pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #19388: Failing to connect to postgres with EACCES error
4+ messages / 3 participants
[nested] [flat]
* BUG #19388: Failing to connect to postgres with EACCES error
@ 2026-01-23 13:37 PG Bug reporting form <noreply@postgresql.org>
2026-01-23 15:35 ` Re: BUG #19388: Failing to connect to postgres with EACCES error Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 4+ messages in thread
From: PG Bug reporting form @ 2026-01-23 13:37 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: gc.nugent66@gmail.com
The following bug has been logged on the website:
Bug reference: 19388
Logged by: George Nugent
Email address: gc.nugent66@gmail.com
PostgreSQL version: 17.7
Operating system: Linux
Description:
Running on k8s pods, I have an issue where a process cannot connect to an
Azure Postgres server due to a permission error.
1782279 1769097264.122469 openat(AT_FDCWD,
"/home/xxxxx/.postgresql/root.crl", O_RDONLY) = -1 EACCES (Permission
denied)
1782279 1769097264.122535 stat("/home/xxxxx/.postgresql/postgresql.crt",
0x7fcdd85a2de0) = -1 EACCES (Permission denied)
We use standard SSL without client certificates and the running process is
setup without a homedir for security reasons.
I noticed from the postgres source code that only ENOENT & ENOTDIR are
allowable errors but EACCES is a fail condition.
I understand the reasoning for checking for existence of certificates, but
can the Permission Denied error also be treated as "Can't get client certs,
continue to try to connect without"?
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #19388: Failing to connect to postgres with EACCES error
2026-01-23 13:37 BUG #19388: Failing to connect to postgres with EACCES error PG Bug reporting form <noreply@postgresql.org>
@ 2026-01-23 15:35 ` Tom Lane <tgl@sss.pgh.pa.us>
2026-01-23 20:01 ` Re: BUG #19388: Failing to connect to postgres with EACCES error Jacob Champion <jacob.champion@enterprisedb.com>
0 siblings, 1 reply; 4+ messages in thread
From: Tom Lane @ 2026-01-23 15:35 UTC (permalink / raw)
To: gc.nugent66@gmail.com; +Cc: pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> Running on k8s pods, I have an issue where a process cannot connect to an
> Azure Postgres server due to a permission error.
> ...
> We use standard SSL without client certificates and the running process is
> setup without a homedir for security reasons.
I'm pretty skeptical that that is a good idea, but if you are stubborn
about it you could explicitly specify "sslcert=/no/such/file" and so
on in your connection parameters. Another way is to make the HOME
environment variable point at a directory that actually doesn't exist,
rather than one that has access restrictions.
> I noticed from the postgres source code that only ENOENT & ENOTDIR are
> allowable errors but EACCES is a fail condition.
> I understand the reasoning for checking for existence of certificates, but
> can the Permission Denied error also be treated as "Can't get client certs,
> continue to try to connect without"?
No, I don't think that would be an improvement in user experience
for most people. If your cert isn't working and libpq fails to
tell you why not, debugging that could be pretty unpleasant.
If anything, I'd lean towards removing the special exception for
ENOTDIR ... I wonder why that's there.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #19388: Failing to connect to postgres with EACCES error
2026-01-23 13:37 BUG #19388: Failing to connect to postgres with EACCES error PG Bug reporting form <noreply@postgresql.org>
2026-01-23 15:35 ` Re: BUG #19388: Failing to connect to postgres with EACCES error Tom Lane <tgl@sss.pgh.pa.us>
@ 2026-01-23 20:01 ` Jacob Champion <jacob.champion@enterprisedb.com>
2026-01-23 20:31 ` Re: BUG #19388: Failing to connect to postgres with EACCES error Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 4+ messages in thread
From: Jacob Champion @ 2026-01-23 20:01 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: gc.nugent66@gmail.com; pgsql-bugs@lists.postgresql.org
On Fri, Jan 23, 2026 at 7:35 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> If anything, I'd lean towards removing the special exception for
> ENOTDIR ... I wonder why that's there.
I think removing that would take some adjustments to
pqGetHomeDirectory(), so that it actually checks for the existence of
that directory before returning true. `have_homedir` is kind of a
misleading name in this context.
--Jacob
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #19388: Failing to connect to postgres with EACCES error
2026-01-23 13:37 BUG #19388: Failing to connect to postgres with EACCES error PG Bug reporting form <noreply@postgresql.org>
2026-01-23 15:35 ` Re: BUG #19388: Failing to connect to postgres with EACCES error Tom Lane <tgl@sss.pgh.pa.us>
2026-01-23 20:01 ` Re: BUG #19388: Failing to connect to postgres with EACCES error Jacob Champion <jacob.champion@enterprisedb.com>
@ 2026-01-23 20:31 ` Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 4+ messages in thread
From: Tom Lane @ 2026-01-23 20:31 UTC (permalink / raw)
To: Jacob Champion <jacob.champion@enterprisedb.com>; +Cc: gc.nugent66@gmail.com; pgsql-bugs@lists.postgresql.org
Jacob Champion <jacob.champion@enterprisedb.com> writes:
> On Fri, Jan 23, 2026 at 7:35 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> If anything, I'd lean towards removing the special exception for
>> ENOTDIR ... I wonder why that's there.
> I think removing that would take some adjustments to
> pqGetHomeDirectory(), so that it actually checks for the existence of
> that directory before returning true. `have_homedir` is kind of a
> misleading name in this context.
I dug into our git history and traced the appearance of ENOTDIR to
commit 5b40677986984d450a2a16e515fe44d90dfeef02
Author: Magnus Hagander <magnus@hagander.net>
Date: Sat Dec 3 15:02:53 2011 +0100
Treat ENOTDIR as ENOENT when looking for client certificate file
This makes it possible to use a libpq app with home directory set
to /dev/null, for example - treating it the same as if the file
doesn't exist (which it doesn't).
Per bug #6302, reported by Diego Elio Petteno
We could imagine pushing the stat() test into pqGetHomeDirectory,
which might be a more sensible factorization, but I don't think
it'd move the behavior much.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2026-01-23 20:31 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-01-23 13:37 BUG #19388: Failing to connect to postgres with EACCES error PG Bug reporting form <noreply@postgresql.org>
2026-01-23 15:35 ` Tom Lane <tgl@sss.pgh.pa.us>
2026-01-23 20:01 ` Jacob Champion <jacob.champion@enterprisedb.com>
2026-01-23 20:31 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox