Thread: pgsql: Allow root-owned SSL private keys in libpq, not only the backend
Allow root-owned SSL private keys in libpq, not only the backend. This change makes libpq apply the same private-key-file ownership and permissions checks that we have used in the backend since commit 9a83564c5. Namely, that the private key can be owned by either the current user or root (with different file permissions allowed in the two cases). This allows system-wide management of key files, which is just as sensible on the client side as the server, particularly when the client is itself some application daemon. Sync the comments about this between libpq and the backend, too. Back-patch of a59c79564 and 50f03473e into all supported branches. David Steele Discussion: https://postgr.es/m/f4b7bc55-97ac-9e69-7398-335e212f7743@pgmasters.net Branch ------ REL_13_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/6599d8f1264299ee595f2eaf4dc6a9aa2d7940d2 Modified Files -------------- doc/src/sgml/libpq.sgml | 26 +++++++++++++++------ src/backend/libpq/be-secure-common.c | 28 +++++++++++----------- src/interfaces/libpq/fe-secure-openssl.c | 40 +++++++++++++++++++++++++++++--- 3 files changed, 69 insertions(+), 25 deletions(-)
Re: pgsql: Allow root-owned SSL private keys in libpq, not only the backend
From
Peter Eisentraut
Date:
On 02.03.22 17:57, Tom Lane wrote:
> Allow root-owned SSL private keys in libpq, not only the backend.
>
> This change makes libpq apply the same private-key-file ownership
> and permissions checks that we have used in the backend since commit
> 9a83564c5. Namely, that the private key can be owned by either the
> current user or root (with different file permissions allowed in the
> two cases). This allows system-wide management of key files, which
> is just as sensible on the client side as the server, particularly
> when the client is itself some application daemon.
>
> Sync the comments about this between libpq and the backend, too.
>
> Back-patch of a59c79564 and 50f03473e into all supported branches.
I think this
libpq_gettext("private key file \"%s\" is not a regular file"),
should have a trailing newline in the string.
Peter Eisentraut <peter.eisentraut@enterprisedb.com> writes:
> I think this
> libpq_gettext("private key file \"%s\" is not a regular file"),
> should have a trailing newline in the string.
Thanks, will fix.
regards, tom lane