PostgreSQL Source Code  git master
be-secure-common.c File Reference
#include "postgres.h"
#include <sys/stat.h>
#include <unistd.h>
#include "common/string.h"
#include "libpq/libpq.h"
#include "storage/fd.h"
Include dependency graph for be-secure-common.c:

Go to the source code of this file.

Functions

int run_ssl_passphrase_command (const char *prompt, bool is_server_start, char *buf, int size)
 
bool check_ssl_key_file_permissions (const char *ssl_key_file, bool isServerStart)
 

Function Documentation

◆ check_ssl_key_file_permissions()

bool check_ssl_key_file_permissions ( const char *  ssl_key_file,
bool  isServerStart 
)

Definition at line 132 of file be-secure-common.c.

133 {
134  int loglevel = isServerStart ? FATAL : LOG;
135  struct stat buf;
136 
137  if (stat(ssl_key_file, &buf) != 0)
138  {
139  ereport(loglevel,
141  errmsg("could not access private key file \"%s\": %m",
142  ssl_key_file)));
143  return false;
144  }
145 
146  /* Key file must be a regular file */
147  if (!S_ISREG(buf.st_mode))
148  {
149  ereport(loglevel,
150  (errcode(ERRCODE_CONFIG_FILE_ERROR),
151  errmsg("private key file \"%s\" is not a regular file",
152  ssl_key_file)));
153  return false;
154  }
155 
156  /*
157  * Refuse to load key files owned by users other than us or root, and
158  * require no public access to the key file. If the file is owned by us,
159  * require mode 0600 or less. If owned by root, require 0640 or less to
160  * allow read access through either our gid or a supplementary gid that
161  * allows us to read system-wide certificates.
162  *
163  * Note that roughly similar checks are performed in
164  * src/interfaces/libpq/fe-secure-openssl.c so any changes here may need
165  * to be made there as well. The environment is different though; this
166  * code can assume that we're not running as root.
167  *
168  * Ideally we would do similar permissions checks on Windows, but it is
169  * not clear how that would work since Unix-style permissions may not be
170  * available.
171  */
172 #if !defined(WIN32) && !defined(__CYGWIN__)
173  if (buf.st_uid != geteuid() && buf.st_uid != 0)
174  {
175  ereport(loglevel,
176  (errcode(ERRCODE_CONFIG_FILE_ERROR),
177  errmsg("private key file \"%s\" must be owned by the database user or root",
178  ssl_key_file)));
179  return false;
180  }
181 
182  if ((buf.st_uid == geteuid() && buf.st_mode & (S_IRWXG | S_IRWXO)) ||
183  (buf.st_uid == 0 && buf.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)))
184  {
185  ereport(loglevel,
186  (errcode(ERRCODE_CONFIG_FILE_ERROR),
187  errmsg("private key file \"%s\" has group or world access",
188  ssl_key_file),
189  errdetail("File must have permissions u=rw (0600) or less if owned by the database user, or permissions u=rw,g=r (0640) or less if owned by root.")));
190  return false;
191  }
192 #endif
193 
194  return true;
195 }
char * ssl_key_file
Definition: be-secure.c:42
int errcode_for_file_access(void)
Definition: elog.c:716
int errdetail(const char *fmt,...)
Definition: elog.c:1037
int errcode(int sqlerrcode)
Definition: elog.c:693
int errmsg(const char *fmt,...)
Definition: elog.c:904
#define LOG
Definition: elog.h:25
#define FATAL
Definition: elog.h:35
#define ereport(elevel,...)
Definition: elog.h:143
static char * buf
Definition: pg_test_fsync.c:67
#define S_IXGRP
Definition: win32_port.h:306
#define stat
Definition: win32_port.h:283
#define S_IRWXG
Definition: win32_port.h:309
#define S_IRWXO
Definition: win32_port.h:321
#define S_ISREG(m)
Definition: win32_port.h:327
#define S_IWGRP
Definition: win32_port.h:303

References buf, ereport, errcode(), errcode_for_file_access(), errdetail(), errmsg(), FATAL, LOG, S_IRWXG, S_IRWXO, S_ISREG, S_IWGRP, S_IXGRP, ssl_key_file, and stat.

Referenced by be_tls_init().

◆ run_ssl_passphrase_command()

int run_ssl_passphrase_command ( const char *  prompt,
bool  is_server_start,
char *  buf,
int  size 
)

Definition at line 39 of file be-secure-common.c.

40 {
41  int loglevel = is_server_start ? ERROR : LOG;
42  StringInfoData command;
43  char *p;
44  FILE *fh;
45  int pclose_rc;
46  size_t len = 0;
47 
48  Assert(prompt);
49  Assert(size > 0);
50  buf[0] = '\0';
51 
52  initStringInfo(&command);
53 
54  for (p = ssl_passphrase_command; *p; p++)
55  {
56  if (p[0] == '%')
57  {
58  switch (p[1])
59  {
60  case 'p':
61  appendStringInfoString(&command, prompt);
62  p++;
63  break;
64  case '%':
65  appendStringInfoChar(&command, '%');
66  p++;
67  break;
68  default:
69  appendStringInfoChar(&command, p[0]);
70  }
71  }
72  else
73  appendStringInfoChar(&command, p[0]);
74  }
75 
76  fh = OpenPipeStream(command.data, "r");
77  if (fh == NULL)
78  {
79  ereport(loglevel,
81  errmsg("could not execute command \"%s\": %m",
82  command.data)));
83  goto error;
84  }
85 
86  if (!fgets(buf, size, fh))
87  {
88  if (ferror(fh))
89  {
90  explicit_bzero(buf, size);
91  ereport(loglevel,
93  errmsg("could not read from command \"%s\": %m",
94  command.data)));
95  goto error;
96  }
97  }
98 
99  pclose_rc = ClosePipeStream(fh);
100  if (pclose_rc == -1)
101  {
102  explicit_bzero(buf, size);
103  ereport(loglevel,
105  errmsg("could not close pipe to external command: %m")));
106  goto error;
107  }
108  else if (pclose_rc != 0)
109  {
110  explicit_bzero(buf, size);
111  ereport(loglevel,
113  errmsg("command \"%s\" failed",
114  command.data),
115  errdetail_internal("%s", wait_result_to_str(pclose_rc))));
116  goto error;
117  }
118 
119  /* strip trailing newline and carriage return */
120  len = pg_strip_crlf(buf);
121 
122 error:
123  pfree(command.data);
124  return len;
125 }
char * ssl_passphrase_command
Definition: be-secure.c:47
int errdetail_internal(const char *fmt,...)
Definition: elog.c:1064
#define ERROR
Definition: elog.h:33
int ClosePipeStream(FILE *file)
Definition: fd.c:2870
FILE * OpenPipeStream(const char *command, const char *mode)
Definition: fd.c:2564
Assert(fmt[strlen(fmt) - 1] !='\n')
void pfree(void *pointer)
Definition: mcxt.c:1175
const void size_t len
void explicit_bzero(void *buf, size_t len)
static void error(void)
Definition: sql-dyntest.c:147
int pg_strip_crlf(char *str)
Definition: string.c:121
void appendStringInfoString(StringInfo str, const char *s)
Definition: stringinfo.c:176
void appendStringInfoChar(StringInfo str, char ch)
Definition: stringinfo.c:188
void initStringInfo(StringInfo str)
Definition: stringinfo.c:59
char * wait_result_to_str(int exitstatus)
Definition: wait_error.c:32

References appendStringInfoChar(), appendStringInfoString(), Assert(), buf, ClosePipeStream(), StringInfoData::data, ereport, errcode_for_file_access(), errdetail_internal(), errmsg(), ERROR, error(), explicit_bzero(), initStringInfo(), len, LOG, OpenPipeStream(), pfree(), pg_strip_crlf(), ssl_passphrase_command, and wait_result_to_str().

Referenced by ssl_external_passwd_cb().