Re: Securing "make check" (CVE-2014-0067)

On 03/02/2014 01:27 PM, Tom Lane wrote:

> Also, to what extent does any of this affect buildfarm animals? Whatever
> we do for "make check" will presumably make those tests safe for them,
> but how are the postmasters they test under "make installcheck" set up?
>

Nothing special.

"bin/initdb" -U buildfarm --locale=$locale data-$locale
...
"bin/pg_ctl" -D data-$locale -l logfile -w start

We have wide control over what's done, just let me know what's wanted.
For example, it would be pretty simple to make it use a non-standard
socket directory and turn tcp connections off on Unix, or to set up
password auth for that matter, assuming we already have a strong password.

I generally assume that people aren't running buildfarm animals on
general purpose multi-user machines, but it might be as well to take
precautions.

cheers

andrew