Ensure Row Level Security (RLS) is configured correctly

MediaNivel 1Revisión manualyugabytedb

Descripción

In addition to the YSQL-standard privilege system available through GRANT, tables can have row security policies that restrict, on a per-user basis, which individual rows can be returned by normal queries or inserted, updated, or deleted by data modification commands. This feature is also known as Row Level Security (RLS).

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Identify the tables that require row-level security under business policy, then run SELECT oid, relname, relrowsecurity FROM pg_class WHERE relrowsecurity IS TRUE; and review policies with SELECT * FROM pg_policies; Any table that should be RLS-protected but is missing, or whose policies do not restrict rows as intended, is a finding.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

In this example, we are using the using the example passwd table. We will create three database roles to illustrate the workings of RLS: yugabyte=# CREATE ROLE admin; CREATE ROLE yugabyte=# CREATE ROLE bob; CREATE ROLE yugabyte=# CREATE ROLE alice; CREATE ROLE Now, we will insert known data into the passwd table: yugabyte=# INSERT INTO passwd VALUES ('admin','xxx',0,0,'Admin','111-222-3333',null,'/root','/bin/dash');

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: yugabytedbprivileges
Referencia: CIS YugabyteDB Benchmark v2.0.0 - 4.5 Ensure Row Level Security (RLS) is configured correctly