Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc37b3d0

Browse files
committed
Allow group access on PGDATA
Allow the cluster to be optionally init'd with read access for thegroup.This means a relatively non-privileged user can perform a backup of thecluster without requiring write privileges, which enhances security.The mode of PGDATA is used to determine whether group permissions areenabled for directory and file creates. This method was chosen as it'ssimple and works well for the various utilities that write into PGDATA.Changing the mode of PGDATA manually will not automatically change themode of all the files contained therein. If the user would like toenable group access on an existing cluster then changing the mode of allthe existing files will be required. Note that pg_upgrade willautomatically change the mode of all migrated files if the new clusteris init'd with the -g option.Tests are included for the backend and all the utilities which operateon the PG data directory to ensure that the correct mode is set based onthe data directory permissions.Author: David Steele <david@pgmasters.net>Reviewed-By: Michael Paquier, with discussion amongst many others.Discussion:https://postgr.es/m/ad346fe6-b23e-59f1-ecb7-0e08390ad629%40pgmasters.net
1 parentda9b580 commitc37b3d0

32 files changed

+661
-127
lines changed

‎doc/src/sgml/config.sgml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8144,6 +8144,23 @@ dynamic_library_path = 'C:\tools\postgresql;H:\my_project\lib;$libdir'
81448144
</listitem>
81458145
</varlistentry>
81468146

8147+
<varlistentry id="guc-data-directory-mode" xreflabel="data_directory_mode">
8148+
<term><varname>data_directory_mode</varname> (<type>integer</type>)
8149+
<indexterm>
8150+
<primary><varname>data_directory_mode</varname> configuration parameter</primary>
8151+
</indexterm>
8152+
</term>
8153+
<listitem>
8154+
<para>
8155+
On Unix systems this parameter reports the permissions of the data
8156+
directory defined by (<xref linkend="guc-data-directory"/>) at startup.
8157+
(On Microsoft Windows this parameter will always display
8158+
<literal>0700</literal>). See
8159+
<xref linkend="app-initdb-allow-group-access"/> for more information.
8160+
</para>
8161+
</listitem>
8162+
</varlistentry>
8163+
81478164
<varlistentry id="guc-debug-assertions" xreflabel="debug_assertions">
81488165
<term><varname>debug_assertions</varname> (<type>boolean</type>)
81498166
<indexterm>

‎doc/src/sgml/ref/initdb.sgml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,14 @@ PostgreSQL documentation
7676
to do so.)
7777
</para>
7878

79+
<para>
80+
For security reasons the new cluster created by <command>initdb</command>
81+
will only be accessible by the cluster owner by default. The
82+
<option>--allow-group-access</option> option allows any user in the same
83+
group as the cluster owner to read files in the cluster. This is useful
84+
for performing backups as a non-privileged user.
85+
</para>
86+
7987
<para>
8088
<command>initdb</command> initializes the database cluster's default
8189
locale and character set encoding. The character set encoding,
@@ -188,6 +196,17 @@ PostgreSQL documentation
188196
</listitem>
189197
</varlistentry>
190198

199+
<varlistentry id="app-initdb-allow-group-access" xreflabel="group access">
200+
<term><option>-g</option></term>
201+
<term><option>--allow-group-access</option></term>
202+
<listitem>
203+
<para>
204+
Allows users in the same group as the cluster owner to read all cluster
205+
files created by <command>initdb</command>.
206+
</para>
207+
</listitem>
208+
</varlistentry>
209+
191210
<varlistentry id="app-initdb-data-checksums" xreflabel="data checksums">
192211
<term><option>-k</option></term>
193212
<term><option>--data-checksums</option></term>

‎doc/src/sgml/ref/pg_basebackup.sgml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,12 @@ PostgreSQL documentation
737737
or later.
738738
</para>
739739

740+
<para>
741+
<application>pg_basebackup</application> will preserve group permissions in
742+
both the <literal>plain</literal> and <literal>tar</literal> formats if group
743+
permissions are enabled on the source cluster.
744+
</para>
745+
740746
</refsect1>
741747

742748
<refsect1>

‎doc/src/sgml/ref/pg_receivewal.sgml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -425,6 +425,12 @@ PostgreSQL documentation
425425
not keep up with fetching the WAL data.
426426
</para>
427427

428+
<para>
429+
<application>pg_receivewal</application> will preserve group permissions on
430+
the received WAL files if group permissions are enabled on the source
431+
cluster.
432+
</para>
433+
428434
</refsect1>
429435

430436
<refsect1>

‎doc/src/sgml/ref/pg_recvlogical.sgml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,17 @@ PostgreSQL documentation
399399
</para>
400400
</refsect1>
401401

402+
<refsect1>
403+
<title>Notes</title>
404+
405+
<para>
406+
<application>pg_recvlogical</application> will preserve group permissions on
407+
the received WAL files if group permissions are enabled on the source
408+
cluster.
409+
</para>
410+
411+
</refsect1>
412+
402413
<refsect1>
403414
<title>Examples</title>
404415

‎doc/src/sgml/runtime.sgml

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,22 @@ postgres$ <userinput>initdb -D /usr/local/pgsql/data</userinput>
137137
database, it is essential that it be secured from unauthorized
138138
access. <command>initdb</command> therefore revokes access
139139
permissions from everyone but the
140-
<productname>PostgreSQL</productname> user.
140+
<productname>PostgreSQL</productname> user, and optionally, group.
141+
Group access, when enabled, is read-only. This allows an unprivileged
142+
user in the same group as the cluster owner to take a backup of the
143+
cluster data or perform other operations that only require read access.
144+
</para>
145+
146+
<para>
147+
Note that enabling or disabling group access on an existing cluster requires
148+
the cluster to be shut down and the appropriate mode to be set on all
149+
directories and files before restarting
150+
<productname>PostgreSQL</productname>. Otherwise, a mix of modes might
151+
exist in the data directory. For clusters that allow access only by the
152+
owner, the appropriate modes are <literal>0700</literal> for directories
153+
and <literal>0600</literal> for files. For clusters that also allow
154+
reads by the group, the appropriate modes are <literal>0750</literal>
155+
for directories and <literal>0640</literal> for files.
141156
</para>
142157

143158
<para>
@@ -2194,6 +2209,15 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
21942209
member of the group that has access to those certificate and key files.
21952210
</para>
21962211

2212+
<para>
2213+
If the data directory allows group read access then certificate files may
2214+
need to be located outside of the data directory in order to conform to the
2215+
security requirements outlined above. Generally, group access is enabled
2216+
to allow an unprivileged user to backup the database, and in that case the
2217+
backup software will not be able to read the certificate files and will
2218+
likely error.
2219+
</para>
2220+
21972221
<para>
21982222
If the private key is protected with a passphrase, the
21992223
server will prompt for the passphrase and will not start until it has

‎src/backend/bootstrap/bootstrap.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -349,13 +349,15 @@ AuxiliaryProcessMain(int argc, char *argv[])
349349
proc_exit(1);
350350
}
351351

352-
/* Validate we have been given a reasonable-looking DataDir */
353-
Assert(DataDir);
354-
ValidatePgVersion(DataDir);
355-
356-
/* Change into DataDir (if under postmaster, should be done already) */
352+
/*
353+
* Validate we have been given a reasonable-looking DataDir and change
354+
* into it (if under postmaster, should be done already).
355+
*/
357356
if (!IsUnderPostmaster)
357+
{
358+
checkDataDir();
358359
ChangeToDataDir();
360+
}
359361

360362
/* If standalone, create lockfile for data directory */
361363
if (!IsUnderPostmaster)

‎src/backend/postmaster/postmaster.c

Lines changed: 15 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -391,7 +391,7 @@ static DNSServiceRef bonjour_sdref = NULL;
391391
staticvoidCloseServerPorts(intstatus,Datumarg);
392392
staticvoidunlink_external_pid_file(intstatus,Datumarg);
393393
staticvoidgetInstallationPaths(constchar*argv0);
394-
staticvoidcheckDataDir(void);
394+
staticvoidcheckControlFile(void);
395395
staticPort*ConnCreate(intserverFd);
396396
staticvoidConnFree(Port*port);
397397
staticvoidreset_shared(intport);
@@ -588,7 +588,12 @@ PostmasterMain(int argc, char *argv[])
588588
IsPostmasterEnvironment= true;
589589

590590
/*
591-
* for security, no dir or file created can be group or other accessible
591+
* We should not be creating any files or directories before we check the
592+
* data directory (see checkDataDir()), but just in case set the umask to
593+
* the most restrictive (owner-only) permissions.
594+
*
595+
* checkDataDir() will reset the umask based on the data directory
596+
* permissions.
592597
*/
593598
umask(PG_MODE_MASK_OWNER);
594599

@@ -877,6 +882,9 @@ PostmasterMain(int argc, char *argv[])
877882
/* Verify that DataDir looks reasonable */
878883
checkDataDir();
879884

885+
/* Check that pg_control exists */
886+
checkControlFile();
887+
880888
/* And switch working directory into it */
881889
ChangeToDataDir();
882890

@@ -1469,82 +1477,17 @@ getInstallationPaths(const char *argv0)
14691477
*/
14701478
}
14711479

1472-
14731480
/*
1474-
* Validate the proposed data directory
1481+
* Check that pg_control exists in the correct location in the data directory.
1482+
*
1483+
* No attempt is made to validate the contents of pg_control here. This is
1484+
* just a sanity check to see if we are looking at a real data directory.
14751485
*/
14761486
staticvoid
1477-
checkDataDir(void)
1487+
checkControlFile(void)
14781488
{
14791489
charpath[MAXPGPATH];
14801490
FILE*fp;
1481-
structstatstat_buf;
1482-
1483-
Assert(DataDir);
1484-
1485-
if (stat(DataDir,&stat_buf)!=0)
1486-
{
1487-
if (errno==ENOENT)
1488-
ereport(FATAL,
1489-
(errcode_for_file_access(),
1490-
errmsg("data directory \"%s\" does not exist",
1491-
DataDir)));
1492-
else
1493-
ereport(FATAL,
1494-
(errcode_for_file_access(),
1495-
errmsg("could not read permissions of directory \"%s\": %m",
1496-
DataDir)));
1497-
}
1498-
1499-
/* eventual chdir would fail anyway, but let's test ... */
1500-
if (!S_ISDIR(stat_buf.st_mode))
1501-
ereport(FATAL,
1502-
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
1503-
errmsg("specified data directory \"%s\" is not a directory",
1504-
DataDir)));
1505-
1506-
/*
1507-
* Check that the directory belongs to my userid; if not, reject.
1508-
*
1509-
* This check is an essential part of the interlock that prevents two
1510-
* postmasters from starting in the same directory (see CreateLockFile()).
1511-
* Do not remove or weaken it.
1512-
*
1513-
* XXX can we safely enable this check on Windows?
1514-
*/
1515-
#if !defined(WIN32)&& !defined(__CYGWIN__)
1516-
if (stat_buf.st_uid!=geteuid())
1517-
ereport(FATAL,
1518-
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
1519-
errmsg("data directory \"%s\" has wrong ownership",
1520-
DataDir),
1521-
errhint("The server must be started by the user that owns the data directory.")));
1522-
#endif
1523-
1524-
/*
1525-
* Check if the directory has group or world access. If so, reject.
1526-
*
1527-
* It would be possible to allow weaker constraints (for example, allow
1528-
* group access) but we cannot make a general assumption that that is
1529-
* okay; for example there are platforms where nearly all users
1530-
* customarily belong to the same group. Perhaps this test should be
1531-
* configurable.
1532-
*
1533-
* XXX temporarily suppress check when on Windows, because there may not
1534-
* be proper support for Unix-y file permissions. Need to think of a
1535-
* reasonable check to apply on Windows.
1536-
*/
1537-
#if !defined(WIN32)&& !defined(__CYGWIN__)
1538-
if (stat_buf.st_mode& (S_IRWXG |S_IRWXO))
1539-
ereport(FATAL,
1540-
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
1541-
errmsg("data directory \"%s\" has group or world access",
1542-
DataDir),
1543-
errdetail("Permissions should be u=rwx (0700).")));
1544-
#endif
1545-
1546-
/* Look for PG_VERSION before looking for pg_control */
1547-
ValidatePgVersion(DataDir);
15481491

15491492
snprintf(path,sizeof(path),"%s/global/pg_control",DataDir);
15501493

‎src/backend/tcop/postgres.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3731,8 +3731,7 @@ PostgresMain(int argc, char *argv[],
37313731
* Validate we have been given a reasonable-looking DataDir (if under
37323732
* postmaster, assume postmaster did this already).
37333733
*/
3734-
Assert(DataDir);
3735-
ValidatePgVersion(DataDir);
3734+
checkDataDir();
37363735

37373736
/* Change into DataDir (if under postmaster, was done already) */
37383737
ChangeToDataDir();

‎src/backend/utils/init/globals.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,11 @@
1616
*
1717
*-------------------------------------------------------------------------
1818
*/
19+
#include<sys/stat.h>
20+
1921
#include"postgres.h"
2022

23+
#include"common/file_perm.h"
2124
#include"libpq/libpq-be.h"
2225
#include"libpq/pqcomm.h"
2326
#include"miscadmin.h"
@@ -59,6 +62,12 @@ struct Latch *MyLatch;
5962
*/
6063
char*DataDir=NULL;
6164

65+
/*
66+
* Mode of the data directory. The default is 0700 but may it be changed in
67+
* checkDataDir() to 0750 if the data directory actually has that mode.
68+
*/
69+
intdata_directory_mode=PG_DIR_MODE_OWNER;
70+
6271
charOutputFileName[MAXPGPATH];/* debugging output file */
6372

6473
charmy_exec_path[MAXPGPATH];/* full path to my executable */

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp