Message-ID: <0b3fb11184bf9ce6516ed1aa08af5dddc924f21c.camel@cybertec.at>
Subject: Re: Bypassing Directory Ownership Check in PostgreSQL 16.6 with
 Secure z/OS NFS (AT-TLS)
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Amol Inamdar <amol.aai@gmail.com>
Cc: pgsql-general@lists.postgresql.org
Date: Mon, 14 Jul 2025 21:44:19 +0900
In-Reply-To: <CAGOe9RijT-5X=UoeGv_TeW=KVVV9xvBBSwY9V-a=n_8GyzdRDA@mail.gmail.com>
References: 
	<CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com>
	 <13e3100fc7c7d14919c37943dcfd76b263cecce2.camel@cybertec.at>
	 <CAGOe9RijT-5X=UoeGv_TeW=KVVV9xvBBSwY9V-a=n_8GyzdRDA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-1.fc42) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/0b3fb11184bf9ce6516ed1aa08af5dddc924f21c.camel%40cybertec.at>
Precedence: bulk

On Mon, 2025-07-14 at 17:59 +0530, Amol Inamdar wrote:
> If I am not mistaken, below is my understanding of your suggestion.=C2=A0
>=20
> Suppose that My mount point on the NFS server is say /nfs-mount/postgres/=
=C2=A0
> and you are suggesting to have a data directory as say /nfs-mount/postgre=
s/db or something like=C2=A0that ?=C2=A0
> and assign this value to the PGDATA ?=C2=A0
>=20
> If that is the case, then when and who should be creating the directory D=
B ?=C2=A0
>=20
> Please correct me if I am wrong about the understanding.

You understood me perfectly well.

The data directory can either be created by "initdb", in which case
the mount point must allow the PostgreSQL user to create a directory.
You could set the group of the mount point to the group of the
PostgreSQL user and use permissions 1770, which should be perfectly safe.

Alternatively, the root user could create the data directory with the
correct ownership and permissions prior to running "initdb".

Yours,
Laurenz Albe