From: Tom Lane <tgl@sss.pgh.pa.us>
To: David Steele <david@pgmasters.net>
cc: "Suralkar, Yogendra (Yogendra)" <suralkary@avaya.com>,
        "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>,
        "Porob, Dattaram (Datta)" <porobd@avaya.com>,
        "Oswal,
    Prashant (Prashant) **CTR**" <poswal@avaya.com>,
        "Patil,
    Parag (Parag)" <paragp@avaya.com>,
        "Devaraj,
    Sankar (Sankar)" <devarajs@avaya.com>,
        "Singh,
    Payal (Payal) **CTR**" <payals@avaya.com>
Subject: Re: Unable to connect to PostgreSQL DB as root user when private key
 is owned by root with permission 640
In-reply-to: <2af73dd7-6ea2-b5f2-9b35-76e6a8f2a54a@pgmasters.net>
References: 
 <MW3PR15MB3931DF96896DC36D21AFD47CA3D39@MW3PR15MB3931.namprd15.prod.outlook.com>
 <335500.1653058186@sss.pgh.pa.us> <1719047.1653422732@sss.pgh.pa.us>
 <2af73dd7-6ea2-b5f2-9b35-76e6a8f2a54a@pgmasters.net>
Comments: In-reply-to David Steele <david@pgmasters.net>
	message dated "Tue, 24 May 2022 16:33:12 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2415118.1653588981.1@sss.pgh.pa.us>
Date: Thu, 26 May 2022 14:16:21 -0400
Message-ID: <2415119.1653588981@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2415119.1653588981%40sss.pgh.pa.us>
Precedence: bulk

David Steele <david@pgmasters.net> writes:
> On 5/24/22 16:05, Tom Lane wrote:
>> After further poking at this, I see that we also have to drop the check of
>> file ownership.  That was already dropped once long ago (3405f2b9253), on
>> the grounds that if the file has suitable permissions but its ownership
>> isn't what we expect then our read attempt will fail, so we needn't check
>> ownership explicitly.  While I'd prefer a more explicit error than the
>> "Permission denied" that you get with this approach, the intent of this
>> patch was not to create any new failure modes, so I think we're stuck
>> with that.

> That makes sense. Seems I should have dug further into why the server 
> does this but the client does not.

Pushed that.

>> Open questions:
>> * This puts us back into a situation where the frontend and server tests
>> are not in sync.  Do we want to relax the server's checks to match this,
>> or just leave that side as it stands?

> I'm inclined to leave it as is in the back branches to avoid any other 
> unintended consequences. Perhaps we could make the change for PG15?

Yeah, I'm unenthused now about touching this in the back branches.
But do we want to do it in HEAD, or just leave well enough alone?

			regards, tom lane