BUG #6302: Certificate lookup fails for users with /dev/null as home directory

From: "Diego Elio Petten" <flameeyes(at)flameeyes(dot)eu>
To: pgsql-bugs(at)postgresql(dot)org
Subject: BUG #6302: Certificate lookup fails for users with /dev/null as home directory
Date: 2011-11-20 13:45:37
Message-ID: 201111201345.pAKDjbH5068726@wwwmaster.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs


The following bug has been logged online:

Bug reference: 6302
Logged by: Diego Elio Pettenò
Email address: flameeyes(at)flameeyes(dot)eu
PostgreSQL version: 9.1.1
Operating system: Gentoo Linux
Description: Certificate lookup fails for users with /dev/null as
home directory
Details:

A common way to make sure an user has no access to a home directory on Unix
is to set that directory to /dev/null. Unfortunately that causes the stat()
call to return an error when you're trying to check for the certificate.
>From 9.1.1, src/interfaces/libpq/fe-secure.c, line 1009 and counting:

else if (stat(fnbuf, &buf) != 0)
{
/*
* If file is not present, just go on without a client cert;
server
* might or might not accept the connection. Any other
error,
* however, is grounds for complaint.
*/
if (errno != ENOENT)
{
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("could not open certificate file
\"%s\": %s\n"),
fnbuf,
pqStrerror(errno, sebuf, sizeof(sebuf)));
return -1;
}
have_cert = false;
}

Interestingly enough, the .pgpass file check is not as strict; from
fe-connect.c lines 4863 and counting:

if (!getPgPassFilename(pgpassfile))
return NULL;

/* If password file cannot be opened, ignore it. */
if (stat(pgpassfile, &stat_buf) != 0)
return NULL;

I suppose it might be a good idea to simply replicate the same logic for the
certificate, so that it restores the chance to use SSL connections on users
that have /dev/null as home directory, which right now is outright
impossible.

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Magnus Hagander 2011-11-21 08:08:22 Re: BUG #6302: Certificate lookup fails for users with /dev/null as home directory
Previous Message Tom Lane 2011-11-19 17:57:44 Re: BUG #6299: pg_dump, pg_dumpall - Problem with the order of backup functions