Message-ID: <62b420e1c9500c68c1bc135810d4cf9f3289fb8c.camel@cybertec.at>
Subject: Re: Bypassing Directory Ownership Check in PostgreSQL 16.6 with
 Secure z/OS NFS (AT-TLS)
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Amol Inamdar <amol.aai@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-general@lists.postgresql.org
Date: Wed, 16 Jul 2025 17:48:10 +0200
In-Reply-To: <CAGOe9RiBSEZo3c8akePA+11HmV1JHx0Lsk57-fGfM0DEf4ekXg@mail.gmail.com>
References: 
	<CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com>
	 <13e3100fc7c7d14919c37943dcfd76b263cecce2.camel@cybertec.at>
	 <609925.1752502040@sss.pgh.pa.us>
	 <CAGOe9RirtoXtMJhejo4_V+Si83+c4gfM_E-DH9WqaEBJ9SnfiA@mail.gmail.com>
	 <CAGOe9RiBSEZo3c8akePA+11HmV1JHx0Lsk57-fGfM0DEf4ekXg@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-1.fc42) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/62b420e1c9500c68c1bc135810d4cf9f3289fb8c.camel%40cybertec.at>
Precedence: bulk

On Wed, 2025-07-16 at 18:54 +0530, Amol Inamdar wrote:
> I would like to rephrase the question a little bit, below is how our setu=
p going to be=C2=A0
> =C2=A0=C2=A0=C2=A01. NFS mount point is for /nfs-mount/postgres (and perm=
issions locked down so
>       that Postgres cannot create directories in here)
> =C2=A0=C2=A0=C2=A02. Postgres data directory is /nfs-mount/postgres/db
> =C2=A0=C2=A0=C2=A03. With secured NFS + AT-TLS setup Postgres will be abl=
e to write to data directory
>       but not parent dir, however the file ownership information Postgres=
 sees from the
>      =C2=A0stat()=C2=A0call will not match the Postgres user in the conta=
iner (even though the
>       AT-TLS strict access control will ensure only the Posgres user can =
read/write to
>       this directory)
> Considering the above scenario/setup,=C2=A0what is the danger of removing=
 the ownership check
> in=C2=A0miscinit.c=C2=A0checkDataDir()=C2=A0function ?=C2=A0

The danger is that somebody else than the PostgreSQL user has permissions o=
n
the data directory.  You will argue that that somebody is root, and root ha=
s
these permissions anyway.

But there is another reason why PostgreSQL insists that the PostgreSQL user
owns the data directory: at startup, the postmaster checks if the data
directory belongs to the current user and fails if not.  This is a protecti=
on
against starting the postmaster with the wrong user.

There are certainly ways to do it differently, but I'd argue that they woul=
d
be more complicated, and the current simple solution is robust.

If you pre-create the data directory with the appropriate permissions,
what keeps you from giving ownership to the correct user too?

Yours,
Laurenz Albe