfae30849..a13f1cbde35 100644 --- a/doc/src/sgml/ref/create_view.sgml +++ b/doc/src/sgml/ref/create_view.sgml @@ -323,12 +323,6 @@ CREATE VIEW vista AS SELECT text 'Hello World' AS hello; or set-returning functions. - - - - The view must not have the security_barrier property. - - @@ -361,6 +355,19 @@ CREATE VIEW vista AS SELECT text 'Hello World' AS hello; such rows that are not visible through the view. + + If an automatically updatable view is marked with the + security_barrier property then all the view's WHERE + conditions (and any conditions using operators which are marked as LEAKPROOF) + will always be evaluated before any conditions that a user of the view has + added. See for full details. Note that, + due to this, rows which are not ultimately returned (because they do not + pass the user's WHERE conditions) may still end up being locked. + EXPLAIN can be used to see which conditions are + applied at the relation level (and therefore do not lock rows) and which are + not. + + A more complex view that does not satisfy all these conditions is read-only by default: the system will not allow an insert, update, or -- cgit v1.2.3