+
(policy1 <- rls_construct_policy(
name = "admin_all",
- on = "passwd",
- to = "admin",
+ table = "passwd",
+ role = "admin",
using = "(true)",
- with = "(true)"
+ check = "(true)"
))
#> <rls_policy>
#> policy name: admin_all
-#> on: passwd
-#> to: admin
+#> table: passwd
+#> role: admin
#> using: (true)
-#> with: (true)
+#> check: (true)
rls_create_policy(con, policy1)
rls_policies(con)
#> # A tibble: 1 × 8
@@ -158,17 +189,17 @@
all_view = Normal users can view all rows
-
+
(policy2 <- rls_construct_policy(
name = "all_view",
- on = "passwd",
- for_ = "SELECT",
+ table = "passwd",
+ command = "SELECT",
using = "(true)"
))
#> <rls_policy>
#> policy name: all_view
-#> on: passwd
-#> for: SELECT
+#> table: passwd
+#> command: SELECT
#> using: (true)
rls_create_policy(con, policy2)
rls_policies(con)
@@ -179,23 +210,23 @@
user_mod = Normal users can update their own records,
but limit which shells a normal user is allowed to set
-
+
(policy3 <- rls_construct_policy(
name = "user_mod",
- on = "passwd",
- for_ = "UPDATE",
+ table = "passwd",
+ command = "UPDATE",
using = "(current_user = user_name)",
- with = "(
+ check = "(
current_user = user_name AND
shell IN ('/bin/bash','/bin/sh','/bin/dash','/bin/zsh','/bin/tcsh')
)"
))
#> <rls_policy>
#> policy name: user_mod
-#> on: passwd
-#> for: UPDATE
+#> table: passwd
+#> command: UPDATE
#> using: (current_user = user_name)
-#> with: (
+#> check: (
#> current_user = user_name AND
#> shell IN ('/bin/bash','/bin/sh','/bin/dash','/bin/zsh','/bin/tcsh')
#> )
@@ -212,64 +243,86 @@
Allow admin all normal rights
-
+
dbExecute(con, "GRANT SELECT, INSERT, UPDATE, DELETE ON passwd TO admin")
Users only get select access on public columns
-
+
dbExecute(con, "GRANT SELECT
- (user_name, uid, gid, real_name, home_phone, extra_info, home_dir, shell)
+ (user_name, uid, gid, real_name, home_phone, home_dir, shell)
ON passwd TO public"
)
Allow users to update certain columns
-
+
dbExecute(con, "GRANT UPDATE
- (pwhash, real_name, home_phone, extra_info, shell)
+ (pwhash, real_name, home_phone, shell)
ON passwd TO public"
)
Ensure the system behaves as expected
-
+Admin can access all columns
+
dbExecute(con, "SET SESSION AUTHORIZATION admin")
#> [1] 0
-dbGetQuery(con, "SELECT * from passwd")
-#> user_name pwhash uid gid real_name home_phone extra_info home_dir
-#> 1 admin xxx 0 0 Admin 111-222-3333 <NA> /root
-#> 2 bob xxx 1 1 Bob 123-456-7890 <NA> /home/bob
-#> 3 alice xxx 2 1 Alice 098-765-4321 <NA> /home/alice
-#> shell
-#> 1 /bin/dash
-#> 2 /bin/zsh
-#> 3 /bin/zsh
+tbl(con, "passwd")
+#> # Source: table<"passwd"> [3 x 8]
+#> # Database: postgres [schambe3@/tmp:5432/schambe3]
+#> user_name pwhash uid gid real_name home_phone home_dir shell
+#> <chr> <chr> <int> <int> <chr> <chr> <chr> <chr>
+#> 1 admin xxx 0 0 Admin 111-222-3333 /root /bin/dash
+#> 2 bob xxx 1 1 Bob 123-456-7890 /home/bob /bin/zsh
+#> 3 alice xxx 2 1 Alice 098-765-4321 /home/alice /bin/zsh
Alice can NOT access all columns
+
dbExecute(con, "SET SESSION AUTHORIZATION alice")
#> [1] 0
-dbGetQuery(con, "SELECT * from passwd")
-#> Error: Failed to fetch row : ERROR: permission denied for table passwd
-dbGetQuery(con, "SELECT user_name,real_name,home_phone,extra_info,home_dir,shell FROM passwd")
-#> user_name real_name home_phone extra_info home_dir shell
-#> 1 admin Admin 111-222-3333 <NA> /root /bin/dash
-#> 2 bob Bob 123-456-7890 <NA> /home/bob /bin/zsh
-#> 3 alice Alice 098-765-4321 <NA> /home/alice /bin/zsh
+tbl(con, "passwd") # "passwd" here means "SELECT * from passwd"
+#> Error in `db_query_fields.DBIConnection()`:
+#> ! Can't query fields.
+#> ℹ Using SQL: SELECT * FROM "passwd" AS "q01" WHERE (0 = 1)
+#> Caused by error:
+#> ! Failed to fetch row : ERROR: permission denied for table passwd
Alice can access all columns except for pwhash
+
+sql1 <- sql("SELECT user_name,real_name,home_phone,home_dir,shell FROM passwd")
+tbl(con, sql1)
+#> # Source: SQL [3 x 5]
+#> # Database: postgres [schambe3@/tmp:5432/schambe3]
+#> user_name real_name home_phone home_dir shell
+#> <chr> <chr> <chr> <chr> <chr>
+#> 1 admin Admin 111-222-3333 /root /bin/dash
+#> 2 bob Bob 123-456-7890 /home/bob /bin/zsh
+#> 3 alice Alice 098-765-4321 /home/alice /bin/zsh
Alice can not do UPDATE operations on certain columns (in this case
+user_name)
+
dbExecute(con, "UPDATE passwd SET user_name = 'joe'")
#> Error: Failed to fetch row : ERROR: permission denied for table passwd
+Alice can however update real_name
+
dbExecute(con, "UPDATE passwd SET real_name = 'Alice Doe'")
-#> [1] 1
-dbExecute(con, "UPDATE passwd SET real_name = 'John Doe' WHERE user_name = 'admin'")
-#> [1] 0
-dbExecute(con, "UPDATE passwd SET shell = '/bin/xx'")
-#> Error: Failed to fetch row : ERROR: new row violates row-level security policy for table "passwd"
-dbExecute(con, "DELETE from passwd")
+#> [1] 1
She can update real_name, but the update doesn’t alter
+any rows when it has a WHERE clause on user_name
+
+dbExecute(con, "UPDATE passwd SET real_name = 'John Doe' WHERE user_name = 'admin'")
+#> [1] 0
Alice can not update the shell column to an invalid
+value as defined by our row-level security policy above
+
+dbExecute(con, "UPDATE passwd SET shell = '/bin/xx'")
+#> Error: Failed to fetch row : ERROR: new row violates row-level security policy for table "passwd"
Alice can not delete the passwd table and can not do any
+insert operations
+
+dbExecute(con, "DELETE from passwd")
#> Error: Failed to fetch row : ERROR: permission denied for table passwd
dbExecute(con, "INSERT INTO passwd (user_name) VALUES ('xxx')")
#> Error: Failed to fetch row : ERROR: permission denied for table passwd
Alice can change her own password; RLS silently prevents updating
other rows
-
+
dbExecute(con, "UPDATE passwd SET pwhash = 'abc'")
#> [1] 1
@@ -56,10 +56,11 @@
Value
s3 object of class rls_policy
+
+
Details
+
We've chosen more intuitive names for policy parameters, so here's
+a mapping of function parameters to the PostgreSQL parameters:
References
https://www.postgresql.org/docs/current/sql-createpolicy.html
@@ -99,16 +118,16 @@
x <- rls_construct_policy(
name = "hide_confidential",
- on = "sometable",
- with = "confidential BOOLEAN",
+ table = "sometable",
+ check = "confidential BOOLEAN",
using = "confidential = false"
)
x
#> <rls_policy>
#> policy name: hide_confidential
-#> on: sometable
+#> table: sometable
#> using: confidential = false
-#> with: confidential BOOLEAN
+#> check: confidential BOOLEAN