From: Tom Lane <tgl@sss.pgh.pa.us>
To: "Suralkar, Yogendra (Yogendra)" <suralkary@avaya.com>
cc: "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>,
        David Steele <david@pgmasters.net>,
        "Porob, Dattaram (Datta)" <porobd@avaya.com>,
        "Oswal,
    Prashant (Prashant)
 **CTR**" <poswal@avaya.com>,
        "Patil,
    Parag (Parag)" <paragp@avaya.com>,
        "Devaraj,
    Sankar (Sankar)" <devarajs@avaya.com>,
        "Singh,
    Payal (Payal) **CTR**" <payals@avaya.com>
Subject: Re: Unable to connect to PostgreSQL DB as root user when private key
 is owned by root with permission 640
In-reply-to: 
 <MW3PR15MB3931DF96896DC36D21AFD47CA3D39@MW3PR15MB3931.namprd15.prod.outlook.com>
References: 
 <MW3PR15MB3931DF96896DC36D21AFD47CA3D39@MW3PR15MB3931.namprd15.prod.outlook.com>
Comments: In-reply-to "Suralkar, Yogendra (Yogendra)" <suralkary@avaya.com>
	message dated "Fri, 20 May 2022 05:53:11 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <335499.1653058186.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 20 May 2022 10:49:46 -0400
Message-ID: <335500.1653058186@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/335500.1653058186%40sss.pgh.pa.us>
Precedence: bulk

"Suralkar, Yogendra (Yogendra)" <suralkary@avaya.com> writes:
> Recently we updated to PostgreSQL 13.7 (Please see list of rpms used bel=
ow).
> After update we have noticed an issue when connecting to Database as 'ro=
ot' user when private key file is owned by root and has permission 640.

TBH, my immediate reaction is "what are you doing running database
accesses as root?".  But given that you are, I see the problem: the test
is coded like

        if ((buf.st_uid =3D=3D geteuid() && buf.st_mode & (S_IRWXG | S_IRW=
XO)) ||
            (buf.st_uid =3D=3D 0 && buf.st_mode & (S_IWGRP | S_IXGRP | S_I=
RWXO)))

which was copied verbatim from the equivalent test in the backend.
However, in the backend it's safe to assume that geteuid() !=3D 0.
libpq apparently shouldn't assume that, meaning that the two arms
of the if aren't disjoint cases anymore, and it matters which one
we check first.

The repeat call of geteuid() is a waste of cycles anyway, so maybe better
like

        if (buf.st_uid !=3D 0 ?
            buf.st_mode & (S_IRWXG | S_IRWXO) :
            buf.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO))

This feels kind of wrong, in that root's privacy check is now strictly
weaker than anyone else's, but root ought to know what she's doing anyway.

			regards, tom lane