row_security_policy_hook_permissive

Description

hooks to allow extensions to add their own security policies row_security_policy_hook_permissive can be used to add policies which are combined with the other permissive policies, using OR. row_security_policy_hook_restrictive can be used to add policies which are enforced, regardless of other policies (they are combined using AND).

Interface type

row_security_policy_hook_type

Header

src/include/rewrite/rowsecurity.h

Subsystem

Permissions and object access

Initial value

NULL (no hook installed)

C interface

typedef List *(*row_security_policy_hook_type) (CmdType cmdtype, Relation relation);
extern PGDLLIMPORT row_security_policy_hook_type row_security_policy_hook_permissive;

Call sites

src/backend/rewrite/rowsecurity.c:644

Core call context: src/backend/rewrite/rowsecurity.c:638–652

		}
	}

	if (row_security_policy_hook_permissive)
	{
		List	   *hook_policies =
			(*row_security_policy_hook_permissive) (cmd, relation);

		foreach(item, hook_policies)
		{
			RowSecurityPolicy *policy = (RowSecurityPolicy *) lfirst(item);

			if (check_role_for_policy(policy->roles, user_id))
				*permissive_policies = lappend(*permissive_policies, policy);
		}

Related entries

• Row Security Policies

Documentation and source

• Interface declaration
• Core definition
• Call sites

Related entries

• ExecutorCheckPerms_hookExecutorCheckPerms_hook
• object_access_hookobject_access_hook
• object_access_hook_strobject_access_hook_str
• row_security_policy_hook_restrictiverow_security_policy_hook_restrictive