pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedpg_rewind: ERROR: could not fetch remote file "global/pg_control": ERROR: permission denied
2+ messages / 2 participants
[nested] [flat]
* pg_rewind: ERROR: could not fetch remote file "global/pg_control": ERROR: permission denied
@ 2023-09-26 02:39 Zhaoxun Yan <yan.zhaoxun@gmail.com>
0 siblings, 1 reply; 2+ messages in thread
From: Zhaoxun Yan @ 2023-09-26 02:39 UTC (permalink / raw)
To: Pgsql-admin <pgsql-admin@lists.postgresql.org>
I came across this error notice when trying to execute pg_rewind through
repmgr's old primary demotion to standby after recovery. (the old standby @
192.168.1.2 has already executed repmgr standby promote)
https://serverfault.com/questions/1144242
postgres version=15.4 repmgr version=5.4dev and the command to execute such
process and the following feedback are these:
repmgr node rejoin --force-rewind -d 'host=192.168.1.2 port=5432
user=rep dbname=repmgr connect_timeout=5'
NOTICE: rejoin target is node "yzx2" (ID: 2)
NOTICE: pg_rewind execution required for this node to attach to rejoin
target node 2
DETAIL: rejoin target server's timeline 2 forked off current database
system timeline 1 before current recovery point 0/81C6D80
NOTICE: executing pg_rewind
DETAIL: pg_rewind command is "/usr/pgsql-15/bin/pg_rewind -D '/pgdata'
--source-server='host=192.168.1.2 port=5432 user=rep dbname=repmgr
connect_timeout=5'"
ERROR: pg_rewind execution failed
DETAIL: pg_rewind: error: could not fetch remote file
"global/pg_control": ERROR: permission denied for function
pg_read_binary_file
Actually I have grant function pg_read_binary_file's execution right to the
user rep, and here are the setup for this role:
CREATE EXTENSION repmgr;
GRANT pg_checkpoint TO rep;
GRANT pg_read_all_stats TO rep;
GRANT EXECUTE ON function pg_catalog.pg_ls_dir(text, boolean, boolean) TO rep;
GRANT EXECUTE ON function pg_catalog.pg_stat_file(text, boolean) TO rep;
GRANT EXECUTE ON function pg_catalog.pg_read_binary_file(text) TO rep;
GRANT EXECUTE ON function pg_catalog.pg_read_binary_file(text, bigint,
bigint, boolean
I re-grant the right again using GRANT EXECUTE ON function
pg_read_binary_file(text) TO rep;, and it made no difference. It is not
that the user rep does not have the right to execute the function, but that
the function has no right to fetch remote file "global/pg_control"? BTW, I
did not give ssh right to access postgres Linux account on another server
for security reasons.
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: pg_rewind: ERROR: could not fetch remote file "global/pg_control": ERROR: permission denied
@ 2023-09-27 08:06 Alvaro Herrera <alvherre@alvh.no-ip.org>
parent: Zhaoxun Yan <yan.zhaoxun@gmail.com>
0 siblings, 0 replies; 2+ messages in thread
From: Alvaro Herrera @ 2023-09-27 08:06 UTC (permalink / raw)
To: Zhaoxun Yan <yan.zhaoxun@gmail.com>; +Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
On 2023-Sep-26, Zhaoxun Yan wrote:
> Actually I have grant function pg_read_binary_file's execution right to the
> user rep, and here are the setup for this role:
>
> CREATE EXTENSION repmgr;
> GRANT pg_checkpoint TO rep;
> GRANT pg_read_all_stats TO rep;
> GRANT EXECUTE ON function pg_catalog.pg_ls_dir(text, boolean, boolean) TO rep;
> GRANT EXECUTE ON function pg_catalog.pg_stat_file(text, boolean) TO rep;
> GRANT EXECUTE ON function pg_catalog.pg_read_binary_file(text) TO rep;
> GRANT EXECUTE ON function pg_catalog.pg_read_binary_file(text, bigint,
> bigint, boolean
Maybe you did this in the wrong database? Keep in mind that function
privileges are per database.
--
Álvaro Herrera PostgreSQL Developer — https://www.EnterpriseDB.com/
"People get annoyed when you try to debug them." (Larry Wall)
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2023-09-27 08:06 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2023-09-26 02:39 pg_rewind: ERROR: could not fetch remote file "global/pg_control": ERROR: permission denied Zhaoxun Yan <yan.zhaoxun@gmail.com>
2023-09-27 08:06 ` Alvaro Herrera <alvherre@alvh.no-ip.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox