PostgreSQL Source Code  git master
be-secure-common.c
Go to the documentation of this file.
1 /*-------------------------------------------------------------------------
2  *
3  * be-secure-common.c
4  *
5  * common implementation-independent SSL support code
6  *
7  * While be-secure.c contains the interfaces that the rest of the
8  * communications code calls, this file contains support routines that are
9  * used by the library-specific implementations such as be-secure-openssl.c.
10  *
11  * Portions Copyright (c) 1996-2022, PostgreSQL Global Development Group
12  * Portions Copyright (c) 1994, Regents of the University of California
13  *
14  * IDENTIFICATION
15  * src/backend/libpq/be-secure-common.c
16  *
17  *-------------------------------------------------------------------------
18  */
19 
20 #include "postgres.h"
21 
22 #include <sys/stat.h>
23 #include <unistd.h>
24 
25 #include "common/string.h"
26 #include "libpq/libpq.h"
27 #include "storage/fd.h"
28 
29 /*
30  * Run ssl_passphrase_command
31  *
32  * prompt will be substituted for %p. is_server_start determines the loglevel
33  * of error messages.
34  *
35  * The result will be put in buffer buf, which is of size size. The return
36  * value is the length of the actual result.
37  */
38 int
39 run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf, int size)
40 {
41  int loglevel = is_server_start ? ERROR : LOG;
42  StringInfoData command;
43  char *p;
44  FILE *fh;
45  int pclose_rc;
46  size_t len = 0;
47 
48  Assert(prompt);
49  Assert(size > 0);
50  buf[0] = '\0';
51 
52  initStringInfo(&command);
53 
54  for (p = ssl_passphrase_command; *p; p++)
55  {
56  if (p[0] == '%')
57  {
58  switch (p[1])
59  {
60  case 'p':
61  appendStringInfoString(&command, prompt);
62  p++;
63  break;
64  case '%':
65  appendStringInfoChar(&command, '%');
66  p++;
67  break;
68  default:
69  appendStringInfoChar(&command, p[0]);
70  }
71  }
72  else
73  appendStringInfoChar(&command, p[0]);
74  }
75 
76  fh = OpenPipeStream(command.data, "r");
77  if (fh == NULL)
78  {
79  ereport(loglevel,
81  errmsg("could not execute command \"%s\": %m",
82  command.data)));
83  goto error;
84  }
85 
86  if (!fgets(buf, size, fh))
87  {
88  if (ferror(fh))
89  {
90  explicit_bzero(buf, size);
91  ereport(loglevel,
93  errmsg("could not read from command \"%s\": %m",
94  command.data)));
95  goto error;
96  }
97  }
98 
99  pclose_rc = ClosePipeStream(fh);
100  if (pclose_rc == -1)
101  {
102  explicit_bzero(buf, size);
103  ereport(loglevel,
105  errmsg("could not close pipe to external command: %m")));
106  goto error;
107  }
108  else if (pclose_rc != 0)
109  {
110  explicit_bzero(buf, size);
111  ereport(loglevel,
113  errmsg("command \"%s\" failed",
114  command.data),
115  errdetail_internal("%s", wait_result_to_str(pclose_rc))));
116  goto error;
117  }
118 
119  /* strip trailing newline and carriage return */
120  len = pg_strip_crlf(buf);
121 
122 error:
123  pfree(command.data);
124  return len;
125 }
126 
127 
128 /*
129  * Check permissions for SSL key files.
130  */
131 bool
132 check_ssl_key_file_permissions(const char *ssl_key_file, bool isServerStart)
133 {
134  int loglevel = isServerStart ? FATAL : LOG;
135  struct stat buf;
136 
137  if (stat(ssl_key_file, &buf) != 0)
138  {
139  ereport(loglevel,
141  errmsg("could not access private key file \"%s\": %m",
142  ssl_key_file)));
143  return false;
144  }
145 
146  /* Key file must be a regular file */
147  if (!S_ISREG(buf.st_mode))
148  {
149  ereport(loglevel,
150  (errcode(ERRCODE_CONFIG_FILE_ERROR),
151  errmsg("private key file \"%s\" is not a regular file",
152  ssl_key_file)));
153  return false;
154  }
155 
156  /*
157  * Refuse to load key files owned by users other than us or root, and
158  * require no public access to the key file. If the file is owned by us,
159  * require mode 0600 or less. If owned by root, require 0640 or less to
160  * allow read access through either our gid or a supplementary gid that
161  * allows us to read system-wide certificates.
162  *
163  * Note that roughly similar checks are performed in
164  * src/interfaces/libpq/fe-secure-openssl.c so any changes here may need
165  * to be made there as well. The environment is different though; this
166  * code can assume that we're not running as root.
167  *
168  * Ideally we would do similar permissions checks on Windows, but it is
169  * not clear how that would work since Unix-style permissions may not be
170  * available.
171  */
172 #if !defined(WIN32) && !defined(__CYGWIN__)
173  if (buf.st_uid != geteuid() && buf.st_uid != 0)
174  {
175  ereport(loglevel,
176  (errcode(ERRCODE_CONFIG_FILE_ERROR),
177  errmsg("private key file \"%s\" must be owned by the database user or root",
178  ssl_key_file)));
179  return false;
180  }
181 
182  if ((buf.st_uid == geteuid() && buf.st_mode & (S_IRWXG | S_IRWXO)) ||
183  (buf.st_uid == 0 && buf.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)))
184  {
185  ereport(loglevel,
186  (errcode(ERRCODE_CONFIG_FILE_ERROR),
187  errmsg("private key file \"%s\" has group or world access",
188  ssl_key_file),
189  errdetail("File must have permissions u=rw (0600) or less if owned by the database user, or permissions u=rw,g=r (0640) or less if owned by root.")));
190  return false;
191  }
192 #endif
193 
194  return true;
195 }
bool check_ssl_key_file_permissions(const char *ssl_key_file, bool isServerStart)
int run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf, int size)
char * ssl_passphrase_command
Definition: be-secure.c:45
char * ssl_key_file
Definition: be-secure.c:40
int errdetail_internal(const char *fmt,...)
Definition: elog.c:1066
int errcode_for_file_access(void)
Definition: elog.c:718
int errdetail(const char *fmt,...)
Definition: elog.c:1039
int errcode(int sqlerrcode)
Definition: elog.c:695
int errmsg(const char *fmt,...)
Definition: elog.c:906
#define LOG
Definition: elog.h:27
#define FATAL
Definition: elog.h:37
#define ERROR
Definition: elog.h:35
#define ereport(elevel,...)
Definition: elog.h:145
int ClosePipeStream(FILE *file)
Definition: fd.c:2791
FILE * OpenPipeStream(const char *command, const char *mode)
Definition: fd.c:2486
Assert(fmt[strlen(fmt) - 1] !='\n')
void pfree(void *pointer)
Definition: mcxt.c:1306
const void size_t len
static char * buf
Definition: pg_test_fsync.c:67
void explicit_bzero(void *buf, size_t len)
static void error(void)
Definition: sql-dyntest.c:147
int pg_strip_crlf(char *str)
Definition: string.c:155
void appendStringInfoString(StringInfo str, const char *s)
Definition: stringinfo.c:176
void appendStringInfoChar(StringInfo str, char ch)
Definition: stringinfo.c:188
void initStringInfo(StringInfo str)
Definition: stringinfo.c:59
char * wait_result_to_str(int exitstatus)
Definition: wait_error.c:33
#define S_IXGRP
Definition: win32_port.h:309
#define stat
Definition: win32_port.h:286
#define S_IRWXG
Definition: win32_port.h:312
#define S_IRWXO
Definition: win32_port.h:324
#define S_ISREG(m)
Definition: win32_port.h:330
#define S_IWGRP
Definition: win32_port.h:306