From: Tom Lane <tgl@sss.pgh.pa.us>
To: Igor Korot <ikorot01@gmail.com>
Cc: pgsql-general <pgsql-general@postgresql.org>
Subject: Re: Fwd: Log file
Date: Mon, 29 Oct 2018 17:08:55 -0400
Message-ID: <23733.1540847335@sss.pgh.pa.us> (raw)
In-Reply-To: <CA+FnnTwb4V++4WRQj1vCBQ0Pb_NPR3pxjJgyGpuCXHOhFuXpmQ@mail.gmail.com>
References: <CA+FnnTy4b=gSVw+dJwijoiFoeQNQMKZq65feupZgJh4-uuyKVQ@mail.gmail.com>
<CA+FnnTw5Z=XoV=GyeC0-x85Q_MdJ0+hr6UD1Y5=NByG4SfzxyQ@mail.gmail.com>
<18469.1540839366@sss.pgh.pa.us>
<CA+FnnTwb4V++4WRQj1vCBQ0Pb_NPR3pxjJgyGpuCXHOhFuXpmQ@mail.gmail.com>
Igor Korot <ikorot01@gmail.com> writes:
> On Mon, Oct 29, 2018 at 1:56 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> You can set up the log files as readable by the OS group of the server
>> (see log_file_mode), and then grant membership in that group to whichever
>> OS accounts you trust. You may also need to move the log directory
>> out from under $PGDATA to make that work, since PG doesn't like
>> world-readable data directories.
> I'm trying to make the log file of PG readable of the user who logs in
> to the current
> OS session. I don't need a write permission, just read.
> Because my program will not be started from the "postgres" account.
Well, any such setup is a serious security hole in itself, because
there is likely to be sensitive data in the postmaster log, eg
passwords. (Remember that the log file is global to the whole cluster,
it will not contain just data relevant to the current session.)
You should only grant access to people who you trust at more or less
the level of trust you'd put in the installation DBA.
It may be that these concerns are all irrelevant to you because it's
a single-user installation anyway, but they're not irrelevant to
people running multi-user installations. So that's why you can't
get Postgres to do it. In a single-user installation, maybe you
should just launch the postmaster as that user.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: tgl@sss.pgh.pa.us, ikorot01@gmail.com
Subject: Re: Fwd: Log file
In-Reply-To: <23733.1540847335@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox