Message-ID: <bedcc1a31d365325f24031cc24fa6ee6c532cb8d.camel@cybertec.at>
Subject: Re: Bypassing Directory Ownership Check in PostgreSQL 16.6 with
 Secure z/OS NFS (AT-TLS)
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Amol Inamdar <amol.aai@gmail.com>
Cc: pgsql-general@lists.postgresql.org
Date: Mon, 14 Jul 2025 16:41:26 +0200
In-Reply-To: <CAGOe9Ri8aNao0SB8kkm0F6xp=TPe5XWHpcA9MEBkY4kp-6Bjig@mail.gmail.com>
References: 
	<CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com>
	 <13e3100fc7c7d14919c37943dcfd76b263cecce2.camel@cybertec.at>
	 <CAGOe9RijT-5X=UoeGv_TeW=KVVV9xvBBSwY9V-a=n_8GyzdRDA@mail.gmail.com>
	 <0b3fb11184bf9ce6516ed1aa08af5dddc924f21c.camel@cybertec.at>
	 <CAGOe9Ri8aNao0SB8kkm0F6xp=TPe5XWHpcA9MEBkY4kp-6Bjig@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-1.fc42) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/bedcc1a31d365325f24031cc24fa6ee6c532cb8d.camel%40cybertec.at>
Precedence: bulk

On Mon, 2025-07-14 at 18:32 +0530, Amol Inamdar wrote:
> > The data directory can either be created by "initdb", in which case
> > the mount point must allow the PostgreSQL user to create a directory.
> > You could set the group of the mount point to the group of the
> > PostgreSQL user and use permissions 1770, which should be perfectly saf=
e.
>=20
> This exactly is the problem we are facing, to give you a summary,=C2=A0
> our NFS server is enabled with AT-TLS authentication
> and we are accessing the server via a proxy server (Haproxy).=C2=A0
> This acts as our NFS client and it is configured with the=C2=A0
> required client certificates.
>=20
> The outcome of above configuration is that any directory created=C2=A0
> in the NFS mount is always owned by the user in the certificates=C2=A0
> and if that user isn't present in the proxy container it is marked=C2=A0
> as nobody:nogroup, we tried various things like
> created the user similar to postgres user so that the users ids match but=
=C2=A0
> always ended up giving error=C2=A0=C2=A0=E2=80=9Cdata directory =E2=80=9C=
/var/lib=E2=80=9D has wrong ownership=C2=A0
>=20
> Hence, we thought of skipping this check (Directory owner and postgres us=
er validation) and=C2=A0
> wanted to understand the implication of the same.

No; don't.

Simply mount the directory once, create a subdirectory with the
appropriate ownership and permissions, and there you go.
Problem solved.

Yours,
Laurenz Albe