Improve RLS documentation with respect to COPY

Documentation for pg_restore said COPY TO does not support row security
when in fact it should say COPY FROM. Fix that.

While at it, make it clear that "COPY FROM" does not allow RLS to be
enabled and INSERT should be used instead. Also that SELECT policies
will apply to COPY TO statements.

Back-patch to 9.5 where RLS first appeared.

Author: Joe Conway
Reviewed-By: Dean Rasheed and Robert Haas
Discussion: https://postgr.es/m/5744FA24.3030008%40joeconway.com

diff --git a/doc/src/sgml/ref/copy.sgml b/doc/src/sgml/ref/copy.sgml
index 2477a872e88558d9f8ebcc7eabdf9c0280ae7e04..7ff62f2a821d0af81e6193fb00efef87f93668c7 100644 (file)
--- a/doc/src/sgml/ref/copy.sgml
+++ b/doc/src/sgml/ref/copy.sgml
@@ -424,6 +424,15 @@ COPY <replaceable class="parameter">count</replaceable>
     to have column privileges on the column(s) listed in the command.
    </para>
 
+   <para>
+    If row-level security is enabled for the table, the relevant 
+    <command>SELECT</command> policies will apply to <literal>COPY
+    <replaceable class="parameter">table</> TO</literal> statements.
+    Currently, <command>COPY FROM</command> is not supported for tables
+    with row-level security. Use equivalent <command>INSERT</command>
+    statements instead.
+   </para>
+
    <para>
     Files named in a <command>COPY</command> command are read or written
     directly by the server, not by the client application. Therefore,

diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgml
index f6225d23c800f4e2ef540c7caacba3475d427d25..b70e7d57e95725622ed7124eaddb89b705bf04c3 100644 (file)
--- a/doc/src/sgml/ref/pg_dump.sgml
+++ b/doc/src/sgml/ref/pg_dump.sgml
@@ -718,6 +718,11 @@ PostgreSQL documentation
         to dump the parts of the contents of the table that they have access to.
        </para>
 
+       <para>
+        Note that if you use this option currently, you probably also want
+        the dump be in <command>INSERT</command> format, as the
+        <command>COPY FROM</command> during restore does not support row security.
+       </para>
       </listitem>
      </varlistentry>
 

diff --git a/doc/src/sgml/ref/pg_restore.sgml b/doc/src/sgml/ref/pg_restore.sgml
index bd5b405314529d13b37155fab4679ebec6f78fee..44f051506618bc426fbfd453b56925f15593a421 100644 (file)
--- a/doc/src/sgml/ref/pg_restore.sgml
+++ b/doc/src/sgml/ref/pg_restore.sgml
@@ -543,7 +543,7 @@
 
        <para>
         Note that this option currently also requires the dump be in <command>INSERT</command>
-        format, as <command>COPY TO</command> does not support row security.
+        format, as <command>COPY FROM</command> does not support row security.
        </para>
       </listitem>
      </varlistentry>