Apply SELECT policies in INSERT/UPDATE+RETURNING

Similar to 7d8db3e, given that INSERT+RETURNING requires SELECT rights
on the table, apply the SELECT policies as WCOs to the tuples being
inserted.  Apply the same logic to UPDATE+RETURNING.

Back-patch to 9.5 where RLS was added.

diff --git a/src/backend/rewrite/rowsecurity.c b/src/backend/rewrite/rowsecurity.c
index 3d7f7a3a18b6b1267fa73f8c28f9ac941aa888ff..eebc493849f8e9c5cf0a13dba1690cae4565d4d9 100644 (file)
--- a/src/backend/rewrite/rowsecurity.c
+++ b/src/backend/rewrite/rowsecurity.c
@@ -271,6 +271,30 @@ get_row_security_policies(Query *root, RangeTblEntry *rte, int rt_index,
                               withCheckOptions,
                               hasSubLinks);
 
+       /*
+        * Get and add ALL/SELECT policies, if SELECT rights are required
+        * for this relation (eg: when RETURNING is used).  These are added as
+        * WCO policies rather than security quals to ensure that an error is
+        * raised if a policy is violated; otherwise, we might end up silently
+        * dropping rows to be added.
+        */
+       if (rte->requiredPerms & ACL_SELECT)
+       {
+           List       *select_permissive_policies = NIL;
+           List       *select_restrictive_policies = NIL;
+
+           get_policies_for_relation(rel, CMD_SELECT, user_id,
+                                     &select_permissive_policies,
+                                     &select_restrictive_policies);
+           add_with_check_options(rel, rt_index,
+                                  commandType == CMD_INSERT ?
+                                  WCO_RLS_INSERT_CHECK : WCO_RLS_UPDATE_CHECK,
+                                  select_permissive_policies,
+                                  select_restrictive_policies,
+                                  withCheckOptions,
+                                  hasSubLinks);
+       }
+
        /*
         * For INSERT ... ON CONFLICT DO UPDATE we need additional policy
         * checks for the UPDATE which may be applied to the same RTE.
@@ -300,9 +324,11 @@ get_row_security_policies(Query *root, RangeTblEntry *rte, int rt_index,
                                   hasSubLinks);
 
            /*
-            * Get and add ALL/SELECT policies, if SELECT rights are required
-            * for this relation, also as WCO policies, again, to avoid
-            * silently dropping data.  See above.
+            * Get and add ALL/SELECT policies, as WCO_RLS_CONFLICT_CHECK
+            * WCOs to ensure they are considered when taking the UPDATE
+            * path of an INSERT .. ON CONFLICT DO UPDATE, if SELECT
+            * rights are required for this relation, also as WCO policies,
+            * again, to avoid silently dropping data.  See above.
             */
            if (rte->requiredPerms & ACL_SELECT)
            {