Date: Thu, 27 May 2021 13:50:25 -0500
From: Justin Pryzby <pryzby@telsasoft.com>
To: Markus =?iso-8859-1?Q?Br=E4unig?= <markus@braeunig.biz>
Cc: Devrim =?iso-8859-1?B?R/xuZPx6?= <devrim@gunduz.org>,
	pgsql-pkg-yum@postgresql.org
Subject: Re: /var/lib/pgsql 0755
Message-ID: <20210527185025.GD2082@telsasoft.com>
References: <20210527180353.GC2082@telsasoft.com>
 <014AB2AF-9AD3-44A9-BECC-EB3F1348E424@braeunig.biz>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <014AB2AF-9AD3-44A9-BECC-EB3F1348E424@braeunig.biz>
User-Agent: Mutt/1.9.4 (2018-02-28)
Archived-At: 
 <https://www.postgresql.org/message-id/20210527185025.GD2082%40telsasoft.com>
Precedence: bulk

On Thu, May 27, 2021 at 06:40:40PM +0000, Markus Bräunig wrote:
> I thought as long as /v/l/p is the homedir of postgres user we should be carefully with changes like this. 

I think you mean that you do things like "sudo -iu postgres" to open an
interactive shell.  Probably because you want to "cd" into the dir and "ls".

I imagine that's common, but is itself strange to me.  You can just "ls" the
dir without sudo without opening an interactive shell, and do anything else,
too.  Which is safer (avoids the risk of then leaving the shell opened or
running as the wrong user in the wrong window) and avoids starting down the
path of running around the system putting on different users' "hats".

System users like this are for running their specific daemon, for isolation
purposes and not for running interactive shells.  It shouldn't have a password
set, either.

> We normally shift the data dir to other places and the log files as well. For the logfiles we use a separate group combined with a sgid bit 

-- 
Justin