Allow SSL server key file to have group read access if owned by root
We used to require the server key file to have permissions 0600 or less
for best security. But some systems (such as Debian) have certificate
and key files managed by the operating system that can be shared with
other services. In those cases, the "postgres" user is made a member of
a special group that has access to those files, and the server key file
has permissions 0640. To accommodate that kind of setup, also allow the
key file to have permissions 0640 but only if owned by root.
From: Christoph Berg <myon@debian.org>
Reviewed-by: Alvaro Herrera <alvherre@alvh.no-ip.org>
Branch
------
master
Details
-------
http://git.postgresql.org/pg/commitdiff/9a83564c58b7f6363141a8f1d0c87c89a5ebab5d
Modified Files
--------------
doc/src/sgml/runtime.sgml | 13 ++++++++++++-
src/backend/libpq/be-secure-openssl.c | 33 ++++++++++++++++++++++++++++-----
2 files changed, 40 insertions(+), 6 deletions(-)
