From da9b580d89903fee871cf54845ffa2b26bda2e11 Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Sat, 7 Apr 2018 17:45:39 -0400 Subject: Refactor dir/file permissions Consolidate directory and file create permissions for tools which work with the PG data directory by adding a new module (common/file_perm.c) that contains variables (pg_file_create_mode, pg_dir_create_mode) and constants to initialize them (0600 for files and 0700 for directories). Convert mkdir() calls in the backend to MakePGDirectory() if the original call used default permissions (always the case for regular PG directories). Add tests to make sure permissions in PGDATA are set correctly by the tools which modify the PG data directory. Authors: David Steele , Adam Brightwell Reviewed-By: Michael Paquier, with discussion amongst many others. Discussion: https://postgr.es/m/ad346fe6-b23e-59f1-ecb7-0e08390ad629%40pgmasters.net --- src/backend/utils/init/miscinit.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'src/backend/utils/init/miscinit.c') diff --git a/src/backend/utils/init/miscinit.c b/src/backend/utils/init/miscinit.c index 87ed7d3f715..f8f08f3f88b 100644 --- a/src/backend/utils/init/miscinit.c +++ b/src/backend/utils/init/miscinit.c @@ -32,6 +32,7 @@ #include "access/htup_details.h" #include "catalog/pg_authid.h" +#include "common/file_perm.h" #include "libpq/libpq.h" #include "mb/pg_wchar.h" #include "miscadmin.h" @@ -831,7 +832,7 @@ CreateLockFile(const char *filename, bool amPostmaster, * Think not to make the file protection weaker than 0600. See * comments below. */ - fd = open(filename, O_RDWR | O_CREAT | O_EXCL, 0600); + fd = open(filename, O_RDWR | O_CREAT | O_EXCL, pg_file_create_mode); if (fd >= 0) break; /* Success; exit the retry loop */ @@ -848,7 +849,7 @@ CreateLockFile(const char *filename, bool amPostmaster, * Read the file to get the old owner's PID. Note race condition * here: file might have been deleted since we tried to create it. */ - fd = open(filename, O_RDONLY, 0600); + fd = open(filename, O_RDONLY, pg_file_create_mode); if (fd < 0) { if (errno == ENOENT) -- cgit v1.2.3