Name
CREATE POLICY -- define a new row level security policy for a tableSynopsis
CREATE POLICY name ON table_name [ FOR { ALL | SELECT | INSERT | UPDATE | DELETE } ] [ TO { role_name | PUBLIC | CURRENT_USER | SESSION_USER } [, ...] ] [ USING ( using_expression ) ] [ WITH CHECK ( check_expression ) ]
Description
The CREATE POLICY
command defines a new row-level security policy for a table. Note that row-level security must be enabled on the table (using ALTER TABLE ... ENABLE ROW LEVEL SECURITY
) in order for created policies to be applied.
A policy grants the permission to select, insert, update, or delete rows that match the relevant policy expression. Existing table rows are checked against the expression specified in USING
, while new rows that would be created via INSERT
or UPDATE
are checked against the expression specified in WITH CHECK
. When a USING
expression returns true for a given row then that row is visible to the user, while if false or null is returned then the row is not visible. When a WITH CHECK
expression returns true for a row then that row is inserted or updated, while if false or null is returned then an error occurs.
For INSERT
and UPDATE
statements, WITH CHECK
expressions are enforced after BEFORE
triggers are fired, and before any actual data modifications are made. Thus a BEFORE ROW
trigger may modify the data to be inserted, affecting the result of the security policy check. WITH CHECK
expressions are enforced before any other constraints.
Policy names are per-table. Therefore, one policy name can be used for many different tables and have a definition for each table which is appropriate to that table.
Policies can be applied for specific commands or for specific roles. The default for newly created policies is that they apply for all commands and roles, unless otherwise specified. If multiple policies apply to a given statement, they will be combined using OR (although ON CONFLICT DO UPDATE
and INSERT
policies are not combined in this way, but rather enforced as noted at each stage of ON CONFLICT
execution).
For commands that can have both USING
and WITH CHECK
policies (ALL
and UPDATE
), if no WITH CHECK
policy is defined, then the USING
policy will be used both for which rows are visible (normal USING
case) and for which rows will be allowed to be added (WITH CHECK
case).
If row-level security is enabled for a table, but no applicable policies exist, a "default deny" policy is assumed, so that no rows will be visible or updatable.
Parameters
name
-
The name of the policy to be created. This must be distinct from the name of any other policy for the table.
table_name
-
The name (optionally schema-qualified) of the table the policy applies to.
command
-
The command to which the policy applies. Valid options are
ALL
,SELECT
,INSERT
,UPDATE
, andDELETE
.ALL
is the default. See below for specifics regarding how these are applied. role_name
-
The role(s) to which the policy is to be applied. The default is
PUBLIC
, which will apply the policy to all roles. using_expression
-
Any SQL conditional expression (returning
boolean
). The conditional expression cannot contain any aggregate or window functions. This expression will be added to queries that refer to the table if row level security is enabled. Rows for which the expression returns true will be visible. Any rows for which the expression returns false or null will not be visible to the user (in aSELECT
), and will not be available for modification (in anUPDATE
orDELETE
). Such rows are silently suppressed; no error is reported. check_expression
-
Any SQL conditional expression (returning
boolean
). The conditional expression cannot contain any aggregate or window functions. This expression will be used inINSERT
andUPDATE
queries against the table if row level security is enabled. Only rows for which the expression evaluates to true will be allowed. An error will be thrown if the expression evaluates to false or null for any of the records inserted or any of the records that result from the update. Note that thecheck_expression
is evaluated against the proposed new contents of the row, not the original contents.
Per-Command Policies
ALL
-
Using
ALL
for a policy means that it will apply to all commands, regardless of the type of command. If anALL
policy exists and more specific policies exist, then both theALL
policy and the more specific policy (or policies) will be combined using OR, as usual for overlapping policies. Additionally,ALL
policies will be applied to both the selection side of a query and the modification side, using theUSING
expression for both cases if only aUSING
expression has been defined.As an example, if an
UPDATE
is issued, then theALL
policy will be applicable both to what theUPDATE
will be able to select as rows to be updated (applying theUSING
expression), and to the resulting updated rows, to check if they are permitted to be added to the table (applying theWITH CHECK
expression, if defined, and theUSING
expression otherwise). If anINSERT
orUPDATE
command attempts to add rows to the table that do not pass theALL
policy'sWITH CHECK
expression, the entire command will be aborted. SELECT
-
Using
SELECT
for a policy means that it will apply toSELECT
queries and wheneverSELECT
permissions are required on the relation the policy is defined for. The result is that only those records from the relation that pass theSELECT
policy will be returned during aSELECT
query, and that queries that requireSELECT
permissions, such asUPDATE
, will also only see those records that are allowed by theSELECT
policy. ASELECT
policy cannot have aWITH CHECK
expression, as it only applies in cases where records are being retrieved from the relation. INSERT
-
Using
INSERT
for a policy means that it will apply toINSERT
commands. Rows being inserted that do not pass this policy will result in a policy violation error, and the entireINSERT
command will be aborted. AnINSERT
policy cannot have aUSING
expression, as it only applies in cases where records are being added to the relation.Note that
INSERT
withON CONFLICT DO UPDATE
checksINSERT
policies'WITH CHECK
expressions only for rows appended to the relation by theINSERT
path. UPDATE
-
Using
UPDATE
for a policy means that it will apply toUPDATE
commands (or auxiliaryON CONFLICT DO UPDATE
clauses ofINSERT
commands). SinceUPDATE
involves pulling an existing record and then making changes to some portion (but possibly not all) of the record,UPDATE
policies accept both aUSING
expression and aWITH CHECK
expression. TheUSING
expression determines which records theUPDATE
command will see to operate against, while theWITH CHECK
expression defines which modified rows are allowed to be stored back into the relation.When an
UPDATE
command is used with aWHERE
clause or aRETURNING
clause,SELECT
rights are also required on the relation being updated and the appropriateSELECT
andALL
policies will be combined (using OR for any overlappingSELECT
related policies found) with theUSING
clause of theUPDATE
policy using AND. Therefore, in order for a user to be able toUPDATE
specific rows, the user must have access to the row(s) through aSELECT
orALL
policy and the row(s) must pass theUPDATE
policy'sUSING
expression.Any rows whose updated values do not pass the
WITH CHECK
expression will cause an error, and the entire command will be aborted. If only aUSING
clause is specified, then that clause will be used for bothUSING
andWITH CHECK
cases.Note, however, that
INSERT
withON CONFLICT DO UPDATE
requires that anUPDATE
policyUSING
expression always be enforced as aWITH CHECK
expression. ThisUPDATE
policy must always pass when theUPDATE
path is taken. Any existing row that necessitates that theUPDATE
path be taken must pass the (UPDATE
orALL
)USING
qualifications (combined using OR), which are always enforced asWITH CHECK
options in this context. (TheUPDATE
path will never be silently avoided; an error will be thrown instead.) Finally, the final row appended to the relation must pass anyWITH CHECK
options that a conventionalUPDATE
is required to pass. DELETE
-
Using
DELETE
for a policy means that it will apply toDELETE
commands. Only rows that pass this policy will be seen by aDELETE
command. There can be rows that are visible through aSELECT
that are not available for deletion, if they do not pass theUSING
expression for theDELETE
policy.When a
DELETE
command is used with aWHERE
clause or aRETURNING
clause,SELECT
rights are also required on the relation being updated and the appropriateSELECT
andALL
policies will be combined (using OR for any overlappingSELECT
related policies found) with theUSING
clause of theDELETE
policy using AND. Therefore, in order for a user to be able toDELETE
specific rows, the user must have access to the row(s) through aSELECT
orALL
policy and the row(s) must pass theDELETE
policy'sUSING
expression.A
DELETE
policy cannot have aWITH CHECK
expression, as it only applies in cases where records are being deleted from the relation, so that there is no new row to check.
Notes
You must be the owner of a table to create or change policies for it.
While policies will be applied for explicit queries against tables in the database, they are not applied when the system is performing internal referential integrity checks or validating constraints. This means there are indirect ways to determine that a given value exists. An example of this is attempting to insert a duplicate value into a column that is a primary key or has a unique constraint. If the insert fails then the user can infer that the value already exists. (This example assumes that the user is permitted by policy to insert records which they are not allowed to see.) Another example is where a user is allowed to insert into a table which references another, otherwise hidden table. Existence can be determined by the user inserting values into the referencing table, where success would indicate that the value exists in the referenced table. These issues can be addressed by carefully crafting policies to prevent users from being able to insert, delete, or update records at all which might possibly indicate a value they are not otherwise able to see, or by using generated values (e.g., surrogate keys) instead of keys with external meanings.
Generally, the system will enforce filter conditions imposed using security policies prior to qualifications that appear in user queries, in order to prevent inadvertent exposure of the protected data to user-defined functions which might not be trustworthy. However, functions and operators marked by the system (or the system administrator) as LEAKPROOF
may be evaluated before policy expressions, as they are assumed to be trustworthy.
Since policy expressions are added to the user's query directly, they will be run with the rights of the user running the overall query. Therefore, users who are using a given policy must be able to access any tables or functions referenced in the expression or they will simply receive a permission denied error when attempting to query the table that has row-level security enabled. This does not change how views work, however. As with normal queries and views, permission checks and policies for the tables which are referenced by a view will use the view owner's rights and any policies which apply to the view owner.
Additional discussion and practical examples can be found in Section 5.7.
Compatibility
CREATE POLICY
is a PostgreSQL extension.
Please login to continue.