pgsql: Allow root-owned SSL private keys in libpq, not only the backend

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Allow root-owned SSL private keys in libpq, not only the backend
Date: 2022-03-02 16:57:21
Message-ID: E1nPSHw-000bmH-Kk@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Allow root-owned SSL private keys in libpq, not only the backend.

This change makes libpq apply the same private-key-file ownership
and permissions checks that we have used in the backend since commit
9a83564c5. Namely, that the private key can be owned by either the
current user or root (with different file permissions allowed in the
two cases). This allows system-wide management of key files, which
is just as sensible on the client side as the server, particularly
when the client is itself some application daemon.

Sync the comments about this between libpq and the backend, too.

Back-patch of a59c79564 and 50f03473e into all supported branches.

David Steele

Discussion: https://postgr.es/m/f4b7bc55-97ac-9e69-7398-335e212f7743@pgmasters.net

Branch
------
REL_13_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/6599d8f1264299ee595f2eaf4dc6a9aa2d7940d2

Modified Files
--------------
doc/src/sgml/libpq.sgml | 26 +++++++++++++++------
src/backend/libpq/be-secure-common.c | 28 +++++++++++-----------
src/interfaces/libpq/fe-secure-openssl.c | 40 +++++++++++++++++++++++++++++---
3 files changed, 69 insertions(+), 25 deletions(-)

Responses

Browse pgsql-committers by date

  From Date Subject
Next Message Michael Paquier 2022-03-03 01:53:00 pgsql: Fix catalog data of pg_stop_backup(), labelled v2
Previous Message Tom Lane 2022-03-02 16:29:25 pgsql: Doc: update libpq.sgml for root-owned SSL private keys.