Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sql: Skip RLS policies when table is access for FK relationship and unique/PK constraints #136747

Open
Tracked by #73596
spilchen opened this issue Dec 4, 2024 · 0 comments · May be fixed by #143079
Open
Tracked by #73596

sql: Skip RLS policies when table is access for FK relationship and unique/PK constraints #136747

spilchen opened this issue Dec 4, 2024 · 0 comments · May be fixed by #143079
Assignees
@spilchen
Labels
A-sql-privileges SQL privilege handling and permission checks. C-enhancement Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception) T-sql-foundations SQL Foundations Team (formerly SQL Schema + SQL Sessions)

Comments

@spilchen
Copy link
Contributor

spilchen commented Dec 4, 2024 •
edited by cockroach-jira-scripts
Loading

If a table has a foreign key relationship, row-level security (RLS) policies should not be applied when reading from or writing to the target table during foreign key-related operations.

It is currently unclear whether any changes are needed to ensure this behavior, as it may already work as intended. If no changes are required, this issue will focus on adding tests to verify that RLS policies do not interfere with foreign key-related queries.

Jira issue: CRDB-45228
@spilchen spilchen added C-enhancement Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception) T-sql-foundations SQL Foundations Team (formerly SQL Schema + SQL Sessions) labels Dec 4, 2024
@spilchen spilchen mentioned this issue Dec 5, 2024
Open
35 tasks
@spilchen spilchen added the A-sql-privileges SQL privilege handling and permission checks. label Dec 5, 2024
@exalate-issue-sync exalate-issue-sync bot changed the title sql: Prevent use of RLS when table is access for FK relationship sql: Skip RLS policies when table is access for FK relationship Dec 11, 2024
@exalate-issue-sync exalate-issue-sync bot changed the title sql: Skip RLS policies when table is access for FK relationship sql: Skip RLS policies when table is access for FK relationship and unique/PK constraints Jan 20, 2025
spilchen added a commit to spilchen/cockroach that referenced this issue Mar 18, 2025
@spilchen
sql: validate RLS policy exemptions for constraints
029e549 
Unique and foreign key constraints on tables with row-level security
(RLS) enabled are exempt from RLS policies when enforcing constraints.
This exemption was implemented previously. This commit adds tests to
validate that RLS policies do not interfere with constraint enforcement.

Closes cockroachdb#136747

Epic: CRDB-45203
Release note: none
spilchen added a commit to spilchen/cockroach that referenced this issue Mar 18, 2025
@spilchen
sql: validate RLS policy exemptions for constraints
2ead183 
Unique and foreign key constraints on tables with row-level security
(RLS) enabled are exempt from RLS policies when enforcing constraints.
This exemption was implemented previously. This commit adds tests to
validate that RLS policies do not interfere with constraint enforcement.

Closes cockroachdb#136747

Epic: CRDB-45203
Release note: none
@spilchen spilchen linked a pull request Mar 18, 2025 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@spilchen spilchen

Labels
A-sql-privileges SQL privilege handling and permission checks. C-enhancement Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception) T-sql-foundations SQL Foundations Team (formerly SQL Schema + SQL Sessions)
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

sql: validate RLS policy exemptions for constraints spilchen/cockroach
1 participant
@spilchen