<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>CREATE POLICY</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REV="MADE"
HREF="mailto:pgsql-docs@postgresql.org"><LINK
REL="HOME"
TITLE="PostgreSQL 9.6.22 Documentation"
HREF="index.html"><LINK
REL="UP"
TITLE="SQL Commands"
HREF="sql-commands.html"><LINK
REL="PREVIOUS"
TITLE="CREATE OPERATOR FAMILY"
HREF="sql-createopfamily.html"><LINK
REL="NEXT"
TITLE="CREATE ROLE"
HREF="sql-createrole.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="stylesheet.css"><META
HTTP-EQUIV="Content-Type"
CONTENT="text/html; charset=ISO-8859-1"><META
NAME="creation"
CONTENT="2021-05-18T09:16:10"></HEAD
><BODY
CLASS="REFENTRY"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="4"
ALIGN="center"
VALIGN="bottom"
><A
HREF="index.html"
>PostgreSQL 9.6.22 Documentation</A
></TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="top"
><A
TITLE="CREATE OPERATOR FAMILY"
HREF="sql-createopfamily.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="top"
><A
HREF="sql-commands.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="60%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="20%"
ALIGN="right"
VALIGN="top"
><A
TITLE="CREATE ROLE"
HREF="sql-createrole.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><H1
><A
NAME="SQL-CREATEPOLICY"
></A
>CREATE POLICY</H1
><DIV
CLASS="REFNAMEDIV"
><A
NAME="AEN81715"
></A
><H2
>Name</H2
>CREATE POLICY -- define a new row level security policy for a table</DIV
><DIV
CLASS="REFSYNOPSISDIV"
><A
NAME="AEN81718"
></A
><H2
>Synopsis</H2
><PRE
CLASS="SYNOPSIS"
>CREATE POLICY <TT
CLASS="REPLACEABLE"
><I
>name</I
></TT
> ON <TT
CLASS="REPLACEABLE"
><I
>table_name</I
></TT
>
[ FOR { ALL | SELECT | INSERT | UPDATE | DELETE } ]
[ TO { <TT
CLASS="REPLACEABLE"
><I
>role_name</I
></TT
> | PUBLIC | CURRENT_USER | SESSION_USER } [, ...] ]
[ USING ( <TT
CLASS="REPLACEABLE"
><I
>using_expression</I
></TT
> ) ]
[ WITH CHECK ( <TT
CLASS="REPLACEABLE"
><I
>check_expression</I
></TT
> ) ]</PRE
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN81725"
></A
><H2
>Description</H2
><P
> The <TT
CLASS="COMMAND"
>CREATE POLICY</TT
> command defines a new row-level
security policy for a table. Note that row-level security must be
enabled on the table (using <TT
CLASS="COMMAND"
>ALTER TABLE ... ENABLE ROW LEVEL
SECURITY</TT
>) in order for created policies to be applied.
</P
><P
> A policy grants the permission to select, insert, update, or delete rows
that match the relevant policy expression. Existing table rows are
checked against the expression specified in <TT
CLASS="LITERAL"
>USING</TT
>,
while new rows that would be created via <TT
CLASS="LITERAL"
>INSERT</TT
>
or <TT
CLASS="LITERAL"
>UPDATE</TT
> are checked against the expression specified
in <TT
CLASS="LITERAL"
>WITH CHECK</TT
>. When a <TT
CLASS="LITERAL"
>USING</TT
>
expression returns true for a given row then that row is visible to the
user, while if false or null is returned then the row is not visible.
When a <TT
CLASS="LITERAL"
>WITH CHECK</TT
> expression returns true for a row
then that row is inserted or updated, while if false or null is returned
then an error occurs.
</P
><P
> For <TT
CLASS="COMMAND"
>INSERT</TT
> and <TT
CLASS="COMMAND"
>UPDATE</TT
> statements,
<TT
CLASS="LITERAL"
>WITH CHECK</TT
> expressions are enforced after
<TT
CLASS="LITERAL"
>BEFORE</TT
> triggers are fired, and before any actual data
modifications are made. Thus a <TT
CLASS="LITERAL"
>BEFORE ROW</TT
> trigger may
modify the data to be inserted, affecting the result of the security
policy check. <TT
CLASS="LITERAL"
>WITH CHECK</TT
> expressions are enforced
before any other constraints.
</P
><P
> Policy names are per-table. Therefore, one policy name can be used for many
different tables and have a definition for each table which is appropriate to
that table.
</P
><P
> Policies can be applied for specific commands or for specific roles. The
default for newly created policies is that they apply for all commands and
roles, unless otherwise specified. Multiple policies may apply to a single
command; see below for more details.
<A
HREF="sql-createpolicy.html#SQL-CREATEPOLICY-SUMMARY"
>Table 1</A
> summarizes how the different types
of policy apply to specific commands.
</P
><P
> For policies that can have both <TT
CLASS="LITERAL"
>USING</TT
>
and <TT
CLASS="LITERAL"
>WITH CHECK</TT
> expressions (<TT
CLASS="LITERAL"
>ALL</TT
>
and <TT
CLASS="LITERAL"
>UPDATE</TT
>), if no <TT
CLASS="LITERAL"
>WITH CHECK</TT
>
expression is defined, then the <TT
CLASS="LITERAL"
>USING</TT
> expression will be
used both to determine which rows are visible (normal
<TT
CLASS="LITERAL"
>USING</TT
> case) and which new rows will be allowed to be
added (<TT
CLASS="LITERAL"
>WITH CHECK</TT
> case).
</P
><P
> If row-level security is enabled for a table, but no applicable policies
exist, a <SPAN
CLASS="QUOTE"
>"default deny"</SPAN
> policy is assumed, so that no rows will
be visible or updatable.
</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN81758"
></A
><H2
>Parameters</H2
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
><TT
CLASS="REPLACEABLE"
><I
>name</I
></TT
></DT
><DD
><P
> The name of the policy to be created. This must be distinct from the
name of any other policy for the table.
</P
></DD
><DT
><TT
CLASS="REPLACEABLE"
><I
>table_name</I
></TT
></DT
><DD
><P
> The name (optionally schema-qualified) of the table the
policy applies to.
</P
></DD
><DT
><TT
CLASS="REPLACEABLE"
><I
>command</I
></TT
></DT
><DD
><P
> The command to which the policy applies. Valid options are
<TT
CLASS="COMMAND"
>ALL</TT
>, <TT
CLASS="COMMAND"
>SELECT</TT
>,
<TT
CLASS="COMMAND"
>INSERT</TT
>, <TT
CLASS="COMMAND"
>UPDATE</TT
>,
and <TT
CLASS="COMMAND"
>DELETE</TT
>.
<TT
CLASS="COMMAND"
>ALL</TT
> is the default.
See below for specifics regarding how these are applied.
</P
></DD
><DT
><TT
CLASS="REPLACEABLE"
><I
>role_name</I
></TT
></DT
><DD
><P
> The role(s) to which the policy is to be applied. The default is
<TT
CLASS="LITERAL"
>PUBLIC</TT
>, which will apply the policy to all roles.
</P
></DD
><DT
><TT
CLASS="REPLACEABLE"
><I
>using_expression</I
></TT
></DT
><DD
><P
> Any <ACRONYM
CLASS="ACRONYM"
>SQL</ACRONYM
> conditional expression (returning
<TT
CLASS="TYPE"
>boolean</TT
>). The conditional expression cannot contain
any aggregate or window functions. This expression will be added
to queries that refer to the table if row level security is enabled.
Rows for which the expression returns true will be visible. Any
rows for which the expression returns false or null will not be
visible to the user (in a <TT
CLASS="COMMAND"
>SELECT</TT
>), and will not be
available for modification (in an <TT
CLASS="COMMAND"
>UPDATE</TT
>
or <TT
CLASS="COMMAND"
>DELETE</TT
>). Such rows are silently suppressed; no error
is reported.
</P
></DD
><DT
><TT
CLASS="REPLACEABLE"
><I
>check_expression</I
></TT
></DT
><DD
><P
> Any <ACRONYM
CLASS="ACRONYM"
>SQL</ACRONYM
> conditional expression (returning
<TT
CLASS="TYPE"
>boolean</TT
>). The conditional expression cannot contain
any aggregate or window functions. This expression will be used in
<TT
CLASS="COMMAND"
>INSERT</TT
> and <TT
CLASS="COMMAND"
>UPDATE</TT
> queries against
the table if row level security is enabled. Only rows for which the
expression evaluates to true will be allowed. An error will be thrown
if the expression evaluates to false or null for any of the records
inserted or any of the records that result from the update. Note that
the <TT
CLASS="REPLACEABLE"
><I
>check_expression</I
></TT
> is
evaluated against the proposed new contents of the row, not the
original contents.
</P
></DD
></DL
></DIV
><DIV
CLASS="REFSECT2"
><A
NAME="AEN81808"
></A
><H3
>Per-Command Policies</H3
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
><A
NAME="SQL-CREATEPOLICY-ALL"
></A
><TT
CLASS="LITERAL"
>ALL</TT
></DT
><DD
><P
> Using <TT
CLASS="LITERAL"
>ALL</TT
> for a policy means that it will apply
to all commands, regardless of the type of command. If an
<TT
CLASS="LITERAL"
>ALL</TT
> policy exists and more specific policies
exist, then both the <TT
CLASS="LITERAL"
>ALL</TT
> policy and the more
specific policy (or policies) will be applied.
Additionally, <TT
CLASS="LITERAL"
>ALL</TT
> policies will be applied to
both the selection side of a query and the modification side, using
the <TT
CLASS="LITERAL"
>USING</TT
> expression for both cases if only
a <TT
CLASS="LITERAL"
>USING</TT
> expression has been defined.
</P
><P
> As an example, if an <TT
CLASS="LITERAL"
>UPDATE</TT
> is issued, then the
<TT
CLASS="LITERAL"
>ALL</TT
> policy will be applicable both to what the
<TT
CLASS="LITERAL"
>UPDATE</TT
> will be able to select as rows to be
updated (applying the <TT
CLASS="LITERAL"
>USING</TT
> expression),
and to the resulting updated rows, to check if they are permitted
to be added to the table (applying the <TT
CLASS="LITERAL"
>WITH CHECK</TT
>
expression, if defined, and the <TT
CLASS="LITERAL"
>USING</TT
> expression
otherwise). If an <TT
CLASS="COMMAND"
>INSERT</TT
>
or <TT
CLASS="COMMAND"
>UPDATE</TT
> command attempts to add rows to the
table that do not pass the <TT
CLASS="LITERAL"
>ALL</TT
>
policy's <TT
CLASS="LITERAL"
>WITH CHECK</TT
> expression, the entire
command will be aborted.
</P
></DD
><DT
><A
NAME="SQL-CREATEPOLICY-SELECT"
></A
><TT
CLASS="LITERAL"
>SELECT</TT
></DT
><DD
><P
> Using <TT
CLASS="LITERAL"
>SELECT</TT
> for a policy means that it will apply
to <TT
CLASS="LITERAL"
>SELECT</TT
> queries and whenever
<TT
CLASS="LITERAL"
>SELECT</TT
> permissions are required on the relation the
policy is defined for. The result is that only those records from the
relation that pass the <TT
CLASS="LITERAL"
>SELECT</TT
> policy will be
returned during a <TT
CLASS="LITERAL"
>SELECT</TT
> query, and that queries
that require <TT
CLASS="LITERAL"
>SELECT</TT
> permissions, such as
<TT
CLASS="LITERAL"
>UPDATE</TT
>, will also only see those records
that are allowed by the <TT
CLASS="LITERAL"
>SELECT</TT
> policy.
A <TT
CLASS="LITERAL"
>SELECT</TT
> policy cannot have a <TT
CLASS="LITERAL"
>WITH
CHECK</TT
> expression, as it only applies in cases where
records are being retrieved from the relation.
</P
></DD
><DT
><A
NAME="SQL-CREATEPOLICY-INSERT"
></A
><TT
CLASS="LITERAL"
>INSERT</TT
></DT
><DD
><P
> Using <TT
CLASS="LITERAL"
>INSERT</TT
> for a policy means that it will apply
to <TT
CLASS="LITERAL"
>INSERT</TT
> commands. Rows being inserted that do
not pass this policy will result in a policy violation error, and the
entire <TT
CLASS="LITERAL"
>INSERT</TT
> command will be aborted.
An <TT
CLASS="LITERAL"
>INSERT</TT
> policy cannot have
a <TT
CLASS="LITERAL"
>USING</TT
> expression, as it only applies in cases
where records are being added to the relation.
</P
><P
> Note that <TT
CLASS="LITERAL"
>INSERT</TT
> with <TT
CLASS="LITERAL"
>ON CONFLICT DO
UPDATE</TT
> checks <TT
CLASS="LITERAL"
>INSERT</TT
> policies'
<TT
CLASS="LITERAL"
>WITH CHECK</TT
> expressions only for rows appended
to the relation by the <TT
CLASS="LITERAL"
>INSERT</TT
> path.
</P
></DD
><DT
><A
NAME="SQL-CREATEPOLICY-UPDATE"
></A
><TT
CLASS="LITERAL"
>UPDATE</TT
></DT
><DD
><P
> Using <TT
CLASS="LITERAL"
>UPDATE</TT
> for a policy means that it will apply
to <TT
CLASS="LITERAL"
>UPDATE</TT
>, <TT
CLASS="LITERAL"
>SELECT FOR UPDATE</TT
>
and <TT
CLASS="LITERAL"
>SELECT FOR SHARE</TT
> commands, as well as
auxiliary <TT
CLASS="LITERAL"
>ON CONFLICT DO UPDATE</TT
> clauses of
<TT
CLASS="LITERAL"
>INSERT</TT
> commands. Since <TT
CLASS="LITERAL"
>UPDATE</TT
>
involves pulling an existing record and replacing it with a new
modified record, <TT
CLASS="LITERAL"
>UPDATE</TT
>
policies accept both a <TT
CLASS="LITERAL"
>USING</TT
> expression and
a <TT
CLASS="LITERAL"
>WITH CHECK</TT
> expression.
The <TT
CLASS="LITERAL"
>USING</TT
> expression determines which records
the <TT
CLASS="LITERAL"
>UPDATE</TT
> command will see to operate against,
while the <TT
CLASS="LITERAL"
>WITH CHECK</TT
> expression defines which
modified rows are allowed to be stored back into the relation.
</P
><P
> Any rows whose updated values do not pass the
<TT
CLASS="LITERAL"
>WITH CHECK</TT
> expression will cause an error, and the
entire command will be aborted. If only a <TT
CLASS="LITERAL"
>USING</TT
>
clause is specified, then that clause will be used for both
<TT
CLASS="LITERAL"
>USING</TT
> and <TT
CLASS="LITERAL"
>WITH CHECK</TT
> cases.
</P
><P
> Typically an <TT
CLASS="LITERAL"
>UPDATE</TT
> command also needs to read
data from columns in the relation being updated (e.g., in a
<TT
CLASS="LITERAL"
>WHERE</TT
> clause or a <TT
CLASS="LITERAL"
>RETURNING</TT
>
clause, or in an expression on the right hand side of the
<TT
CLASS="LITERAL"
>SET</TT
> clause). In this case,
<TT
CLASS="LITERAL"
>SELECT</TT
> rights are also required on the relation
being updated, and the appropriate <TT
CLASS="LITERAL"
>SELECT</TT
> or
<TT
CLASS="LITERAL"
>ALL</TT
> policies will be applied in addition to
the <TT
CLASS="LITERAL"
>UPDATE</TT
> policies. Thus the user must have
access to the row(s) being updated through a <TT
CLASS="LITERAL"
>SELECT</TT
>
or <TT
CLASS="LITERAL"
>ALL</TT
> policy in addition to being granted
permission to update the row(s) via an <TT
CLASS="LITERAL"
>UPDATE</TT
>
or <TT
CLASS="LITERAL"
>ALL</TT
> policy.
</P
><P
> When an <TT
CLASS="LITERAL"
>INSERT</TT
> command has an auxiliary
<TT
CLASS="LITERAL"
>ON CONFLICT DO UPDATE</TT
> clause, if the
<TT
CLASS="LITERAL"
>UPDATE</TT
> path is taken, the row to be updated is
first checked against the <TT
CLASS="LITERAL"
>USING</TT
> expressions of
any <TT
CLASS="LITERAL"
>UPDATE</TT
> policies, and then the new updated row
is checked against the <TT
CLASS="LITERAL"
>WITH CHECK</TT
> expressions.
Note, however, that unlike a standalone <TT
CLASS="LITERAL"
>UPDATE</TT
>
command, if the existing row does not pass the
<TT
CLASS="LITERAL"
>USING</TT
> expressions, an error will be thrown (the
<TT
CLASS="LITERAL"
>UPDATE</TT
> path will <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>never</I
></SPAN
> be silently
avoided).
</P
></DD
><DT
><A
NAME="SQL-CREATEPOLICY-DELETE"
></A
><TT
CLASS="LITERAL"
>DELETE</TT
></DT
><DD
><P
> Using <TT
CLASS="LITERAL"
>DELETE</TT
> for a policy means that it will apply
to <TT
CLASS="LITERAL"
>DELETE</TT
> commands. Only rows that pass this
policy will be seen by a <TT
CLASS="LITERAL"
>DELETE</TT
> command. There can
be rows that are visible through a <TT
CLASS="LITERAL"
>SELECT</TT
> that are
not available for deletion, if they do not pass the
<TT
CLASS="LITERAL"
>USING</TT
> expression for
the <TT
CLASS="LITERAL"
>DELETE</TT
> policy.
</P
><P
> In most cases a <TT
CLASS="LITERAL"
>DELETE</TT
> command also needs to read
data from columns in the relation that it is deleting from (e.g.,
in a <TT
CLASS="LITERAL"
>WHERE</TT
> clause or a
<TT
CLASS="LITERAL"
>RETURNING</TT
> clause). In this case,
<TT
CLASS="LITERAL"
>SELECT</TT
> rights are also required on the relation,
and the appropriate <TT
CLASS="LITERAL"
>SELECT</TT
> or
<TT
CLASS="LITERAL"
>ALL</TT
> policies will be applied in addition to
the <TT
CLASS="LITERAL"
>DELETE</TT
> policies. Thus the user must have
access to the row(s) being deleted through a <TT
CLASS="LITERAL"
>SELECT</TT
>
or <TT
CLASS="LITERAL"
>ALL</TT
> policy in addition to being granted
permission to delete the row(s) via a <TT
CLASS="LITERAL"
>DELETE</TT
> or
<TT
CLASS="LITERAL"
>ALL</TT
> policy.
</P
><P
> A <TT
CLASS="LITERAL"
>DELETE</TT
> policy cannot have a <TT
CLASS="LITERAL"
>WITH
CHECK</TT
> expression, as it only applies in cases where
records are being deleted from the relation, so that there is no
new row to check.
</P
></DD
></DL
></DIV
><DIV
CLASS="TABLE"
><A
NAME="SQL-CREATEPOLICY-SUMMARY"
></A
><P
><B
>Table 1. Policies Applied by Command Type</B
></P
><TABLE
BORDER="1"
CLASS="CALSTABLE"
><COL><COL><COL><COL
WIDTH="1*"
TITLE="update-using"><COL
WIDTH="1*"
TITLE="update-check"><COL><THEAD
><TR
><TH
ROWSPAN="2"
>Command</TH
><TH
><TT
CLASS="LITERAL"
>SELECT/ALL policy</TT
></TH
><TH
><TT
CLASS="LITERAL"
>INSERT/ALL policy</TT
></TH
><TH
COLSPAN="2"
><TT
CLASS="LITERAL"
>UPDATE/ALL policy</TT
></TH
><TH
><TT
CLASS="LITERAL"
>DELETE/ALL policy</TT
></TH
></TR
><TR
><TH
><TT
CLASS="LITERAL"
>USING expression</TT
></TH
><TH
><TT
CLASS="LITERAL"
>WITH CHECK expression</TT
></TH
><TH
><TT
CLASS="LITERAL"
>USING expression</TT
></TH
><TH
><TT
CLASS="LITERAL"
>WITH CHECK expression</TT
></TH
><TH
><TT
CLASS="LITERAL"
>USING expression</TT
></TH
></TR
></THEAD
><TBODY
><TR
><TD
><TT
CLASS="COMMAND"
>SELECT</TT
></TD
><TD
>Existing row</TD
><TD
>—</TD
><TD
>—</TD
><TD
>—</TD
><TD
>—</TD
></TR
><TR
><TD
><TT
CLASS="COMMAND"
>SELECT FOR UPDATE/SHARE</TT
></TD
><TD
>Existing row</TD
><TD
>—</TD
><TD
>Existing row</TD
><TD
>—</TD
><TD
>—</TD
></TR
><TR
><TD
><TT
CLASS="COMMAND"
>INSERT</TT
></TD
><TD
>—</TD
><TD
>New row</TD
><TD
>—</TD
><TD
>—</TD
><TD
>—</TD
></TR
><TR
><TD
><TT
CLASS="COMMAND"
>INSERT ... RETURNING</TT
></TD
><TD
> New row <A
NAME="RLS-SELECT-PRIV"
HREF="#FTN.RLS-SELECT-PRIV"
><SPAN
CLASS="footnote"
>[a]</SPAN
></A
>
</TD
><TD
>New row</TD
><TD
>—</TD
><TD
>—</TD
><TD
>—</TD
></TR
><TR
><TD
><TT
CLASS="COMMAND"
>UPDATE</TT
></TD
><TD
> Existing & new rows <A
HREF="sql-createpolicy.html#FTN.RLS-SELECT-PRIV"
><SPAN
CLASS="footnote"
>[a]</SPAN
></A
>
</TD
><TD
>—</TD
><TD
>Existing row</TD
><TD
>New row</TD
><TD
>—</TD
></TR
><TR
><TD
><TT
CLASS="COMMAND"
>DELETE</TT
></TD
><TD
> Existing row <A
HREF="sql-createpolicy.html#FTN.RLS-SELECT-PRIV"
><SPAN
CLASS="footnote"
>[a]</SPAN
></A
>
</TD
><TD
>—</TD
><TD
>—</TD
><TD
>—</TD
><TD
>Existing row</TD
></TR
><TR
><TD
><TT
CLASS="COMMAND"
>ON CONFLICT DO UPDATE</TT
></TD
><TD
>Existing & new rows</TD
><TD
>—</TD
><TD
>Existing row</TD
><TD
>New row</TD
><TD
>—</TD
></TR
></TBODY
><TR
><TD
COLSPAN="6"
>Notes:<BR><A
NAME="FTN.RLS-SELECT-PRIV"
>a. </A
> If read access is required to the existing or new row (for example,
a <TT
CLASS="LITERAL"
>WHERE</TT
> or <TT
CLASS="LITERAL"
>RETURNING</TT
> clause
that refers to columns from the relation).
<BR></TD
></TR
></TABLE
></DIV
></DIV
><DIV
CLASS="REFSECT2"
><A
NAME="AEN82028"
></A
><H3
>Application of Multiple Policies</H3
><P
> When multiple policies of different command types apply to the same command
(for example, <TT
CLASS="LITERAL"
>SELECT</TT
> and <TT
CLASS="LITERAL"
>UPDATE</TT
>
policies applied to an <TT
CLASS="LITERAL"
>UPDATE</TT
> command), then the user
must have both types of permissions (for example, permission to select rows
from the relation as well as permission to update them). Thus the
expressions for one type of policy are combined with the expressions for
the other type of policy using the <TT
CLASS="LITERAL"
>AND</TT
> operator.
</P
><P
> When multiple policies of the same command type apply to the same command,
then at least one of the policies must grant access to the relation. Thus
the expressions from all the policies of that type are combined using the
<TT
CLASS="LITERAL"
>OR</TT
> operator. If there are no applicable policies, then
access is denied.
</P
><P
> Note that, for the purposes of combining multiple policies,
<TT
CLASS="LITERAL"
>ALL</TT
> policies are treated as having the same type as
whichever other type of policy is being applied.
</P
><P
> For example, in an <TT
CLASS="LITERAL"
>UPDATE</TT
> command requiring both
<TT
CLASS="LITERAL"
>SELECT</TT
> and <TT
CLASS="LITERAL"
>UPDATE</TT
> permissions, if
there are multiple applicable policies of each type, they will be combined
as follows:
</P><PRE
CLASS="PROGRAMLISTING"
>(
<TT
CLASS="REPLACEABLE"
><I
>expression</I
></TT
> from SELECT/ALL policy 1
OR
<TT
CLASS="REPLACEABLE"
><I
>expression</I
></TT
> from SELECT/ALL policy 2
OR
...
)
AND
(
<TT
CLASS="REPLACEABLE"
><I
>expression</I
></TT
> from UPDATE/ALL policy 1
OR
<TT
CLASS="REPLACEABLE"
><I
>expression</I
></TT
> from UPDATE/ALL policy 2
OR
...
)</PRE
><P>
</P
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN82048"
></A
><H2
>Notes</H2
><P
> You must be the owner of a table to create or change policies for it.
</P
><P
> While policies will be applied for explicit queries against tables
in the database, they are not applied when the system is performing internal
referential integrity checks or validating constraints. This means there are
indirect ways to determine that a given value exists. An example of this is
attempting to insert a duplicate value into a column that is a primary key
or has a unique constraint. If the insert fails then the user can infer that
the value already exists. (This example assumes that the user is permitted by
policy to insert records which they are not allowed to see.) Another example
is where a user is allowed to insert into a table which references another,
otherwise hidden table. Existence can be determined by the user inserting
values into the referencing table, where success would indicate that the
value exists in the referenced table. These issues can be addressed by
carefully crafting policies to prevent users from being able to insert,
delete, or update records at all which might possibly indicate a value they
are not otherwise able to see, or by using generated values (e.g., surrogate
keys) instead of keys with external meanings.
</P
><P
> Generally, the system will enforce filter conditions imposed using
security policies prior to qualifications that appear in user queries,
in order to prevent inadvertent exposure of the protected data to
user-defined functions which might not be trustworthy. However,
functions and operators marked by the system (or the system
administrator) as <TT
CLASS="LITERAL"
>LEAKPROOF</TT
> may be evaluated before
policy expressions, as they are assumed to be trustworthy.
</P
><P
> Since policy expressions
are added to the user's query directly, they will be run with the rights of
the user running the overall query. Therefore, users who are using a given
policy must be able to access any tables or functions referenced in the
expression or they will simply receive a permission denied error when
attempting to query the table that has row-level security enabled.
This does not change how views
work, however. As with normal queries and views, permission checks and
policies for the tables which are referenced by a view will use the view
owner's rights and any policies which apply to the view owner.
</P
><P
> Additional discussion and practical examples can be found
in <A
HREF="ddl-rowsecurity.html"
>Section 5.7</A
>.
</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN82057"
></A
><H2
>Compatibility</H2
><P
> <TT
CLASS="COMMAND"
>CREATE POLICY</TT
> is a <SPAN
CLASS="PRODUCTNAME"
>PostgreSQL</SPAN
>
extension.
</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN82062"
></A
><H2
>See Also</H2
><A
HREF="sql-alterpolicy.html"
>ALTER POLICY</A
>, <A
HREF="sql-droppolicy.html"
>DROP POLICY</A
>, <A
HREF="sql-altertable.html"
>ALTER TABLE</A
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="sql-createopfamily.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="sql-createrole.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>CREATE OPERATOR FAMILY</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="sql-commands.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>CREATE ROLE</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>
distrib
>
Mageia
>
7
>
armv7hl
>
media
>
core-updates
>
by-pkgid
>
5fea23694c765462b86d6ddf74461eab
>
files
>
812
