Re: copy.c handling for RLS is insecure

On Mon, Oct 06, 2014 at 03:15:25PM -0400, Stephen Frost wrote:

> > As far as I can see, the previous code only looked up any given name
> > once.  If you got a relation name, DoCopy() looked it up, and then
> > BeginCopy() references it only by the passed-down Relation descriptor;
> > if you got a query, DoCopy() ignores it, and then BeginCopy.  All of
> > which is fine, at least AFAICS; if you think otherwise, that should be
> > reported to pgsql-security.
> 
> Yeah, that's correct.  I suppose there's some possible risk of things
> changing between when you parse the query and when it actually gets
> analyzed and rewritten, but that's not a security risk per-se..

I'm not sure I understand.  If that change violates an access control,
it's a security risk /per se/, as you put it.

Are you saying that such changes, even though they might be bugs,
categorically couldn't violate an access control?

Cheers,
David.
-- 
David Fetter <david@fetter.org> http://fetter.org/
Phone: +1 415 235 3778  AIM: dfetter666  Yahoo!: dfetter
Skype: davidfetter      XMPP: david.fetter@gmail.com
iCal: webcal://www.tripit.com/feed/ical/people/david74/tripit.ics

Remember to vote!
Consider donating to Postgres: http://www.postgresql.org/about/donate