pgpool2.git / summary / log / commit / refs

commit    ffd6bfa8c212090e3681d7959b8ec84d42070cd9
Author:   Muhammad Usama <m.usama@gmail.com>
Date:     Tue Oct 30 12:40:37 2018 +0000

    Allow ssl key files to be owned by users other than us and root.
    
    Pgpool-II inherited this from PostgreSQL, which imposes this restriction on
    ssl key files for security reasons, but this doesn't makes much sense in case of
    Pgpool-II because for many setups Pgpool-II would share the ssl certificates and
    key files with PostgreSQL while running from a different OS user.


 src/utils/pool_ssl.c | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/src/utils/pool_ssl.c b/src/utils/pool_ssl.c
index 5845497d5..db1983b46 100644
--- a/src/utils/pool_ssl.c
+++ b/src/utils/pool_ssl.c
@@ -574,21 +574,6 @@ SSL_ServerSide_init(void)
 		goto error;
 	}
 
-	/*
-	 * Refuse to load key files owned by users other than us or root.
-	 *
-	 * XXX surely we can check this on Windows somehow, too.
-	 */
-#if !defined(WIN32) && !defined(__CYGWIN__)
-	if (buf.st_uid != geteuid() && buf.st_uid != 0)
-	{
-		ereport(WARNING,
-				(errmsg("private key file \"%s\" must be owned by the Pgpool-II user or root",
-						pool_config->ssl_key)));
-		goto error;
-	}
-#endif
-
 	/*
 	 * Require no public access to key file. If the file is owned by us,
 	 * require mode 0600 or less. If owned by root, require 0640 or less to
@@ -608,7 +593,6 @@ SSL_ServerSide_init(void)
 				(errmsg("private key file \"%s\" has group or world access",
 						pool_config->ssl_key),
 				 errdetail("File must have permissions u=rw (0600) or less if owned by the Pgpool-II user, or permissions u=rw,g=r (0640) or less if owned by root.")));
-		goto error;
 	}
 #endif
 


[parent: 988f421c6beb]