Message-ID: <13e3100fc7c7d14919c37943dcfd76b263cecce2.camel@cybertec.at>
Subject: Re: Bypassing Directory Ownership Check in PostgreSQL 16.6 with
 Secure z/OS NFS (AT-TLS)
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Amol Inamdar <amol.aai@gmail.com>, pgsql-general@lists.postgresql.org
Date: Mon, 14 Jul 2025 14:20:14 +0200
In-Reply-To: <CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com>
References: 
	<CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-1.fc42) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/13e3100fc7c7d14919c37943dcfd76b263cecce2.camel%40cybertec.at>
Precedence: bulk

On Mon, 2025-07-14 at 11:19 +0530, Amol Inamdar wrote:
> I'm currently running PostgreSQL version 16.6 inside a Docker container
> (base image: UBI 9), using Docker Compose. The PostgreSQL data directory
> is mounted from an NFS volume hosted on a z/OS NFS server.
>=20
> The environment has a few constraints:
>=20
> - It=E2=80=99s a highly secure and access-controlled setup.
> - Due to platform restrictions on z/OS, the mounted NFS directory cannot
> =C2=A0 be owned by the PostgreSQL user (e.g., `postgres`) inside the cont=
ainer.
> - As a result, PostgreSQL fails to start because of the directory
> =C2=A0 ownership validation check.

It is not a good idea to have a mount point be the data directory.
The proper solution is to create the data directory inside the
mount point.  That way, the permissions of the data directory don't
have to be the same as the permissions of the mount point.

Yours,
Laurenz Albe