mirrors/postgres
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

#ifdef out file permissions check on SSL key file when on Windows, as

Browse Source 
we also have done for the data directory permissions check.

Dave Page
This commit is contained in:
Tom Lane 2004-06-25 15:07:52 +00:00
parent 7d7806d0a2
commit ef2880263c
1 changed files with 12 additions and 1 deletions

13
src/backend/libpq/be-secure.c

@ -11,7 +11,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.45 2003/12/18 22:49:26 tgl Exp $ * $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.46 2004/06/25 15:07:52 tgl Exp $
* *
* Since the server static private key ($DataDir/server.key) * Since the server static private key ($DataDir/server.key)
* will normally be stored unencrypted so that the database * will normally be stored unencrypted so that the database
@ -650,6 +650,16 @@ initialize_SSL(void)
(errcode_for_file_access(), (errcode_for_file_access(),
errmsg("could not access private key file \"%s\": %m", errmsg("could not access private key file \"%s\": %m",
fnbuf))); fnbuf)));
/*
* Require no public access to key file.
*
* XXX temporarily suppress check when on Windows, because there may
* not be proper support for Unix-y file permissions. Need to think
* of a reasonable check to apply on Windows. (See also the data
* directory permission check in postmaster.c)
*/
#if !defined(__CYGWIN__) && !defined(WIN32)
if (!S_ISREG(buf.st_mode) || (buf.st_mode & (S_IRWXG | S_IRWXO)) || if (!S_ISREG(buf.st_mode) || (buf.st_mode & (S_IRWXG | S_IRWXO)) ||
buf.st_uid != getuid()) buf.st_uid != getuid())
ereport(FATAL, ereport(FATAL,
@ -657,6 +667,7 @@ initialize_SSL(void)
errmsg("unsafe permissions on private key file \"%s\"", errmsg("unsafe permissions on private key file \"%s\"",
fnbuf), fnbuf),
errdetail("File must be owned by the database user and must have no permissions for \"group\" or \"other\"."))); errdetail("File must be owned by the database user and must have no permissions for \"group\" or \"other\".")));
#endif
if (!SSL_CTX_use_PrivateKey_file(SSL_context, fnbuf, SSL_FILETYPE_PEM)) if (!SSL_CTX_use_PrivateKey_file(SSL_context, fnbuf, SSL_FILETYPE_PEM))
ereport(FATAL, ereport(FATAL,