From 6fa9c9d427352a01d589ce1871b6adecd88cf49c Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Tue, 7 Apr 2015 11:21:17 +0900 Subject: [PATCH 1/2] Fix process handling of pg_rewind To begin with, pg_rewind should not be allowed to run as root on non-Windows platforms as it manipulates data folders, and file permissions. On Windows platforms, it can run under a user that has Administrator rights but in this case a restricted token needs to be used. --- src/bin/pg_rewind/pg_rewind.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/bin/pg_rewind/pg_rewind.c b/src/bin/pg_rewind/pg_rewind.c index dda3a79..200e001 100644 --- a/src/bin/pg_rewind/pg_rewind.c +++ b/src/bin/pg_rewind/pg_rewind.c @@ -24,6 +24,7 @@ #include "access/xlog_internal.h" #include "catalog/catversion.h" #include "catalog/pg_control.h" +#include "common/restricted_token.h" #include "getopt_long.h" #include "storage/bufpage.h" @@ -174,6 +175,21 @@ main(int argc, char **argv) exit(1); } + /* + * Don't allow pg_rewind to be run as root, to avoid overwriting the + * ownership of files in the data directory. We need only check for root + * -- any other user won't have sufficient permissions to modify files in + * the data directory. + */ +#ifndef WIN32 + if (geteuid() == 0) + pg_fatal("cannot be executed by \"root\"\n" + "You must run %s as the PostgreSQL superuser.\n", + progname); +#endif + + get_restricted_token(progname); + /* Connect to remote server */ if (connstr_source) libpqConnect(connstr_source); -- 2.3.5