Ensure Row Level Security (RLS) is configured correctly

MoyenneNiveau 1Revue manuelleyugabytedb

Description

In addition to the YSQL-standard privilege system available through GRANT, tables can have row security policies that restrict, on a per-user basis, which individual rows can be returned by normal queries or inserted, updated, or deleted by data modification commands. This feature is also known as Row Level Security (RLS).

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Identify the tables that require row-level security under business policy, then run SELECT oid, relname, relrowsecurity FROM pg_class WHERE relrowsecurity IS TRUE; and review policies with SELECT * FROM pg_policies; Any table that should be RLS-protected but is missing, or whose policies do not restrict rows as intended, is a finding.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

In this example, we are using the using the example passwd table. We will create three database roles to illustrate the workings of RLS: yugabyte=# CREATE ROLE admin; CREATE ROLE yugabyte=# CREATE ROLE bob; CREATE ROLE yugabyte=# CREATE ROLE alice; CREATE ROLE Now, we will insert known data into the passwd table: yugabyte=# INSERT INTO passwd VALUES ('admin','xxx',0,0,'Admin','111-222-3333',null,'/root','/bin/dash');

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: yugabytedbprivileges
Référence: CIS YugabyteDB Benchmark v2.0.0 - 4.5 Ensure Row Level Security (RLS) is configured correctly