MIME-Version: 1.0
References: <CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com>
 <13e3100fc7c7d14919c37943dcfd76b263cecce2.camel@cybertec.at> <609925.1752502040@sss.pgh.pa.us>
In-Reply-To: <609925.1752502040@sss.pgh.pa.us>
From: Amol Inamdar <amol.aai@gmail.com>
Date: Tue, 15 Jul 2025 17:06:29 +0530
Message-ID: <CAGOe9RirtoXtMJhejo4_V+Si83+c4gfM_E-DH9WqaEBJ9SnfiA@mail.gmail.com>
Subject: Re: Bypassing Directory Ownership Check in PostgreSQL 16.6 with
 Secure z/OS NFS (AT-TLS)
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Laurenz Albe <laurenz.albe@cybertec.at>, pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000a8ad440639f630fc"
Archived-At: <https://www.postgresql.org/message-id/CAGOe9RirtoXtMJhejo4_V%2BSi83%2Bc4gfM_E-DH9WqaEBJ9SnfiA%40mail.gmail.com>
Precedence: bulk

--000000000000a8ad440639f630fc
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks Tom and Laurenz for the explanation.
Let me try out a few things and get back to you if needed.

Thanks,
Amol

On Mon, Jul 14, 2025 at 7:37=E2=80=AFPM Tom Lane <tgl@sss.pgh.pa.us> wrote:

> Laurenz Albe <laurenz.albe@cybertec.at> writes:
> > It is not a good idea to have a mount point be the data directory.
>
> ^^^ This. ^^^
>
> That is primarily for safety reasons: if for some reason the
> filesystem gets dismounted, or hasn't come on-line yet during
> a reboot, you do not want Postgres to be able to write on the
> underlying mount-point directory.  There is a sobering tale
> in this old thread:
>
> https://www.postgresql.org/message-id/flat/41BFAB7C.5040108%40joeconway.c=
om
>
> Now it didn't help any that they were using a start script that
> would automatically run initdb if it didn't see a data directory
> where expected.  But even without that, you are in for a world of
> hurt if the mount drops while the server is running and the server
> has any ability to write on the underlying storage; it will think
> whatever it was able to write is safely down on disk.  To prevent
> that, the server must not have write permissions on the mount
> point, which dictates making a separate data directory (with
> different ownership/permissions) just below the mount.
>
> Do not bypass that ownership/permissions check.  It is there
> for very good reasons.
>
>                         regards, tom lane
>


--=20
-regards
Amol

--000000000000a8ad440639f630fc
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thanks Tom and Laurenz for the explanation.=C2=A0<div>Let =
me try out a few things and get back to you if needed.<div><br></div><div>T=
hanks,</div><div>Amol</div></div></div><br><div class=3D"gmail_quote gmail_=
quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Jul 14, 2025=
 at 7:37=E2=80=AFPM Tom Lane &lt;<a href=3D"mailto:tgl@sss.pgh.pa.us">tgl@s=
ss.pgh.pa.us</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" styl=
e=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);paddin=
g-left:1ex">Laurenz Albe &lt;<a href=3D"mailto:laurenz.albe@cybertec.at" ta=
rget=3D"_blank">laurenz.albe@cybertec.at</a>&gt; writes:<br>
&gt; It is not a good idea to have a mount point be the data directory.<br>
<br>
^^^ This. ^^^<br>
<br>
That is primarily for safety reasons: if for some reason the<br>
filesystem gets dismounted, or hasn&#39;t come on-line yet during<br>
a reboot, you do not want Postgres to be able to write on the<br>
underlying mount-point directory.=C2=A0 There is a sobering tale<br>
in this old thread:<br>
<br>
<a href=3D"https://www.postgresql.org/message-id/flat/41BFAB7C.5040108%40jo=
econway.com" rel=3D"noreferrer" target=3D"_blank">https://www.postgresql.or=
g/message-id/flat/41BFAB7C.5040108%40joeconway.com</a><br>
<br>
Now it didn&#39;t help any that they were using a start script that<br>
would automatically run initdb if it didn&#39;t see a data directory<br>
where expected.=C2=A0 But even without that, you are in for a world of<br>
hurt if the mount drops while the server is running and the server<br>
has any ability to write on the underlying storage; it will think<br>
whatever it was able to write is safely down on disk.=C2=A0 To prevent<br>
that, the server must not have write permissions on the mount<br>
point, which dictates making a separate data directory (with<br>
different ownership/permissions) just below the mount.<br>
<br>
Do not bypass that ownership/permissions check.=C2=A0 It is there<br>
for very good reasons.<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 regards, tom lane<br>
</blockquote></div><div><br clear=3D"all"></div><div><br></div><span class=
=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_s=
ignature">-regards<br>Amol</div>

--000000000000a8ad440639f630fc--