From: | Amol Inamdar <amol(dot)aai(at)gmail(dot)com> |
---|---|
To: | pgsql-general(at)lists(dot)postgresql(dot)org |
Subject: | Bypassing Directory Ownership Check in PostgreSQL 16.6 with Secure z/OS NFS (AT-TLS) |
Date: | 2025-07-14 05:49:55 |
Message-ID: | CAGOe9RiRUK9K8gUbsMfg8nWDsM2Fd9py-2oe4VG1Uaggu8fQGA@mail.gmail.com |
Views: | Whole Thread | Raw Message | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-general |
Dear PostgreSQL Community,
I'm currently running PostgreSQL version 16.6 inside a Docker container
(base image: UBI 9), using Docker Compose. The PostgreSQL data directory
is mounted from an NFS volume hosted on a z/OS NFS server.
The environment has a few constraints:
- The NFS server runs on z/OS with AT-TLS enabled.
- It’s a highly secure and access-controlled setup.
- Due to platform restrictions on z/OS, the mounted NFS directory cannot
be owned by the PostgreSQL user (e.g., `postgres`) inside the container.
- As a result, PostgreSQL fails to start because of the directory
ownership validation check.
Given the secure nature of the NFS server, I’d like to ask:
1. Is there a supported or recommended way to bypass the ownership
check on the data directory?
2. What are the potential risks or implications of doing so in a secure
NFS environment?
3. I'm considering building a custom PostgreSQL image by modifying the
`miscinit.c` file—specifically, disabling the ownership check in the
`checkDataDir()` function. Is this a reasonable approach, and are
there any caveats or unintended side effects I should be aware of?
**Disclaimer**: The z/OS NFS server is secured using AT-TLS and enforces
strict access control policies. My intention is not to weaken
PostgreSQL’s security model, but to adapt to platform-specific
constraints while maintaining overall security integrity.
Any insights, experiences, or alternative suggestions would be greatly
appreciated.
Best regards,
Amol
From | Date | Subject | |
---|---|---|---|
Next Message | Laurenz Albe | 2025-07-14 12:20:14 | Re: Bypassing Directory Ownership Check in PostgreSQL 16.6 with Secure z/OS NFS (AT-TLS) |
Previous Message | Ron Johnson | 2025-07-12 14:23:04 | Re: I have a suspicious query |