Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tn25D-001IOE-HT for pgsql-hackers@arkaria.postgresql.org; Tue, 25 Feb 2025 21:03:15 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1tn25A-008bxC-PP for pgsql-hackers@arkaria.postgresql.org; Tue, 25 Feb 2025 21:03:12 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tn25A-008bvB-Dm for pgsql-hackers@lists.postgresql.org; Tue, 25 Feb 2025 21:03:12 +0000 Received: from mail-yw1-x112c.google.com ([2607:f8b0:4864:20::112c]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from ) id 1tn257-0004pM-1M for pgsql-hackers@lists.postgresql.org; Tue, 25 Feb 2025 21:03:11 +0000 Received: by mail-yw1-x112c.google.com with SMTP id 00721157ae682-6fba8e84d3cso48751847b3.0 for ; Tue, 25 Feb 2025 13:03:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=catprosystems.com; s=google; t=1740517388; x=1741122188; darn=lists.postgresql.org; h=content-transfer-encoding:in-reply-to:autocrypt:content-language :references:to:subject:user-agent:mime-version:date:message-id:from :from:to:cc:subject:date:message-id:reply-to; bh=M7nLbwyWyaAU/aIRFZKiesxCUfsctKqbVae17tpYjt8=; b=hMDhwXrmn/6bmPVUmhElG3F3a1AO1H0C/q9G0OPFf/EugRAOLLygwpZ481Zt6dSp2n h3pP/CPCVPnzrw0/eCgMuUY4ygFSLuN1neL1atvqZtJCoG1Mj2xTznYTkRHJ3D5nhlrY 6xaxDqZRhLZ7VDeSy6wNj2FyxSqo+E5J2svYvF++roEaEck7oPZXv+j86l0K35zxL8AC rX53h4lsw7+F7Vwntr8nMj+GyPFKZo0IjNYyktN3YqxH6fx4TRI5pLAaH8p5lrxIrDpU LeWGBLrsKvKm9kxg7r9hHpGJ8pi8MG95dPl1HJuUQhteX7v8Uqwi8Pwtpz4Nmvby4Gca JQaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740517388; x=1741122188; h=content-transfer-encoding:in-reply-to:autocrypt:content-language :references:to:subject:user-agent:mime-version:date:message-id:from :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=M7nLbwyWyaAU/aIRFZKiesxCUfsctKqbVae17tpYjt8=; b=jQoQXtFTCnPZIYGoErNxjVa7g6saoOS4M23GZlakwLFnvdvCJpVkTmbmqvU8uiZYHj 4fI8jccEUbNdpqXBwVlGJFuCku9rKs/cofbjEUJ0onCLrwlHievsXlJYdzM3bM7Z24m3 Mzwsm/LQylNP/um2yiK6kHJtbzMt6mL3otxA5gv+YCWxYLBuP6nDSDkRf3pR3LkQ7KbU sE3vB/sXO9GYwhzyixf/AgO9qIRzZ6ZoWbTJ+C/RHM5d9KJGO8jfE+7nfVcNEnL2mt2S 9nsopfGJZN0+EW+0KsCjZqcgjO67LncrW1RotkV9xDf/4Mqq8D+JQ7++XWv4UiMOmYSe LaBQ== X-Gm-Message-State: AOJu0YwgEVha2wpOBoZMBoDeQa3I1ju2h+6hoApcekaLgE2U9d0BZVuP ImOFxAIUdKVnJjoUjKeSaj6Jr0N7tCrVPFudsXNwzJ+Z+dZmksYC2lLJHdUnM1ktd7Zu+GlfKws = X-Gm-Gg: ASbGnctOvxWYQZA6oI80OUV9tlNNgd3UhuUy6mtyDsCKLnBt4hbt4yYVPZnlRLlpD3B 33o+r5ZESO1tOmsfpE+60w1aLmUZFIIXz5tmtVKvxHGpjYh0kBqMDc2Zu9jEdg/h27lP9c3/GUT Vo6WZP5JW2Fz9lC0HPS9RNwDdsT7wejW/uopXBSDLxmf0wsUZKrNGNkfk2IYdlLEjqh15qWgCb7 H+tZGESil15hKvSoBAEiTGpGWba8SyOh5JJVyInGBsNWTkA6D6iawEY63VBMAvpq78TsXynTGhR VcN7ARAIVlqns9rPhcjxnyW7vK2fKEY0yagSOMM6bu18+9tQBKqpAiSnE/w= X-Google-Smtp-Source: AGHT+IHcIC/IzWaHnI08ItL+rqbfBaBqHFptH8C5AUAr3C40J46Ppaz0oI/0oPF+deWPCOIy0DfxRA== X-Received: by 2002:a05:690c:450e:b0:6f9:8845:cfbf with SMTP id 00721157ae682-6fd10a1c497mr43558227b3.22.1740517388270; Tue, 25 Feb 2025 13:03:08 -0800 (PST) Received: from email.catprosystems.com ([2600:1700:31f0:6b7f:5054:ff:fe71:1669]) by smtp.gmail.com with ESMTPSA id 00721157ae682-6fd1167c86fsm6310417b3.30.2025.02.25.13.03.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Feb 2025 13:03:07 -0800 (PST) From: Yogesh Sharma X-Google-Original-From: Yogesh Sharma Received: from email.catprosystems.com (localhost [127.0.0.1]) by email.catprosystems.com (Postfix) with ESMTP id 4Z2VSC1TGBzyQJ for ; Tue, 25 Feb 2025 16:03:07 -0500 (EST) X-Virus-Scanned: amavis at email.catprosystems.com Received: from email.catprosystems.com ([127.0.0.1]) by email.catprosystems.com (email.catprosystems.com [127.0.0.1]) (amavis, port 10026) with ESMTP id 0RIBdBo0WSQf for ; Tue, 25 Feb 2025 16:02:59 -0500 (EST) Received: from [192.168.100.49] (unknown [192.168.100.49]) by email.catprosystems.com (Postfix) with ESMTPSA id 4Z2VS31ps8zycc for ; Tue, 25 Feb 2025 16:02:59 -0500 (EST) Message-ID: <8e2db13e-f480-4a94-8cea-98fcd798f47b@CatProSystems.com> Date: Tue, 25 Feb 2025 16:02:59 -0500 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: Securing PostgreSQL for rootless containers To: PostgreSQL Hackers References: <797ef53d-ecd2-4f23-8c33-1959b862a323@CatProSystems.com> Content-Language: en-US Autocrypt: addr=Yogesh.Sharma@CatProSystems.com; keydata= xjMEXkTQlhYJKwYBBAHaRw8BAQdAxDPDwsoO5hyT+yv8C53Vs39IdBzA2s0ZahS3JoetcoLN UVlvZ2VzaCBTaGFyYW1hIDxZb2dlc2guU2hhcm1hQENhdFByb1N5c3RlbXMuY29tPiAoaHR0 cHM6Ly9ibG9nLmNhdHByb3N5c3RlbXMuY29tKcKdBBMWCgBFAhsDBQkS5emqBQsJCAcCAyIC AQYVCgkICwIEFgIDAQIeBwIXgBYhBFMYpI3RuRKrY/ZXRUd3i/HSqBJUBQJiOkZgAhkBAAoJ EEd3i/HSqBJUfisBAPRrveHNZarIp3zxYmSqQYfNpixi4ZQEkyBOjV/J+ym/AQDMz2AzHv/Y 7HFVolI6A7qChZWBifWnNqkYb5o/IKgLAc44BF5E0JYSCisGAQQBl1UBBQEBB0C1aX+29TBm TCD00vLDaSuBq/3eotVWJuLo6J5m2x/oNwMBCAfCfgQYFggAJhYhBFMYpI3RuRKrY/ZXRUd3 i/HSqBJUBQJeRNCWAhsMBQkSzAMAAAoJEEd3i/HSqBJUWw8A/iO9ibRxr6inyGJwk2ektVb0 KiHfszWWMHEUDqbhQ56YAQD9ZHs+QJ3YmfyBfTNzdmkSQuuduQviBhTyNwo/2IitCw== In-Reply-To: <797ef53d-ecd2-4f23-8c33-1959b862a323@CatProSystems.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk On 2/24/25 14:51, Yogesh Sharma wrote: > > This patch has effect on current use of socket unless systemd socket > are used. Code is also guarded when postgres is not compiled with > systemd flag. I meant to say This patch has **no** effect on current use of socket unless systemd socket are used. Code is also guarded when postgres is not compiled with systemd flag. -- Kind Regards, Yogesh Sharma Open Source Enthusiast and Advocate Member: - PostgreSQL Contributors Team (AWS) https://aws.amazon.com - PG Infra https://www.postgresql.org/about/governance/sysadmin/ - PG RPMs https://yum.postgresql.org/contact/