Skip to content

Add mdb_rls regression test for mdb_superuser RLS interaction - #106

Open
reshke wants to merge 1 commit into
MDB_18_6_prestablefrom
mdb_rls
Open

Add mdb_rls regression test for mdb_superuser RLS interaction#106
reshke wants to merge 1 commit into
MDB_18_6_prestablefrom
mdb_rls

Conversation

@reshke

@reshke reshke commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

mdb_superuser bypasses RLS via object_ownercheck() in check_enable_rls(), which uses has_privs_of_role() to determine ownership. This test verifies:

  1. A plain role sees only RLS-filtered rows.
  2. mdb_superuser bypasses RLS entirely (treated as table owner).
  3. With FORCE ROW LEVEL SECURITY, mdb_superuser is subject to RLS but still matches any policy via the rowsecurity.c bypass.

mdb_superuser bypasses RLS via object_ownercheck() in check_enable_rls(),
which uses has_privs_of_role() to determine ownership.  This
test verifies:

  1. A plain role sees only RLS-filtered rows.
  2. mdb_superuser bypasses RLS entirely (treated as table owner).
  3. With FORCE ROW LEVEL SECURITY, mdb_superuser is subject to RLS but
     still matches any policy via the rowsecurity.c bypass.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant