mirrors/postgres
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Check that the data directory does not have group or world access; remove

Browse Source 
a similar check on postgresql.conf.
This commit is contained in:
Peter Eisentraut 2001-08-06 13:45:15 +00:00
parent 46e252141b
commit f487e3da68
2 changed files with 18 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/backend/utils/init/miscinit.c
View File

@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/utils/init/miscinit.c,v 1.73 2001/07/03 16:49:48 tgl Exp $
* $Header: /cvsroot/pgsql/src/backend/utils/init/miscinit.c,v 1.74 2001/08/06 13:45:15 petere Exp $
*
*-------------------------------------------------------------------------
*/
@ -120,6 +120,7 @@ void
SetDataDir(const char *dir)
{
char *new;
struct stat stat_buf;
AssertArg(dir);
@ -162,6 +163,21 @@ SetDataDir(const char *dir)
if (!new)
elog(FATAL, "out of memory");
}
/*
* Check if the directory has group or world access. If so, reject.
*/
if (stat(new, &stat_buf) == -1)
{
free(new);
elog(FATAL, "could not read permissions of directory %s: %s", new, strerror(errno));
}
if (stat_buf.st_mode & (S_IRWXG | S_IRWXO))
{
free(new);
elog(FATAL, "data directory %s has group or world access; permissions should be u=rwx (0700)", new);
}
if (DataDir)
free(DataDir);

22
src/backend/utils/misc/guc-file.l
View File

@ -4,7 +4,7 @@
*
* Copyright 2000 by PostgreSQL Global Development Group
*
* $Header: /cvsroot/pgsql/src/backend/utils/misc/guc-file.l,v 1.8 2001/06/07 04:50:57 momjian Exp $
* $Header: /cvsroot/pgsql/src/backend/utils/misc/guc-file.l,v 1.9 2001/08/06 13:45:15 petere Exp $
*/
%{
@ -130,7 +130,6 @@ ProcessConfigFile(GucContext context)
int token, parse_state;
char *opt_name, *opt_value;
char *filename;
struct stat stat_buf;
struct name_value_pair *item, *head, *tail;
int elevel;
FILE * fp;
@ -161,25 +160,6 @@ ProcessConfigFile(GucContext context)
return;
}
/*
* Check if the file is group or world writeable. If so, reject.
*/
if (fstat(fileno(fp), &stat_buf) == -1)
{
FreeFile(fp);
free(filename);
elog(elevel, "could not stat configuration file `" CONFIG_FILENAME "': %s", strerror(errno));
return;
}
if (stat_buf.st_mode & (S_IWGRP | S_IXGRP | S_IWOTH | S_IXOTH))
{
FreeFile(fp);
free(filename);
elog(elevel, "configuration file `" CONFIG_FILENAME "' has wrong permissions");
return;
}
/*
* Parse
*/