Re: [HACKERS] Re: [HACKERS] Re: [HACKERS] Windows service is not starting so there’s message in log: FATAL: "could not create shared memory segment “Global/PostgreSQL.851401618”: Permission denied”

On Fri, Mar 11, 2016 at 5:21 PM, Haribabu Kommi <kommi(dot)haribabu(at)gmail(dot)com>
wrote:
>
> On Fri, Mar 11, 2016 at 12:00 AM, Amit Kapila <amit(dot)kapila16(at)gmail(dot)com>
wrote:
>
>
> >> I am not able to find the reason for this error. This error is
occurring
> >> only
> >> when the PostgreSQL is started as a service only.
> >>
> >
> > Did you use pg_ctl register/unregister to register different services.
Can
> > you share the detail steps and OS version on which you saw this
behaviour?
>
> Operating system - windows 7
> Binary - PostgreSQL 9.5 (This doesn't matter, 9.4+ can produce the
problem)
>
> 1. Create two standard users in the system (test_user1 and test_user2)
> 2. Create two databases belongs each user listed above.
> 3. Now using pg_ctl register the services for the two users.
> 4. Provide logon permissions to these users to run the services by
changing
> service properties.

Did you mean to say that you changed Log on as: Local System Account in
service properties or something else?

> 5. Now try to start the services, the second service fails with the
> error message.
> 6. Error details can be found out in Event log viewer.
>

If I follow above steps and do as I mentioned for step-4, I am not able to
reproduce the issue on Windows-7 m/c using code of HEAD.

> Yes, it is working as same user services. The main problem is, PostgreSQL
> as a service for two different users in the same system is not working
because
> of same random getting generated for two services.
>

I am not sure why you think same random number is problem, as mentioned
above, even if the dsm name is same due to same random number, the code has
logic to process it appropriately (regenerate the name of dsm). Having
said that, I don't mean to say that we shouldn't have logic to generate
unique name and I think we might want to add data dir path to name
generation as we do for main shared memory, however it is better to first
completely understand the underneath issue.

If I understand correctly, here the problem is due to the reason that the
second user doesn't have appropriate access rights to access the object
created by first user. On reading the documentation of
CreateFileMapping(), it seems that user should have SeCreateGlobalPrivilege
privilege to create an object in Global namespace. Can you once try giving
that privilege to the users created by you? To give this privilege, go to
control panel->System And Security->Administrative Tools->Local Security
Policy->Local Policies->User Rights Assignment, in the right window, select
Create global objects and double-click the same and add the newly created
users. Rerun your test after these steps.

With Regards,
Amit Kapila.
EnterpriseDB: http://www.enterprisedb.com