From: | PG Doc comments form <noreply(at)postgresql(dot)org> |
---|---|
To: | pgsql-docs(at)lists(dot)postgresql(dot)org |
Cc: | bgiles(at)coyotesong(dot)com |
Subject: | Improved security for https://www.postgresql.org/docs/current/install-make.html |
Date: | 2024-11-06 21:58:13 |
Message-ID: | 173093029303.708.7136095929535895689@wrigleys.postgresql.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-docs |
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/17/install-make.html
Description:
The current 'short' version is
```
./configure
make
su
make install
adduser postgres
mkdir -p /usr/local/pgsql/data
chown postgres /usr/local/pgsql/data
su - postgres
/usr/local/pgsql/bin/initdb -D /usr/local/pgsql/data
/usr/local/pgsql/bin/pg_ctl -D /usr/local/pgsql/data -l logfile start
/usr/local/pgsql/bin/createdb test
/usr/local/pgsql/bin/psql test
```
The security could be improved by limiting the amount of work that is done
as root. (sudo make
install -- shudder!)
First, split `make install` so `make build` gets as far as building the
libraries **under the current directory**, not on location in the start
directory.
Second, verify that `make install` does nothing but create directories and
copy files into them. It can probably also include the tasks currently done
by `make installdir` but the latter might still be required by some external
process. This target should be reviewed by security experts.
The 'short' script can then be rewritten as
```
# work done as a regular user
./configure
make build
# work that requires ROOT access
su
mkdir /usr/local/pgsql/data
chown (current user):(current group) /usr/local/pgsql
adduser --system --group postgres
exit
# work that requires POSTGRES access
su -u postgres
make install installdirs
exit
# work that requires ROOT access
su
adduser --system --group postgres
chown -R postgres:postgres /usr/local/pgsql
exit
# work that requires POSTGRES access
su - postgres
/usr/local/pgsql/bin/initdb -D /usr/local/pgsql/data
/usr/local/pgsql/bin/pg_ctl -D /usr/local/pgsql/data -l logfile start
/usr/local/pgsql/bin/createdb test
/usr/local/pgsql/bin/psql test
exit
```
From | Date | Subject | |
---|---|---|---|
Previous Message | Daniel Gustafsson | 2024-11-06 19:39:35 | Re: A minor bug in doc. Hovering over heading shows # besides it. |