Re: worried about PGPASSWORD drop

From: Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us>
To: Alvaro Herrera <alvherre(at)atentus(dot)com>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Christoph Dalitz <christoph(dot)dalitz(at)hs-niederrhein(dot)de>, PG Mailing List <pgsql-general(at)postgresql(dot)org>
Subject: Re: worried about PGPASSWORD drop
Date: 2002-08-28 21:33:34
Message-ID: 200208282133.g7SLXYY12462@candle.pha.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general pgsql-patches

Alvaro Herrera wrote:
> Bruce Momjian dijo:
>
> > Tom Lane wrote:
>
> > > If you want to put in security restrictions that are actually useful,
> > > where is the code to verify that PGPASSWORDFILE points at a
> > > non-world-readable file? That needs to be there now, not later, or
> > > we'll have people moaning about backward compatibility when we finally
> > > do plug that hole.
> >
> > Agreed.
>
> Point taken, will look into it later.

Here is some code from postmaster.c that may help:

if (stat(checkdir, &stat_buf) == -1)
{
if (errno == ENOENT)
elog(FATAL, "data directory %s was not found", checkdir);
else
elog(FATAL, "could not read permissions of directory %s: %m",
checkdir);
}

if (stat_buf.st_mode & (S_IRWXG | S_IRWXO))
elog(FATAL, "data directory %s has group or world access; permissions should be u=rwx (0700)",
checkdir);

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

In response to

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Debra LaVille 2002-08-28 22:46:30 Attempt to connect to database using libpq++ PgDatabase class fails because CONNECTION_BAD
Previous Message Markus Wollny 2002-08-28 21:25:44 Re: Naming-scheme for db-files

Browse pgsql-patches by date

  From Date Subject
Next Message Tom Lane 2002-08-28 23:08:45 Concern about memory management with SRFs
Previous Message Bruce Momjian 2002-08-28 21:17:55 Re: contrib/cube patches