From: Lamar Owen <lamar.owen@wgcr.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Sergio A. Kessler <ser@perio.unlp.edu.ar>
Cc: pgsql-interfaces@postgreSQL.org <pgsql-interfaces@postgreSQL.org>
Subject: Re: [INTERFACES] pg_pwd
Date: Sat, 20 Nov 1999 17:41:34 -0500
Message-ID: <99112017500100.00543@lorc.wgcr.org> (raw)
In-Reply-To: <3766.943051402@sss.pgh.pa.us>
References: <3766.943051402@sss.pgh.pa.us>
On Fri, 19 Nov 1999, Tom Lane wrote:
> > in rh6.1 /var/lib/pgsql is 755 (and no, I haven't changed anything)
> > can you spell "2_KM_DIAMETER_HOLE" ?
>
> In a standard setup, pg_pwd is inside .../pgsql/data which is mode 700.
> Have the RH guys really blown it this badly? (Lamar?)
PGDATA is in fact 755 in the RPM installation. pg_pwd is the only file 666
under this directory.
Since pg_pwd is not very well documented, it is kind of hard to figure out
the permissions -- however, it is simple enough to issue a security advisory
for people to chmod 0700 /var/lib/pgsql.
The change to mode 0700 for PGDATA (which is moving in the future) will be made
in future RPM's. Again, no other file under /var/lib/pgsql under RH6.1 has
group or world permissions EXCEPT pg_pwd.
And yes, this IS a glaring security hole, IF the user postgres has a postgres
password. Just WHY is pg_pwd mode 666 in the first place??
--
Lamar Owen
WGCR Internet Radio
1 Peter 4:11
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: lamar.owen@wgcr.org, tgl@sss.pgh.pa.us, ser@perio.unlp.edu.ar
Subject: Re: [INTERFACES] pg_pwd
In-Reply-To: <99112017500100.00543@lorc.wgcr.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox