From: Tom Lane <tgl@sss.pgh.pa.us>
To: Lamar Owen <lamar.owen@wgcr.org>
Cc: Sergio A. Kessler <ser@perio.unlp.edu.ar>
Cc: pgsql-interfaces@postgreSQL.org <pgsql-interfaces@postgreSQL.org>
Subject: Re: [INTERFACES] pg_pwd
Date: Sat, 20 Nov 1999 21:25:00 -0500
Message-ID: <23778.943151100@sss.pgh.pa.us> (raw)
In-Reply-To: <99112018343902.00543@lorc.wgcr.org>
Lamar Owen <lamar.owen@wgcr.org> writes:
>> Maybe it would be worthwhile to try to force pg_pwd in particular
>> to be written with just mode 600. In the standard configuration that
>> shouldn't make any difference ...
> Hmmm... Can a parameter be passed to COPY giving the file create mode?
Yes, that was what I was thinking of. I need to look at the code and
see how direct the connection is between the code that knows it's
writing pg_pwd and the COPY code --- there might be a lot of layers
between :-(
> Just 'initdb --pglib=/usr/lib/pgsql --pgdata=/var/lib/pgsql'
> /var/lib/pgsql is created during the rpm installation of the server
> rpm -- and I can force that to create mode 0700. HOWEVER, that just
> fixes the symptom -- not the problem.
It looks like if you allow initdb to create the PGDATA directory, it
is correctly created with mode 700. But if the directory already
exists, initdb just uses it with whatever permissions it was made with.
Should initdb complain, or perhaps try to do a chmod() to make things
more secure? Mode 755 is bad enough, but suppose a sloppy admin had
made the directory group- or world-writable... or not even owned by
postgres...
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: tgl@sss.pgh.pa.us, lamar.owen@wgcr.org, ser@perio.unlp.edu.ar
Subject: Re: [INTERFACES] pg_pwd
In-Reply-To: <23778.943151100@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox