Best way to implement this is to use column privilege and security group together.
GRANT ... update(<column_name>..) on <table_name> to ....
The post is long because I am trying to demonstrate it with steps and examples. Otherwise its simple few steps.
Demo Scenario
Experiment table: pgvpd
Experiment schema: demo_schema
Admin User(full privilege on expriment table): postgres
General user (restricted access on necessary column): demo_user.
Table
select current_user;
create table demo_schema.pgvpd(txt varchar(10),createat date,updateat date);
insert into demo_schema.pgvpd values('one',current_date,current_date);
select * from demo_schema.pgvpd;
Output:
postgres=# select current_user;
current_user
--------------
postgres
(1 row)
postgres=# create table demo_schema.pgvpd(txt varchar(10),createat date,updateat date);
CREATE TABLE
postgres=# insert into demo_schema.pgvpd values('one',current_date,current_date);
INSERT 0 1
postgres=# select * from demo_schema.pgvpd;
txt | createat | updateat
-----+------------+------------
one | 2022-02-06 | 2022-02-06
(1 row)
General User
create user demo_user password 'demo_user' valid until 'infinity';
Output:
postgres=# create user demo_user password 'demo_user' valid until 'infinity';
CREATE ROLE
Revoke the table from general availability and verify
revoke all on demo_schema.pgvpd from public;
set session authorization demo_user;
select current_user;
select * from demo_schema.pgvpd;
Output:
postgres=# revoke all on demo_schema.pgvpd from public;
REVOKE
postgres=# set session authorization demo_user;
SET
postgres=> select current_user;
current_user
--------------
demo_user
(1 row)
postgres=> select * from demo_schema.pgvpd;
ERROR: permission denied for schema demo_schema
LINE 1: select * from demo_schema.pgvpd;
Create two security groups one for Admin (all privilege) and one for the needed restriction. Note: the all important piece ...update(txt) -> update is allowed only on 'txt' column, not on the date columns.
create group general_users;
grant usage on schema demo_schema to group general_users;
grant select,delete,insert,update(txt) on demo_schema.pgvpd to group general_users;
alter group general_users add user demo_user;
create group admin_users;
grant usage on schema demo_schema to group admin_users;
grant all on demo_schema.pgvpd to admin_users;
alter group admin_users add user postgres;
Output:
postgres=# create group general_users;
CREATE ROLE
postgres=# grant usage on schema demo_schema to group general_users;
GRANT
postgres=# grant select,delete,insert,update(txt) on demo_schema.pgvpd to group general_users;
GRANT
postgres=# alter group general_users add user demo_user;
ALTER ROLE
postgres=# create group admin_users;
CREATE ROLE
postgres=# grant usage on schema demo_schema to group admin_users;
GRANT
postgres=# grant all on demo_schema.pgvpd to admin_users;
GRANT
postgres=# alter group admin_users add user postgres;
ALTER ROLE
Verify the update on the column that needs protection is NOT ALLOWED for the general user but allowed for admin user.
For General User:
set session authorization demo_user;
select current_user;
select * from demo_schema.pgvpd;
insert into demo_schema.pgvpd values('two',current_date,current_date);
select * from demo_schema.pgvpd;
update demo_schema.pgvpd set txt = 'two again' where txt='two';
select * from demo_schema.pgvpd;
update demo_schema.pgvpd set createat = current_date where txt='two';
Output:
postgres=# set session authorization demo_user;
SET
postgres=> select current_user;
current_user
--------------
demo_user
(1 row)
postgres=> select * from demo_schema.pgvpd;
txt | createat | updateat
-----+------------+------------
one | 2022-02-06 | 2022-02-06
(1 row)
postgres=> insert into demo_schema.pgvpd values('two',current_date,current_date);
INSERT 0 1
postgres=> select * from demo_schema.pgvpd;
txt | createat | updateat
-----+------------+------------
one | 2022-02-06 | 2022-02-06
two | 2022-02-06 | 2022-02-06
(2 rows)
postgres=> update demo_schema.pgvpd set txt = 'two again' where txt='two';
UPDATE 1
postgres=> select * from demo_schema.pgvpd;
txt | createat | updateat
-----------+------------+------------
one | 2022-02-06 | 2022-02-06
two again | 2022-02-06 | 2022-02-06
(2 rows)
postgres=> update demo_schema.pgvpd set createat = current_date where txt='two';
ERROR: permission denied for table pgvpd
For admin user:
postgres=> set session authorization postgres;
SET
postgres=# select current_user;
current_user
--------------
postgres
(1 row)
postgres=# update demo_schema.pgvpd set createat = current_date where txt='two again';
UPDATE 1
Advice: Keep the number of Triggers as low as possible on production tables and also perfectly tuned for performance. Triggers are overhead on production tables for every DML that executes on it.
Edit: 7th February 2022 Demonstration through Row Level Security Policy.
Step 1: Create & populate the table with test data.
create table posts
(
id serial primary key,
created_at timestamp,
updated_at timestamp
);
grant all on posts to public;
grant all on posts_id_seq to public;
insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
select pg_catalog.pg_sleep(10);
insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
Step 2: Enable row level security policy.
alter table posts enable row level security;
Step 3: Create a permissive policy for SELECT,INSERT,DELETE.
create policy posts_insert on posts for insert with check(true);
create policy posts_delete on posts for delete using(true);
create policy posts_select on posts for select using(true);
Step 4: Create the function that returns TRUE or FALSE for the permissive policy for UPDATE.
create or replace function posts_update_check(id_new int,updated_at_new timestamp, created_at_new timestamp)
returns boolean
language plpgsql
as
$$
declare
row_variable posts%rowtype;
flag boolean;
begin
flag := true;
select * from posts into row_variable where id=id_new;
if (row_variable.updated_at != updated_at_new or row_variable.created_at != created_at_new)
then flag := false;
end if;
return flag;
end; $$;
Step 5: Create the final all important permission policy for UPDATE.
create policy posts_update on posts for update using(true) with check(posts_update_check(id,updated_at,created_at));
Step 6: Run test as non-owner of the table.
set session authorization demo_user;
select current_user;
select * from posts;
insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
select pg_catalog.pg_sleep(5);
insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
select * from posts;
delete from posts where id= 1;
update posts set id=1 where id=2;
update posts set created_at = current_timestamp where id=1;
update posts set updated_at = current_timestamp where id=1;
Trail:
postgres=# create table posts
postgres-# (
postgres(# id serial primary key,
postgres(# created_at timestamp,
postgres(# updated_at timestamp
postgres(# );
CREATE TABLE
postgres=# grant all on posts to public;
GRANT
postgres=# grant all on posts_id_seq to public;
GRANT
postgres=#
postgres=#
postgres=# insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
INSERT 0 1
postgres=# select pg_catalog.pg_sleep(10);
pg_sleep
----------
(1 row)
postgres=# insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
INSERT 0 1
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=# alter table posts enable row level security;
ALTER TABLE
postgres=#
postgres=#
postgres=#
postgres=# create policy posts_insert on posts for insert with check(true);
CREATE POLICY
postgres=# create policy posts_delete on posts for delete using(true);
CREATE POLICY
postgres=# create policy posts_select on posts for select using(true);
CREATE POLICY
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=# create or replace function posts_update_check(id_new int,updated_at_new timestamp, created_at_new timestamp)
postgres-# returns boolean
postgres-# language plpgsql
postgres-# as
postgres-# $$
postgres$# declare
postgres$# row_variable posts%rowtype;
postgres$# flag boolean;
postgres$# begin
postgres$# flag := true;
postgres$# select * from posts into row_variable where id=id_new;
postgres$# if (row_variable.updated_at != updated_at_new or row_variable.created_at != created_at_new)
postgres$#
postgres$# then flag := false;
postgres$# end if;
postgres$# return flag;
postgres$# end; $$;
CREATE FUNCTION
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=# create policy posts_update on posts for update using(true) with check(posts_update_check(id,updated_at,created_at));
CREATE POLICY
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=#
postgres=# set session authorization demo_user;
SET
postgres=> select current_user;
current_user
--------------
demo_user
(1 row)
postgres=> select * from posts;
id | created_at | updated_at
----+----------------------------+----------------------------
1 | 2022-02-08 08:32:41.527004 | 2022-02-08 08:32:41.527004
2 | 2022-02-08 08:32:51.536821 | 2022-02-08 08:32:51.536821
(2 rows)
postgres=> insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
INSERT 0 1
postgres=> select pg_catalog.pg_sleep(5);
pg_sleep
----------
(1 row)
postgres=> insert into posts(created_at,updated_at) values(current_timestamp,current_timestamp);
INSERT 0 1
postgres=> select * from posts;
id | created_at | updated_at
----+----------------------------+----------------------------
1 | 2022-02-08 08:32:41.527004 | 2022-02-08 08:32:41.527004
2 | 2022-02-08 08:32:51.536821 | 2022-02-08 08:32:51.536821
3 | 2022-02-08 08:33:41.400015 | 2022-02-08 08:33:41.400015
4 | 2022-02-08 08:33:46.411654 | 2022-02-08 08:33:46.411654
(4 rows)
postgres=> delete from posts where id= 1;
DELETE 1
postgres=> update posts set id=1 where id=2;
UPDATE 1
postgres=> update posts set created_at = current_timestamp where id=1;
ERROR: new row violates row-level security policy for table "posts"
postgres=> update posts set updated_at = current_timestamp where id=1;
ERROR: new row violates row-level security policy for table "posts"
postgres=>
Edit 2: 7th February 2022 , demonstrating the impact of triggers.
Set up:
Identical tables
Posts - have security rules
Posts_1 - have triggers
Both freshly created tables with identical rows.
posts:
postgres=> \d posts
Table "public.posts"
Column | Type | Collation | Nullable | Default
------------+-----------------------------+-----------+----------+-----------------------------------
id | integer | | not null | nextval('posts_id_seq'::regclass)
created_at | timestamp without time zone | | |
updated_at | timestamp without time zone | | |
Indexes:
"posts_pkey" PRIMARY KEY, btree (id)
Policies (forced row security enabled):
POLICY "posts_delete" FOR DELETE
USING (true)
POLICY "posts_insert" FOR INSERT
WITH CHECK (true)
POLICY "posts_select" FOR SELECT
USING (true)
POLICY "posts_update" FOR UPDATE
USING (true)
WITH CHECK (posts_update_check(id, updated_at, created_at))
postgres=> select * from posts;
id | created_at | updated_at
----+----------------------------+----------------------------
8 | 2022-02-08 16:23:20.48457 | 2022-02-08 16:23:20.48457
9 | 2022-02-08 16:23:30.501669 | 2022-02-08 16:23:30.501669
(2 rows)
posts_1:
postgres=> \d posts_1
Table "public.posts_1"
Column | Type | Collation | Nullable | Default
------------+-----------------------------+-----------+----------+-------------------------------------
id | integer | | not null | nextval('posts_1_id_seq'::regclass)
created_at | timestamp without time zone | | |
updated_at | timestamp without time zone | | |
Indexes:
"posts_1_pkey" PRIMARY KEY, btree (id)
Triggers:
on_posts_1_update BEFORE UPDATE ON posts_1 FOR EACH ROW EXECUTE FUNCTION posts_1_created_at()
postgres=> select * from posts_1;
id | created_at | updated_at
----+----------------------------+----------------------------
3 | 2022-02-08 16:17:11.792555 | 2022-02-08 16:17:11.792555
4 | 2022-02-08 16:17:21.800956 | 2022-02-08 16:17:21.800956
(2 rows)
Performance Comparison on posts and posts_1
posts (policy based)
postgres=> explain (analyze,timing,buffers) update posts_1 set id=80 where id=8;
QUERY PLAN
--------------------------------------------------------------------------------------------------------
Update on posts_1 (cost=0.00..1.02 rows=1 width=26) (actual time=0.017..0.020 rows=0 loops=1)
Buffers: shared hit=1
-> Seq Scan on posts_1 (cost=0.00..1.02 rows=1 width=26) (actual time=0.014..0.015 rows=0 loops=1)
Filter: (id = 8)
Rows Removed by Filter: 2
Buffers: shared hit=1
Planning Time: 0.076 ms
Execution Time: 0.054 ms
(8 rows)
posts_1 (trigger based)
postgres=> explain (analyze,timing,buffers) update posts_1 set id=40 where id=4;
QUERY PLAN
--------------------------------------------------------------------------------------------------------
Update on posts_1 (cost=0.00..1.02 rows=1 width=26) (actual time=0.112..0.115 rows=0 loops=1)
Buffers: shared hit=3 read=1 dirtied=2
-> Seq Scan on posts_1 (cost=0.00..1.02 rows=1 width=26) (actual time=0.015..0.017 rows=1 loops=1)
Filter: (id = 4)
Rows Removed by Filter: 1
Buffers: shared hit=1
Planning Time: 0.075 ms
Trigger on_posts_1_update: time=0.033 calls=1
Execution Time: 0.150 ms
(9 rows)
The difference in the execution plan is the extra line for the trigger.
Trigger on_posts_1_update: time=0.033 calls=1
I believe even the policy has to execute code but it appears triggers are more costly.
However, trade-off can be ignored if the amount of updates and the latency introduced through trigger is acceptable. You can really discern it through benchmarking.