Received: from sss.sss.pgh.pa.us (sss.pgh.pa.us [209.114.166.2])
	by hub.org (8.9.3/8.9.3) with ESMTP id RAA82783
	for <pgsql-interfaces@postgreSQL.org>;
	Fri, 19 Nov 1999 17:44:59 -0500 (EST)
	(envelope-from tgl@sss.pgh.pa.us)
Received: from sss.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.sss.pgh.pa.us (8.9.1/8.9.1) with ESMTP id RAA03768;
	Fri, 19 Nov 1999 17:43:22 -0500 (EST)
To: "Sergio A. Kessler" <ser@perio.unlp.edu.ar>
cc: Lamar Owen <lamar.owen@wgcr.org>,
	"pgsql-interfaces@postgreSQL.org" <pgsql-interfaces@postgreSQL.org>
Subject: Re: [INTERFACES] pg_pwd 
In-reply-to: Your message of Fri, 19 Nov 1999 19:08:59 -0300
	<3835CA7B.5D7FF6F3@perio.unlp.edu.ar>
Date: Fri, 19 Nov 1999 17:43:22 -0500
Message-ID: <3766.943051402@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>

"Sergio A. Kessler" <ser@perio.unlp.edu.ar> writes:
>> See doc/TODO.detail/pg_shadow.

> where ? can you post an absolute url ?

Sorry, I forgot that the TODO.detail files are not in the 6.5.*
distribution (they got added to the CVS repository since 6.5).
I'm not sure if they are available separately at the website (Bruce?).
I know you could get them by downloading a current snapshot...

>>>> and why is world =writable & readable= ?
>>>> (hey, everybody, wanna know my passwd ?)
>> 
>> It's not really a security hole because it lives inside a directory
>> that's mode 700 (unless you tampered with the default permissions
>> setup). 

> in rh6.1 /var/lib/pgsql is 755 (and no, I haven't changed anything)
> can you spell "2_KM_DIAMETER_HOLE" ?

In a standard setup, pg_pwd is inside .../pgsql/data which is mode 700.
Have the RH guys really blown it this badly?  (Lamar?)

			regards, tom lane