agora inbox for pgsql-bugs@postgresql.org
help / color / mirror / Atom feedFrom: Tom Lane <tgl@sss.pgh.pa.us>
To: Álvaro Herrera <alvherre@kurilemu.de>
Cc: Daniel Gustafsson <daniel@yesql.se>
Cc: scherbakov_lo_radarmms@mail.ru
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19610: Database won't start if an unrelated process is exist
Date: Wed, 12 Aug 2026 08:51:41 -0400
Message-ID: <2622434.1786539101@sss.pgh.pa.us> (raw)
In-Reply-To: <ansmw5aeWQikOu2k@alvherre.pgsql>
References: <ansmw5aeWQikOu2k@alvherre.pgsql>
=?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@kurilemu.de> writes:
> Well, I'm not sure this is really intended. I'd say it's rather
> emergent behavior from what we can do, which is to inquiry whether a
> process with that PID exist or not; and if it does, we assume it's the
> postmaster and give up. But maybe there are ways to verify whether it's
> really a postmaster that indeed corresponds to that .pid file; so that
> if we can determine it's not, then the .pid file is stale and we can
> remove it and move on.
We already check that the PID belongs to our own UID, and is not our
parent or grandparent. I doubt there is more that we can do portably.
We've already expended a bunch of sweat in this direction,
eg commit 8f5500e6b.
To my mind, this false-positive is only likely to happen if you have
a bunch of unrelated stuff getting run under the same UID, which is
already a security problem of the first magnitude. Don't do that:
create a dedicated UID for each Postgres instance you plan to run.
> If we get it wrong, the user ends up with corrupt data which definitely
> is not nice.
Yeah. Erring in the direction of thinking it's safe when it isn't
is far worse than erring in this direction.
regards, tom lane
view thread (2+ messages)
Message-ID: <2622434.1786539101@sss.pgh.pa.us>
Permalink: ../2622434.1786539101@sss.pgh.pa.us/
Also on: postgresql.org/message-id/2622434.1786539101@sss.pgh.pa.us
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, alvherre@kurilemu.de, daniel@yesql.se, scherbakov_lo_radarmms@mail.ru, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19610: Database won't start if an unrelated process is exist
In-Reply-To: <2622434.1786539101@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox