Commands linked to pg_wrapper not working with non-root users

Jonathan Leroy - Inikup <jonathan@inikup.com> writes:

Here's my issue : when I'm logged as an user which is not root or
postgresql, I can't use any of the commands linked to pg_wrapper:

user1@server1:~ $ /usr/bin/psql --version
Error: Invalid data directory

There's no error message with exactly that spelling in PG proper,
so it must be coming out of the wrapper script. At a guess, the
wrapper script thinks it should be able to examine the data directory,
but it can't because of restrictive file permissions. Why your
setup is triggering that when it works for other people, I can't say.

regards, tom lane

Jonathan Leroy - Inikup <jonathan@inikup.com> writes:

Hi,

I'm using multiples versions of PostgreSQL from the postgresql.org
repository (http://apt.postgresql.org/) on Debian Jessie, on multiples
servers.
Each postgresql-client-XX package depends on postgresql-client-common,
which provides the pg_wrapper script
(/usr/share/postgresql-common/pg_wrapper).

A lot of PostgreSQL commands are linked to pg_wrapper. E.g.:
/usr/bin/psql -> ../share/postgresql-common/pg_wrapper

Here's my issue : when I'm logged as an user which is not root or
postgresql, I can't use any of the commands linked to pg_wrapper:

user1@server1:~ $ /usr/bin/psql --version
Error: Invalid data directory

However, everything works with postgres or root user:

root@server1:~ # /usr/bin/psql --version
psql (PostgreSQL) 9.4.16

Also, everything works fine if I bypass pg_wrapper:

user1@server1:~ $ /usr/lib/postgresql/9.4/bin/psql --version
psql (PostgreSQL) 9.4.16

I am missing something ?

Thanks,

Check your settings in /etc/postgresql-common/user_clusters. The wrapper
script uses that file to determine what databases to connect to or what
is the user default database cluster. It can also be overridden with a
local ~/.postgresqlrc, so check there are no old settings there as well.

Tim

--
Tim Cross

2018-04-12 0:26 GMT+02:00 Tim Cross <theophilusx@gmail.com>:

Check your settings in /etc/postgresql-common/user_clusters. The wrapper
script uses that file to determine what databases to connect to or what
is the user default database cluster. It can also be overridden with a
local ~/.postgresqlrc, so check there are no old settings there as well.

Thank you Tim.

The file /etc/postgresql-common/user_clusters is empty on all servers
(it only contains comments). None of my users have a ~/.postgresqlrc
file.

--
Jonathan Leroy

On 04/11/2018 04:20 PM, Jonathan Leroy - Inikup wrote:

2018-04-12 0:26 GMT+02:00 Tim Cross <theophilusx@gmail.com>:

Check your settings in /etc/postgresql-common/user_clusters. The wrapper
script uses that file to determine what databases to connect to or what
is the user default database cluster. It can also be overridden with a
local ~/.postgresqlrc, so check there are no old settings there as well.

Thank you Tim.

The file /etc/postgresql-common/user_clusters is empty on all servers
(it only contains comments). None of my users have a ~/.postgresqlrc
file.

What are the permissions on /usr/bin/psql?

On my Ubuntu 16.04 instance I have:

lrwxrwxrwx 1 root root 37 Feb 8 04:55 /usr/bin/psql ->
../share/postgresql-common/pg_wrapper*

--
Adrian Klaver
adrian.klaver@aklaver.com

On 04/11/2018 04:20 PM, Jonathan Leroy - Inikup wrote:

2018-04-12 0:26 GMT+02:00 Tim Cross <theophilusx@gmail.com>:

Check your settings in /etc/postgresql-common/user_clusters. The wrapper
script uses that file to determine what databases to connect to or what
is the user default database cluster. It can also be overridden with a
local ~/.postgresqlrc, so check there are no old settings there as well.

Thank you Tim.

The file /etc/postgresql-common/user_clusters is empty on all servers
(it only contains comments). None of my users have a ~/.postgresqlrc
file.

Another thought do you have the PGDATA environment variable set for your
user1?

--
Adrian Klaver
adrian.klaver@aklaver.com

2018-04-12 1:32 GMT+02:00 Adrian Klaver <adrian.klaver@aklaver.com>:

What are the permissions on /usr/bin/psql?

On my Ubuntu 16.04 instance I have:

lrwxrwxrwx 1 root root 37 Feb 8 04:55 /usr/bin/psql ->
../share/postgresql-common/pg_wrapper*

I have exactly the same permissions on my side.
I don't think it's a permissions issue as I have the same exact error
on all my servers, which uses more or less the deb packages default
configuration.

--
Jonathan Leroy

2018-04-12 1:38 GMT+02:00 Adrian Klaver <adrian.klaver@aklaver.com>:

Another thought do you have the PGDATA environment variable set for your
user1?

Nope.

Maybe I will try to "dissect" pg_wrapper to find where the error
occurs, but the script is quite complex...

--
Jonathan Leroy

On 04/11/2018 04:49 PM, Jonathan Leroy - Inikup wrote:

2018-04-12 1:38 GMT+02:00 Adrian Klaver <adrian.klaver@aklaver.com>:

Another thought do you have the PGDATA environment variable set for your
user1?

Nope.

Maybe I will try to "dissect" pg_wrapper to find where the error
occurs, but the script is quite complex...

Does this happen for the other commands also? e.g:

pg_dump -V

Also what happens if you do:

psql 9.4 main -V

Substituting your cluster name for main if required.

--
Adrian Klaver
adrian.klaver@aklaver.com

On 04/11/2018 04:49 PM, Jonathan Leroy - Inikup wrote:

2018-04-12 1:38 GMT+02:00 Adrian Klaver <adrian.klaver@aklaver.com>:

Another thought do you have the PGDATA environment variable set for your
user1?

Nope.

Maybe I will try to "dissect" pg_wrapper to find where the error
occurs, but the script is quite complex...

Sorry that should have been:

psql --cluster 10/main --version

--
Adrian Klaver
adrian.klaver@aklaver.com

2018-04-12 1:49 GMT+02:00 Jonathan Leroy - Inikup <jonathan@inikup.com>:

Maybe I will try to "dissect" pg_wrapper to find where the error
occurs, but the script is quite complex...

OK, I've found the issue : pg_wrapper is trying to get the value of
the "data_directory" setting by reading the postgresql.conf file.
However, my user can't access the postgresql.conf file.

So I've bootstrapped a fresh Debian 8 VM with just postgresql-9.6, and
compared files permissions between that VM and my production servers.
All my production postgresql.conf files have a chmod 640 vs 644 on my new VM.

After digging, I've found that the SaltStack recipe who configure all
my servers force the file chmod to 640...
I've fixed it: everything works now. :)

Thank you all for your help!

--
Jonathan Leroy

On 04/11/2018 05:36 PM, Jonathan Leroy - Inikup wrote:

2018-04-12 1:49 GMT+02:00 Jonathan Leroy - Inikup <jonathan@inikup.com>:

Maybe I will try to "dissect" pg_wrapper to find where the error
occurs, but the script is quite complex...

OK, I've found the issue : pg_wrapper is trying to get the value of
the "data_directory" setting by reading the postgresql.conf file.
However, my user can't access the postgresql.conf file.

So I've bootstrapped a fresh Debian 8 VM with just postgresql-9.6, and
compared files permissions between that VM and my production servers.
All my production postgresql.conf files have a chmod 640 vs 644 on my new VM.

After digging, I've found that the SaltStack recipe who configure all
my servers force the file chmod to 640...
I've fixed it: everything works now. :)

Great. Thanks for the follow up.

Thank you all for your help!

--
Adrian Klaver
adrian.klaver@aklaver.com