From: Tom Lane <tgl@sss.pgh.pa.us>
To: gc.nugent66@gmail.com
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19388: Failing to connect to postgres with EACCES error
In-reply-to: <19388-c49c361739e2eb3c@postgresql.org>
References: <19388-c49c361739e2eb3c@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Fri, 23 Jan 2026 13:37:08 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3106877.1769182545.1@sss.pgh.pa.us>
Date: Fri, 23 Jan 2026 10:35:45 -0500
Message-ID: <3106878.1769182545@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3106878.1769182545%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> Running on k8s pods, I have an issue where a process cannot connect to an
> Azure Postgres server due to a permission error.
> ...
> We use standard SSL without client certificates and the running process is
> setup without a homedir for security reasons.

I'm pretty skeptical that that is a good idea, but if you are stubborn
about it you could explicitly specify "sslcert=/no/such/file" and so
on in your connection parameters.  Another way is to make the HOME
environment variable point at a directory that actually doesn't exist,
rather than one that has access restrictions.

> I noticed from the postgres source code that only ENOENT & ENOTDIR are
> allowable errors but EACCES is a fail condition.
> I understand the reasoning for checking for existence of certificates, but
> can the Permission Denied error also be treated as "Can't get client certs,
> continue to try to connect without"?

No, I don't think that would be an improvement in user experience
for most people.  If your cert isn't working and libpq fails to
tell you why not, debugging that could be pretty unpleasant.

If anything, I'd lean towards removing the special exception for
ENOTDIR ... I wonder why that's there.

			regards, tom lane