Ensure Row Level Security (RLS) is configured correctly

中级别 1人工审核postgres

说明

In addition to the SQL-standard privilege system available through GRANT, tables can have row security policies that restrict, on a per-user basis, which individual rows can be returned by normal queries or inserted, updated, or deleted by data modification commands. This feature is also known as Row Level Security (RLS).

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Determine which tables need row level security, then run SELECT oid, relname, relrowsecurity FROM pg_class WHERE relrowsecurity IS TRUE; Any table that requires RLS but is missing from the result (or lacks policies, see \d+ <table>) is a fail.

修复方式

修复方法: 操作指南或基础设施补丁

ALTER TABLE <table> ENABLE ROW LEVEL SECURITY; then CREATE POLICY ... for each required access rule, and confirm roles that must obey RLS do not have BYPASSRLS.

属性

操作系统: 任意
标签: postgresdatabaseauthorizationmanual
参考: CIS PostgreSQL 18 Benchmark v1.0.0 - 4.7 Ensure Row Level Security (RLS) is configured correctly