pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedCould not create a tablespace - permission denied
10+ messages / 3 participants
[nested] [flat]
* Could not create a tablespace - permission denied
@ 2008-04-19 12:58 Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 10+ messages in thread
From: Graham Leggett @ 2008-04-19 12:58 UTC (permalink / raw)
To: pgsql-admin
Hi all,
While attempting to create a tablespace as the postgres user under RHEL5
with *no* SELinux enabled, I get the following error:
postgres=# CREATE TABLESPACE fma LOCATION '/home/chandler/fma/db/pgsql';
ERROR: could not set permissions on directory
"/home/chandler/fma/db/pgsql": Permission denied
The user postgres is able to access the directory, and the user postgres
is able to set permissions on the directory to 0700:
-bash-3.1$ chmod 700 /home/chandler/fma/db/pgsql
-bash-3.1$
Does anyone know what I should do to fix this?
Regards,
Graham
--
Attachments:
smime.p7s (application/x-pkcs7-signature, 3.2K) download
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Could not create a tablespace - permission denied
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
@ 2008-04-19 15:34 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 15:42 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
0 siblings, 1 reply; 10+ messages in thread
From: Tom Lane @ 2008-04-19 15:34 UTC (permalink / raw)
To: Graham Leggett <minfrin@sharp.fm>; +Cc: pgsql-admin
Graham Leggett <minfrin@sharp.fm> writes:
> While attempting to create a tablespace as the postgres user under RHEL5
> with *no* SELinux enabled, I get the following error:
> postgres=# CREATE TABLESPACE fma LOCATION '/home/chandler/fma/db/pgsql';
> ERROR: could not set permissions on directory
> "/home/chandler/fma/db/pgsql": Permission denied
> The user postgres is able to access the directory, and the user postgres
> is able to set permissions on the directory to 0700:
> -bash-3.1$ chmod 700 /home/chandler/fma/db/pgsql
If you can do that from a shell running as postgres, then I think
selinux is not so disabled as you think. Ordinary file permissions are
applied uniformly to all processes running as a given userid, but
selinux is different.
regards, tom lane
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Could not create a tablespace - permission denied
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
@ 2008-04-19 15:42 ` Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:50 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 10+ messages in thread
From: Graham Leggett @ 2008-04-19 15:42 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin
Tom Lane wrote:
> If you can do that from a shell running as postgres, then I think
> selinux is not so disabled as you think. Ordinary file permissions are
> applied uniformly to all processes running as a given userid, but
> selinux is different.
SELinux is definitely not present on this machine - it is not installed
at all.
At it turned out, the postgresql server had cached the system user
permissions, and it only started working after postgresql had been
restarted and the cached credentials had been replaced.
Regards,
Graham
--
Attachments:
smime.p7s (application/x-pkcs7-signature, 3.2K) download
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Could not create a tablespace - permission denied
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 15:42 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
@ 2008-04-19 15:50 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 16:08 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
0 siblings, 1 reply; 10+ messages in thread
From: Tom Lane @ 2008-04-19 15:50 UTC (permalink / raw)
To: Graham Leggett <minfrin@sharp.fm>; +Cc: pgsql-admin
Graham Leggett <minfrin@sharp.fm> writes:
> At it turned out, the postgresql server had cached the system user
> permissions, and it only started working after postgresql had been
> restarted and the cached credentials had been replaced.
I think this explanation is fiction ... there is no "cacheing of
credentials" in there that I know about.
Maybe the server had not been running under the userid you thought it
was? But it would have to match the ownership of the data directory,
so it's hard to see how a simple restart would fix it.
[ thinks... ] Hm, is the tablespace directory mounted over NFS?
I *have* heard of strange cacheing behaviors on NFS. In fact,
NFS has enough weirdnesses that I wouldn't recommend running a
database over it ...
regards, tom lane
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Could not create a tablespace - permission denied
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 15:42 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:50 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
@ 2008-04-19 16:08 ` Graham Leggett <minfrin@sharp.fm>
2008-04-19 16:14 ` Re: Could not create a tablespace - permission denied Joshua D. Drake <jd@commandprompt.com>
2008-04-19 16:17 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 2 replies; 10+ messages in thread
From: Graham Leggett @ 2008-04-19 16:08 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin
Tom Lane wrote:
> I think this explanation is fiction ... there is no "cacheing of
> credentials" in there that I know about.
>
> Maybe the server had not been running under the userid you thought it
> was? But it would have to match the ownership of the data directory,
> so it's hard to see how a simple restart would fix it.
>
> [ thinks... ] Hm, is the tablespace directory mounted over NFS?
> I *have* heard of strange cacheing behaviors on NFS. In fact,
> NFS has enough weirdnesses that I wouldn't recommend running a
> database over it ...
The server is a standard REHL5 installed copy of postgresql, running as
the postgres user (as is standard on RHE5). Both the data directory and
the tablespace are running on ext3 filesystems local to the machine,
there are no NFS mounts anywhere. The machine does not have SELinux
installed, never mind enabled.
After the postgres user was granted permission to access the tablespace
directory, and after it was verified that the postgres user was able to
access the tablespace directory, postgresql refused to allow the
tablespace to be created until the postgresql server was restarted.
Regards,
Graham
--
Attachments:
smime.p7s (application/x-pkcs7-signature, 3.2K) download
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Could not create a tablespace - permission denied
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 15:42 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:50 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 16:08 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
@ 2008-04-19 16:14 ` Joshua D. Drake <jd@commandprompt.com>
2008-04-19 18:21 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
1 sibling, 1 reply; 10+ messages in thread
From: Joshua D. Drake @ 2008-04-19 16:14 UTC (permalink / raw)
To: Graham Leggett <minfrin@sharp.fm>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
Graham Leggett wrote:
> After the postgres user was granted permission to access the tablespace
> directory, and after it was verified that the postgres user was able to
> access the tablespace directory, postgresql refused to allow the
> tablespace to be created until the postgresql server was restarted.
I am pretty sure you are missing something. I can not reproduce your issue:
jd@scratch:~$ mkdir /tmp/foo
jd@scratch:~$ psql -U postgres
postgres=# \h create tablespace
Command: CREATE TABLESPACE
Description: define a new tablespace
Syntax:
CREATE TABLESPACE tablespacename [ OWNER username ] LOCATION 'directory'
postgres=# create tablespace foobar location '/tmp/foo';
ERROR: could not set permissions on directory "/tmp/foo": Operation not
permitted
postgres=#
[1]+ Stopped psql -U postgres
jd@scratch:~$ sudo su -
[sudo] password for jd:
root@scratch:~# chown postgres:postgres /tmp/foo
root@scratch:~# exit
logout
jd@scratch:~$ fg
psql -U postgres
postgres=# create tablespace foobar location '/tmp/foo';
CREATE TABLESPACE
postgres=#
But I am glad your problem is resolved.
Joshua D. Drake
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Could not create a tablespace - permission denied
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 15:42 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:50 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 16:08 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 16:14 ` Re: Could not create a tablespace - permission denied Joshua D. Drake <jd@commandprompt.com>
@ 2008-04-19 18:21 ` Graham Leggett <minfrin@sharp.fm>
2008-04-19 18:51 ` Re: Could not create a tablespace - permission denied Joshua D. Drake <jd@commandprompt.com>
0 siblings, 1 reply; 10+ messages in thread
From: Graham Leggett @ 2008-04-19 18:21 UTC (permalink / raw)
To: Joshua D. Drake <jd@commandprompt.com>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
Joshua D. Drake wrote:
> I am pretty sure you are missing something. I can not reproduce your issue:
Do it like this:
- mkdir /tmp/foo
- chown user:user /tmp/foo
- edit /etc/group and add postgres to the group user
- attempt to access /tmp/foo as the user postgres, at this point a user
logged in as postgres will be able to access the directory.
- attempt to create a tablespace on /tmp/foo, this will fail until
postgresql is restarted, after which the attempt will succeed.
Regards,
Graham
--
Attachments:
smime.p7s (application/x-pkcs7-signature, 3.2K) download
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Could not create a tablespace - permission denied
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 15:42 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:50 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 16:08 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 16:14 ` Re: Could not create a tablespace - permission denied Joshua D. Drake <jd@commandprompt.com>
2008-04-19 18:21 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
@ 2008-04-19 18:51 ` Joshua D. Drake <jd@commandprompt.com>
2008-04-19 21:11 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 10+ messages in thread
From: Joshua D. Drake @ 2008-04-19 18:51 UTC (permalink / raw)
To: Graham Leggett <minfrin@sharp.fm>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
Graham Leggett wrote:
> Joshua D. Drake wrote:
>
>> I am pretty sure you are missing something. I can not reproduce your
>> issue:
>
> Do it like this:
>
> - mkdir /tmp/foo
> - chown user:user /tmp/foo
> - edit /etc/group and add postgres to the group user
Aha! there it is. Adding a user to a group doesn't mean anything until
that user reinitializes the environment. That is why restarting
postgresql resolves the issue. When postgresql is started, is actually
launches a new shell as the user and the fact that they are part of the
group is picked up.
Sincerely,
Joshua D. Drake
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Could not create a tablespace - permission denied
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 15:42 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:50 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 16:08 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 16:14 ` Re: Could not create a tablespace - permission denied Joshua D. Drake <jd@commandprompt.com>
2008-04-19 18:21 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 18:51 ` Re: Could not create a tablespace - permission denied Joshua D. Drake <jd@commandprompt.com>
@ 2008-04-19 21:11 ` Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 10+ messages in thread
From: Tom Lane @ 2008-04-19 21:11 UTC (permalink / raw)
To: Joshua D. Drake <jd@commandprompt.com>; +Cc: Graham Leggett <minfrin@sharp.fm>; pgsql-admin
"Joshua D. Drake" <jd@commandprompt.com> writes:
> Graham Leggett wrote:
>> - edit /etc/group and add postgres to the group user
> Aha! there it is. Adding a user to a group doesn't mean anything until
> that user reinitializes the environment.
In particular, it looks like the list of groups you belong to is
typically only computed at login time (or equivalently su -l, which
is what's happening in the postgres init script), and then just
inherited by all processes launched from that login. So there is
caching of a sort going on here, but it's in the kernel and there's
nothing we can do about it.
regards, tom lane
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Could not create a tablespace - permission denied
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 15:42 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:50 ` Re: Could not create a tablespace - permission denied Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 16:08 ` Re: Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
@ 2008-04-19 16:17 ` Tom Lane <tgl@sss.pgh.pa.us>
1 sibling, 0 replies; 10+ messages in thread
From: Tom Lane @ 2008-04-19 16:17 UTC (permalink / raw)
To: Graham Leggett <minfrin@sharp.fm>; +Cc: pgsql-admin
Graham Leggett <minfrin@sharp.fm> writes:
> Tom Lane wrote:
>> I think this explanation is fiction ... there is no "cacheing of
>> credentials" in there that I know about.
> The server is a standard REHL5 installed copy of postgresql, running as
> the postgres user (as is standard on RHE5). Both the data directory and
> the tablespace are running on ext3 filesystems local to the machine,
> there are no NFS mounts anywhere. The machine does not have SELinux
> installed, never mind enabled.
> After the postgres user was granted permission to access the tablespace
> directory, and after it was verified that the postgres user was able to
> access the tablespace directory, postgresql refused to allow the
> tablespace to be created until the postgresql server was restarted.
Fascinating. I think what you're describing must be a kernel bug ---
want to see if you can reproduce it without PG involved? Just make a
test program that chmod's, sleeps awhile, and chmod's again, and
manually change the permissions while it's sleeping, in the same way
that you did in the problem case.
regards, tom lane
^ permalink raw reply [nested|flat] 10+ messages in thread
end of thread, other threads:[~2008-04-19 21:11 UTC | newest]
Thread overview: 10+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2008-04-19 12:58 Could not create a tablespace - permission denied Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:34 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 15:42 ` Graham Leggett <minfrin@sharp.fm>
2008-04-19 15:50 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 16:08 ` Graham Leggett <minfrin@sharp.fm>
2008-04-19 16:14 ` Joshua D. Drake <jd@commandprompt.com>
2008-04-19 18:21 ` Graham Leggett <minfrin@sharp.fm>
2008-04-19 18:51 ` Joshua D. Drake <jd@commandprompt.com>
2008-04-19 21:11 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-04-19 16:17 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox