2010/8/18 KaiGai Kohei <kai...@ak.jp.nec.com>: >> It's also worth pointing out that the hook in ExecCheckRTPerms() does >> not presuppose label-based security. It could be used to implement >> some other policy altogether, which only strengthens the argument that >> we can't know how the user of the hook wants to handle these cases. >> > If rte->requiredPerms would not be cleared, the user of the hook will > be able to check access rights on the child tables, as they like. > How about an idea to add a new flag in RangeTblEntry which shows where > the RangeTblEntry came from, instead of clearing requiredPerms? > If the flag is true, I think ExecCheckRTEPerms() can simply skip checks > on the child tables.
Something along those lines might work, although I haven't yet scrutinized the code well enough to have a real clear opinion on what the best way of dealing with this is. -- Robert Haas EnterpriseDB: http://www.enterprisedb.com The Enterprise Postgres Company -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
