MIME-Version: 1.0
References: <CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com>
 <13e3100fc7c7d14919c37943dcfd76b263cecce2.camel@cybertec.at>
 <CAGOe9RijT-5X=UoeGv_TeW=KVVV9xvBBSwY9V-a=n_8GyzdRDA@mail.gmail.com>
 <0b3fb11184bf9ce6516ed1aa08af5dddc924f21c.camel@cybertec.at>
 <CAGOe9Ri8aNao0SB8kkm0F6xp=TPe5XWHpcA9MEBkY4kp-6Bjig@mail.gmail.com> <bedcc1a31d365325f24031cc24fa6ee6c532cb8d.camel@cybertec.at>
In-Reply-To: <bedcc1a31d365325f24031cc24fa6ee6c532cb8d.camel@cybertec.at>
From: Amol Inamdar <amol.aai@gmail.com>
Date: Tue, 15 Jul 2025 17:05:04 +0530
Message-ID: <CAGOe9RjvC0x0cOn4K-2ZXfrZODi6ZoFF5PUQMZixS5vu+2=m0A@mail.gmail.com>
Subject: Re: Bypassing Directory Ownership Check in PostgreSQL 16.6 with
 Secure z/OS NFS (AT-TLS)
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="0000000000009a0b670639f62b5d"
Archived-At: <https://www.postgresql.org/message-id/CAGOe9RjvC0x0cOn4K-2ZXfrZODi6ZoFF5PUQMZixS5vu%2B2%3Dm0A%40mail.gmail.com>
Precedence: bulk

--0000000000009a0b670639f62b5d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks Laurenz.

On Mon, Jul 14, 2025 at 8:11=E2=80=AFPM Laurenz Albe <laurenz.albe@cybertec=
.at>
wrote:

> On Mon, 2025-07-14 at 18:32 +0530, Amol Inamdar wrote:
> > > The data directory can either be created by "initdb", in which case
> > > the mount point must allow the PostgreSQL user to create a directory.
> > > You could set the group of the mount point to the group of the
> > > PostgreSQL user and use permissions 1770, which should be perfectly
> safe.
> >
> > This exactly is the problem we are facing, to give you a summary,
> > our NFS server is enabled with AT-TLS authentication
> > and we are accessing the server via a proxy server (Haproxy).
> > This acts as our NFS client and it is configured with the
> > required client certificates.
> >
> > The outcome of above configuration is that any directory created
> > in the NFS mount is always owned by the user in the certificates
> > and if that user isn't present in the proxy container it is marked
> > as nobody:nogroup, we tried various things like
> > created the user similar to postgres user so that the users ids match
> but
> > always ended up giving error  =E2=80=9Cdata directory =E2=80=9C/var/lib=
=E2=80=9D has wrong
> ownership
> >
> > Hence, we thought of skipping this check (Directory owner and postgres
> user validation) and
> > wanted to understand the implication of the same.
>
> No; don't.
>
> Simply mount the directory once, create a subdirectory with the
> appropriate ownership and permissions, and there you go.
> Problem solved.
>
> Yours,
> Laurenz Albe
>


--=20
-regards
Amol

--0000000000009a0b670639f62b5d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thanks Laurenz.=C2=A0</div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Jul 14,=
 2025 at 8:11=E2=80=AFPM Laurenz Albe &lt;<a href=3D"mailto:laurenz.albe@cy=
bertec.at">laurenz.albe@cybertec.at</a>&gt; wrote:<br></div><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid =
rgb(204,204,204);padding-left:1ex">On Mon, 2025-07-14 at 18:32 +0530, Amol =
Inamdar wrote:<br>
&gt; &gt; The data directory can either be created by &quot;initdb&quot;, i=
n which case<br>
&gt; &gt; the mount point must allow the PostgreSQL user to create a direct=
ory.<br>
&gt; &gt; You could set the group of the mount point to the group of the<br=
>
&gt; &gt; PostgreSQL user and use permissions 1770, which should be perfect=
ly safe.<br>
&gt; <br>
&gt; This exactly is the problem we are facing, to give you a summary,=C2=
=A0<br>
&gt; our NFS server is enabled with AT-TLS authentication<br>
&gt; and we are accessing the server via a proxy server (Haproxy).=C2=A0<br=
>
&gt; This acts as our NFS client and it is configured with the=C2=A0<br>
&gt; required client certificates.<br>
&gt; <br>
&gt; The outcome of above configuration is that any directory created=C2=A0=
<br>
&gt; in the NFS mount is always owned by the user in the certificates=C2=A0=
<br>
&gt; and if that user isn&#39;t present in the proxy container it is marked=
=C2=A0<br>
&gt; as nobody:nogroup, we tried various things like<br>
&gt; created the user similar to postgres user so that the users ids match =
but=C2=A0<br>
&gt; always ended up giving error=C2=A0=C2=A0=E2=80=9Cdata directory =E2=80=
=9C/var/lib=E2=80=9D has wrong ownership=C2=A0<br>
&gt; <br>
&gt; Hence, we thought of skipping this check (Directory owner and postgres=
 user validation) and=C2=A0<br>
&gt; wanted to understand the implication of the same.<br>
<br>
No; don&#39;t.<br>
<br>
Simply mount the directory once, create a subdirectory with the<br>
appropriate ownership and permissions, and there you go.<br>
Problem solved.<br>
<br>
Yours,<br>
Laurenz Albe<br>
</blockquote></div><div><br clear=3D"all"></div><div><br></div><span class=
=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_s=
ignature">-regards<br>Amol</div>

--0000000000009a0b670639f62b5d--