Re: BUG #15049: Initdb.exe failing to create DB

On Tue, Feb 6, 2018 at 5:55 AM, Dheeraj <dheeru(dot)chhabra(at)gmail(dot)com> wrote:

> Dear Pavan, Pavel,
>
> This is little confusing. See below scenarios -
>
> *Scenario -1: * When I run the postgresDB installation with Windows
> Administrator user who has all the rights means he is privileged user. The
> installation is successful. In that case it is not complaining but creating
> the DB successfully. Why it is working in this case if it only needs
> unprivileged user.
>
> C:\Users\ADMINI~1\AppData\Local\Temp\extract6096>"D:\BMC
> Software\TrueSightPServer\truesightpserver\modules\pgsql\bin\initdb.exe"
> -U dheeraj -A trust -E utf8 -D "D:\BMC Software\TrueSightPServer\truesightpserver\data\pgsql"
> -X "D:\BMC Software\TrueSightPServer\truesightpserver\data\pgsql_txnlog"
> --pwfile "D:\BMC Software\TrueSightPServer\truesightpserver\tmp\
> DBdata6820706518760534179ks"
> The files belonging to this database system will be owned by user "
> *Administrator*".
> This user must also own the server process.
> The database cluster will be initialized with locale "English_United
> States.1252".
> The default text search configuration will be set to "english".
> Data page checksums are disabled.
> creating directory D:/BMC Software/TrueSightPServer/truesightpserver/data/pgsql
> ... ok
> creating directory D:/BMC Software/TrueSightPServer/
> truesightpserver/data/pgsql_txnlog ... ok
> creating subdirectories ... ok
> selecting default max_connections ... 100
> selecting default shared_buffers ... 128MB
> selecting dynamic shared memory implementation ... windows
> creating configuration files ... ok
> running bootstrap script ... ok
> performing post-bootstrap initialization ... ok
> syncing data to disk ... ok
> *Success*. You can now start the database server using:
> "D:\BMC Software\TrueSightPServer\truesightpserver\modules\pgsql\bin\pg_ctl"
> -D "D:\BMC Software\TrueSightPServer\truesightpserver\data\pgsql" -l
> logfile start
>
>
> *Scenario-2:* In few occasions, a normal user who is part of same
> Administrator group, is failed to create the DB.
>
> C:\Users\138580\AppData\Local\Temp\extract5416>D:\BMC\TrueSightPServer\
> truesightpserver\modules\pgsql\bin\initdb.exe -U SVC_BMCMON -A trust -E
> utf8 -D D:\BMC\TrueSightPServer\truesightpserver\data\pgsql -X
> D:\BMC\TrueSightPServer\truesightpserver\data\pgsql_txnlog --pwfile
> D:\BMC\TrueSightPServer\truesightpserver\tmp\DBdata4550223386000473763ks
> initdb: could not start process for command "D:\BMC\TrueSightPServer\
> truesightpserver\modules\pgsql\bin\initdb.exe -U SVC_BMCMON -A trust -E
> utf8 -D D:\BMC\TrueSightPServer\truesightpserver\data\pgsql -X
> D:\BMC\TrueSightPServer\truesightpserver\data\pgsql_txnlog --pwfile
> D:\BMC\TrueSightPServer\truesightpserver\tmp\DBdata4550223386000473763ks":
> error code 1260
>

^ this here is probably the root of your problem. Windows errorcode 1260
means "Windows cannot open this program because it has been prevented by a
software restriction policy".

So it looks like somewhere on your system there is a policy preventing
initdb from executing itself (which it will do on Windows).

initdb: could not re-execute with restricted token: error code 3
>
The files belonging to this database system will be owned by user "*138580*
> ".
> This user must also own the server process.
> The database cluster will be initialized with locale
> "English_Australia.1252".
> The default text search configuration will be set to "english".
> Data page checksums are disabled.
> creating directory D:/BMC/TrueSightPServer/truesightpserver/data/pgsql
> ... ok
> creating directory D:/BMC/TrueSightPServer/truesightpserver/data/pgsql_txnlog
> ... ok
> creating subdirectories ... ok
> selecting default max_connections ... 10
> selecting default shared_buffers ... 400kB
> selecting dynamic shared memory implementation ... windows
> creating configuration files ... ok
> *Execution of PostgreSQL by a user with administrative permissions is not*
> *permitted*.
>

This indicates that the user is at least "partially administrative". It may
not be Administrator, but it has administrative permissions. This means
it's member of administrators, domain admins, or power users groups,
directly or indirectly.

As you see in *scenario-1,* DB creation is successfull with Administrator
> user but in *scenario-2*, the install fails with a user who is part of
> same Administrator group.
> Please clarify
>
>
When running as administrator it successfully manages to re-execute itself
without the administrator permissions. With the second user, that is
blocked by some policy.

//Magnus