MIME-Version: 1.0
References: <CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com>
 <13e3100fc7c7d14919c37943dcfd76b263cecce2.camel@cybertec.at>
In-Reply-To: <13e3100fc7c7d14919c37943dcfd76b263cecce2.camel@cybertec.at>
From: Amol Inamdar <amol.aai@gmail.com>
Date: Mon, 14 Jul 2025 17:59:12 +0530
Message-ID: <CAGOe9RijT-5X=UoeGv_TeW=KVVV9xvBBSwY9V-a=n_8GyzdRDA@mail.gmail.com>
Subject: Re: Bypassing Directory Ownership Check in PostgreSQL 16.6 with
 Secure z/OS NFS (AT-TLS)
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000564d970639e2cf16"
Archived-At: <https://www.postgresql.org/message-id/CAGOe9RijT-5X%3DUoeGv_TeW%3DKVVV9xvBBSwY9V-a%3Dn_8GyzdRDA%40mail.gmail.com>
Precedence: bulk

--000000000000564d970639e2cf16
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Laurenz

Thanks for the reply,

If I am not mistaken, below is my understanding of your suggestion.

Suppose that My mount point on the NFS server is say /nfs-mount/postgres/
and you are suggesting to have a data directory as say
/nfs-mount/postgres/db or something like that ?
and assign this value to the PGDATA ?

If that is the case, then when and who should be creating the directory DB
?

Please correct me if I am wrong about the understanding.

Thanks,
Amol


On Mon, Jul 14, 2025 at 5:50=E2=80=AFPM Laurenz Albe <laurenz.albe@cybertec=
.at>
wrote:

> On Mon, 2025-07-14 at 11:19 +0530, Amol Inamdar wrote:
> > I'm currently running PostgreSQL version 16.6 inside a Docker container
> > (base image: UBI 9), using Docker Compose. The PostgreSQL data director=
y
> > is mounted from an NFS volume hosted on a z/OS NFS server.
> >
> > The environment has a few constraints:
> >
> > - It=E2=80=99s a highly secure and access-controlled setup.
> > - Due to platform restrictions on z/OS, the mounted NFS directory canno=
t
> >   be owned by the PostgreSQL user (e.g., `postgres`) inside the
> container.
> > - As a result, PostgreSQL fails to start because of the directory
> >   ownership validation check.
>
> It is not a good idea to have a mount point be the data directory.
> The proper solution is to create the data directory inside the
> mount point.  That way, the permissions of the data directory don't
> have to be the same as the permissions of the mount point.
>
> Yours,
> Laurenz Albe
>


--=20
-regards
Amol

--000000000000564d970639e2cf16
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Laurenz<div><br></div><div>Thanks for the reply,=C2=A0<=
/div><div><br></div><div>If I am not mistaken, below is my understanding of=
 your suggestion.=C2=A0</div><div><br></div><div>Suppose that My mount poin=
t on the NFS server is say /nfs-mount/postgres/=C2=A0</div><div>and you are=
 suggesting to have a data directory as say /nfs-mount/postgres/db or somet=
hing like=C2=A0that ?=C2=A0</div><div>and assign this value to the PGDATA ?=
=C2=A0</div><div><br></div><div>If that is the case, then when and who shou=
ld be creating the directory DB ?=C2=A0</div><div><br></div><div>Please cor=
rect me if I am wrong about the understanding.</div><div><br></div><div>Tha=
nks,</div><div>Amol</div><div><br></div><div><br></div></div><br><div class=
=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr=
">On Mon, Jul 14, 2025 at 5:50=E2=80=AFPM Laurenz Albe &lt;<a href=3D"mailt=
o:laurenz.albe@cybertec.at">laurenz.albe@cybertec.at</a>&gt; wrote:<br></di=
v><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;borde=
r-left:1px solid rgb(204,204,204);padding-left:1ex">On Mon, 2025-07-14 at 1=
1:19 +0530, Amol Inamdar wrote:<br>
&gt; I&#39;m currently running PostgreSQL version 16.6 inside a Docker cont=
ainer<br>
&gt; (base image: UBI 9), using Docker Compose. The PostgreSQL data directo=
ry<br>
&gt; is mounted from an NFS volume hosted on a z/OS NFS server.<br>
&gt; <br>
&gt; The environment has a few constraints:<br>
&gt; <br>
&gt; - It=E2=80=99s a highly secure and access-controlled setup.<br>
&gt; - Due to platform restrictions on z/OS, the mounted NFS directory cann=
ot<br>
&gt; =C2=A0 be owned by the PostgreSQL user (e.g., `postgres`) inside the c=
ontainer.<br>
&gt; - As a result, PostgreSQL fails to start because of the directory<br>
&gt; =C2=A0 ownership validation check.<br>
<br>
It is not a good idea to have a mount point be the data directory.<br>
The proper solution is to create the data directory inside the<br>
mount point.=C2=A0 That way, the permissions of the data directory don&#39;=
t<br>
have to be the same as the permissions of the mount point.<br>
<br>
Yours,<br>
Laurenz Albe<br>
</blockquote></div><div><br clear=3D"all"></div><div><br></div><span class=
=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_s=
ignature">-regards<br>Amol</div>

--000000000000564d970639e2cf16--