From: | "Diego Elio Petten" <flameeyes(at)flameeyes(dot)eu> |
---|---|
To: | pgsql-bugs(at)postgresql(dot)org |
Subject: | BUG #6302: Certificate lookup fails for users with /dev/null as home directory |
Date: | 2011-11-20 13:45:37 |
Message-ID: | 201111201345.pAKDjbH5068726@wwwmaster.postgresql.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-bugs |
The following bug has been logged online:
Bug reference: 6302
Logged by: Diego Elio Pettenò
Email address: flameeyes(at)flameeyes(dot)eu
PostgreSQL version: 9.1.1
Operating system: Gentoo Linux
Description: Certificate lookup fails for users with /dev/null as
home directory
Details:
A common way to make sure an user has no access to a home directory on Unix
is to set that directory to /dev/null. Unfortunately that causes the stat()
call to return an error when you're trying to check for the certificate.
>From 9.1.1, src/interfaces/libpq/fe-secure.c, line 1009 and counting:
else if (stat(fnbuf, &buf) != 0)
{
/*
* If file is not present, just go on without a client cert;
server
* might or might not accept the connection. Any other
error,
* however, is grounds for complaint.
*/
if (errno != ENOENT)
{
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("could not open certificate file
\"%s\": %s\n"),
fnbuf,
pqStrerror(errno, sebuf, sizeof(sebuf)));
return -1;
}
have_cert = false;
}
Interestingly enough, the .pgpass file check is not as strict; from
fe-connect.c lines 4863 and counting:
if (!getPgPassFilename(pgpassfile))
return NULL;
/* If password file cannot be opened, ignore it. */
if (stat(pgpassfile, &stat_buf) != 0)
return NULL;
I suppose it might be a good idea to simply replicate the same logic for the
certificate, so that it restores the chance to use SSL connections on users
that have /dev/null as home directory, which right now is outright
impossible.
From | Date | Subject | |
---|---|---|---|
Next Message | Magnus Hagander | 2011-11-21 08:08:22 | Re: BUG #6302: Certificate lookup fails for users with /dev/null as home directory |
Previous Message | Tom Lane | 2011-11-19 17:57:44 | Re: BUG #6299: pg_dump, pg_dumpall - Problem with the order of backup functions |