Message-ID: <cd6eed7ab5ba04826b72e401267c48179b76df11.camel@cybertec.at>
Subject: Re: Bypassing Directory Ownership Check in PostgreSQL 16.6 with
 Secure z/OS NFS (AT-TLS)
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Tom Lane <tgl@sss.pgh.pa.us>, "Peter J. Holzer" <hjp-pgsql@hjp.at>
Cc: pgsql-general@lists.postgresql.org
Date: Tue, 15 Jul 2025 08:02:06 +0200
In-Reply-To: <708241.1752517845@sss.pgh.pa.us>
References: 
	<CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com>
	 <13e3100fc7c7d14919c37943dcfd76b263cecce2.camel@cybertec.at>
	 <609925.1752502040@sss.pgh.pa.us> <20250714182016.23ypyxgtq6vbgl4c@hjp.at>
	 <708241.1752517845@sss.pgh.pa.us>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-1.fc42) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/cd6eed7ab5ba04826b72e401267c48179b76df11.camel%40cybertec.at>
Precedence: bulk

On Mon, 2025-07-14 at 14:30 -0400, Tom Lane wrote:
> (I have a vague idea that there are system-level security hazards,
> not specific to Postgres, if mount-point directories are publicly
> writable.=C2=A0 Don't feel like researching that though.)

Well, if you are using an ext? file system, there is a lost+found
directory where fsck places links to orphaned inodes.
If the PostgreSQL user owns the mount point and wants to use
"initdb" to create a data directory in it, the program will fail
and complain that the directory is not empty.  The danger is great
that the user removes the lost+found directory to solve the problem.

True, one could re-create it with "mklost+found", but if a DBA
is uneducated enough to remove the directory in the first place,
the risk is high that he wouldn't think of creating it again,
which is a problem if the file system ever becomes corrupted.

All this doesn't apply to NFS, but it is yet another reason
(apart from the safety of a subdirectory that doesn't exist
on the file system underlying the mount point) why we should
continue to recommend that the data directory be not a mount point.

Yours,
Laurenz Albe