From: Tom Lane <tgl@sss.pgh.pa.us>
To: =?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@kurilemu.de>
cc: Daniel Gustafsson <daniel@yesql.se>, scherbakov_lo_radarmms@mail.ru,
        pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19610: Database won't start if an unrelated process is exist
In-reply-to: <ansmw5aeWQikOu2k@alvherre.pgsql>
References: <ansmw5aeWQikOu2k@alvherre.pgsql>
Comments: In-reply-to =?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@kurilemu.de>
	message dated "Wed, 12 Aug 2026 13:26:14 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2622433.1786539101.1@sss.pgh.pa.us>
Date: Wed, 12 Aug 2026 08:51:41 -0400
Message-ID: <2622434.1786539101@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2622434.1786539101%40sss.pgh.pa.us>
Precedence: bulk

=?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@kurilemu.de> writes:
> Well, I'm not sure this is really intended.  I'd say it's rather
> emergent behavior from what we can do, which is to inquiry whether a
> process with that PID exist or not; and if it does, we assume it's the
> postmaster and give up.  But maybe there are ways to verify whether it's
> really a postmaster that indeed corresponds to that .pid file; so that
> if we can determine it's not, then the .pid file is stale and we can
> remove it and move on.

We already check that the PID belongs to our own UID, and is not our
parent or grandparent.  I doubt there is more that we can do portably.
We've already expended a bunch of sweat in this direction,
eg commit 8f5500e6b.

To my mind, this false-positive is only likely to happen if you have
a bunch of unrelated stuff getting run under the same UID, which is
already a security problem of the first magnitude.  Don't do that:
create a dedicated UID for each Postgres instance you plan to run.

> If we get it wrong, the user ends up with corrupt data which definitely
> is not nice.

Yeah.  Erring in the direction of thinking it's safe when it isn't
is far worse than erring in this direction.

			regards, tom lane