row-level-securitylisted

PostgreSQL's Row-Level Security (RLS) — `CREATE POLICY` / `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` / policy application in the rewriter — plus the related security-barrier machinery + leakproof qualification checks. Loads when the user asks about RLS policy semantics (USING vs WITH CHECK, PERMISSIVE vs RESTRICTIVE), how policies are applied to a query at rewrite time, why a qual can/cannot be pushed below a security barrier, the leakproof function attribute, ROLE mapping for BYPASSRLS / NOFORCERLS, `row_security` GUC, or debugging why an RLS policy is/isn't firing. Also covers security-barrier views (`WITH (security_barrier = true)`), which use the same qual-pushdown-prohibition machinery. Skip when the ask is about pg_hba.conf-level authentication, GRANT/REVOKE table-level privileges, SELinux (`sepgsql`), or database-level security features unrelated to per-row visibility.
matejformanek/postgres-claude · ★ 0 · AI & Automation · score 70

Install: claude install-skill matejformanek/postgres-claude

# row-level-security — RLS policies + security barriers + leakproof Row-Level Security lets a table's owner attach `POLICY` rules that filter which rows a user can SELECT/UPDATE/DELETE. The rules are applied at **rewrite time** (before the planner runs), so RLS-filtered rows never even reach the executor. But that only works if the planner can't accidentally leak filtered-out row content by pushing untrusted qualifications below the RLS filter — hence the **security-barrier** infrastructure and the **leakproof** function attribute. Three interlocking mechanisms: 1. **Policies** (`commands/policy.c` + `rewrite/rowsecurity.c`) — the catalog + rewriter side. 2. **Security-barrier views** (`WITH (security_barrier = true)`, in `rewrite/rewriteHandler.c` + planner) — same qual-pushdown-prohibition applied to a view. 3. **Leakproof functions** — an attribute on `pg_proc` rows that lets the planner push a qual through a security barrier if the function can't leak information via error messages or timing. ## The file map | File | KB | Role | |---|---:|---| | `commands/policy.c` | 35 | The `CREATE POLICY` / `ALTER POLICY` / `DROP POLICY` DDL implementation. Manages `pg_policy` catalog rows. | | `rewrite/rowsecurity.c` | 30 | Rewriter integration. `get_row_security_policies` builds the USING + WITH CHECK quals to inject into the query. Called from `rewriteHandler.c` for every RTE. | | `utils/misc/rls.c` | 5 | Helpers: `check_role_for_policy`, `row_security` GUC handling. | | `catal