Window2012R2: initdb error: "The current directory is invalid."

Huong Dangminh schrieb am 19.01.2016 um 11:49:

I have failed in execute initdb in "c:\Windows\Temp\dir" folder as
reproduce logs below. The OS's messages "The current directory is invalid."
was returned.

c:\Windows has special protection and it is not really surprising that a
regular user isn't allowed to write into that directory.

When Postgres is started it drops all "Administrator" privileges
for security reasons (older versions would refuse to start as
Administrator) - and I think initdb is doing the same thing.
So it's understandable that it can't write to c:\Windows

Putting application data into c:\Windows (or "c:\Program Files" for that matter)
is an extremely bad idea to begin with (c:\Windows being even worse than "c:\Program Files")

You shouldn't be doing that anyway.

Thomas

--
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

Hi,

Thanks for reply sir,

-----Original Message-----
From: pgsql-bugs-owner@postgresql.org [mailto:pgsql-bugs-
owner@postgresql.org] On Behalf Of Thomas Kellerer
Sent: 19 Tháng Giêng 2016 9:08 CH
To: pgsql-bugs@postgresql.org
Subject: Re: [BUGS] Window2012R2: initdb error: "The current directory is
invalid."

Huong Dangminh schrieb am 19.01.2016 um 11:49:

I have failed in execute initdb in "c:\Windows\Temp\dir" folder as
reproduce logs below. The OS's messages "The current directory is invalid."
was returned.

c:\Windows has special protection and it is not really surprising that a regular
user isn't allowed to write into that directory.

When Postgres is started it drops all "Administrator" privileges for security
reasons (older versions would refuse to start as
Administrator) - and I think initdb is doing the same thing.
So it's understandable that it can't write to c:\Windows

I did not mean, create data cluster in C drive made that error sir.
This issue reproduce in all drive specified in -D option.
# My reproduce environment is only one (C) drive. So, sorry for the log.

I mean, it happen when current directory of command line is "c:\Windows\Temp\something".
It is rare case, and may be a Windows2012's specification, but i don't know
why only "c:\Windows\Temp\something" and are there another case like that?

Putting application data into c:\Windows (or "c:\Program Files" for that
matter) is an extremely bad idea to begin with (c:\Windows being even
worse than "c:\Program Files")

You shouldn't be doing that anyway.

Thomas

Thanks and best regards,
bocap.

--
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org) To make
changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 2016.0.7303 / Virus Database: 4489/11436 - Release Date: 01/19/16

--
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

On 2016-01-19 22:45, Dang Minh Huong wrote:

owner@postgresql.org] On Behalf Of Thomas Kellerer
Huong Dangminh schrieb am 19.01.2016 um 11:49:

I have failed in execute initdb in "c:\Windows\Temp\dir" folder as
reproduce logs below. The OS's messages "The current directory is invalid."
was returned.

c:\Windows has special protection and it is not really surprising that a regular
user isn't allowed to write into that directory.

When Postgres is started it drops all "Administrator" privileges for security
reasons (older versions would refuse to start as
Administrator) - and I think initdb is doing the same thing.
So it's understandable that it can't write to c:\Windows

I did not mean, create data cluster in C drive made that error sir.
This issue reproduce in all drive specified in -D option.
# My reproduce environment is only one (C) drive. So, sorry for the log.

I mean, it happen when current directory of command line is "c:\Windows\Temp\something".
It is rare case, and may be a Windows2012's specification, but i don't know
why only "c:\Windows\Temp\something" and are there another case like that?

Putting application data into c:\Windows (or "c:\Program Files" for that
matter) is an extremely bad idea to begin with (c:\Windows being even
worse than "c:\Program Files")

You shouldn't be doing that anyway.

As Thomas said, it is undesireable to log into a server as
administrator. You should create and use a privileged user, for
example dmhadmin, insert that user into the administrators
group. Also create an ordinary user, perhaps dmh, and log in
with that account. Download the postgres installer, run it as
the ordinary user. You will be prompted for a privileged user
account, enter the priviledged account (for example, dmhadmin).
When asked for the location to install the database, create a
new folder named postgres on a non-system (not C:) disk. If your
server can only have one disk you might install the database in
C:\postgres, which you'll have the opportunity to create from
inside the installer's "browse..." dialog. This folder will be
owned by the local server's "administrators" group with
appropriate privileges.

C:\Windows\Temp is not an appropriate choice for storing
persistent program data. If you ignore this by manipulating the
permissions you will eventually be harmed when a privileged
program clears the entire contents.

Hope that helps,
--
Charles

--
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

On 19 January 2016 at 18:49, Huong Dangminh <huo-dangminh@ys.jp.nec.com>
wrote:

Hi all,

I have failed in execute initdb in "c:\Windows\Temp\dir" folder as
reproduce logs below. The OS's messages "The current directory is invalid."
was returned.

Is that directory or any parent of it a junction point?

http://www.nirsoft.net/utils/ntfs_links_view.html

http://superuser.com/q/823959

Also, why would you possibly run the installer from there? You should be
using %TEMP% which should generally resolve
to C:\Users\{Username}\AppData\Local\Temp or similar.

creating template1 database in c:/testdb/base/1 ... The current directory
is invalid.

It looks like somehow the current working directory is unmapped or cannot
be found.

Is there any chance you have mapped network drives in use?

--
Craig Ringer http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services

Hi,

Thanks for reply sir,

On 19 January 2016 at 18:49, Huong Dangminh <huo-dangminh@ys.jp.nec.com
<mailto:huo-dangminh@ys.jp.nec.com> > wrote:

Hi all,

I have failed in execute initdb in "c:\Windows\Temp\dir" folder
as
reproduce logs below. The OS's messages "The current directory is
invalid."
was returned.

Is that directory or any parent of it a junction point?

http://www.nirsoft.net/utils/ntfs_links_view.html

http://superuser.com/q/823959

No, sir. As my confirmed results below.

---
c:\>dir c:\Windows | find "Temp"
2016/01/08 11:55 <DIR> CbsTemp
2016/01/20 13:10 <DIR> Temp

c:\>dir c:\Windows\temp\ | find "dir"
2016/01/19 18:55 <DIR> dir

c:\>
---

Also, why would you possibly run the installer from there? You should be
using %TEMP% which should generally resolve to
C:\Users\{Username}\AppData\Local\Temp or similar.

Yes, I think it should be %USERPROFILE%\AppData\Local\Temp
(we specified %TEMP% or %TMP% when create installer).
But in one of my customer's environment, it became "c:\Windows\Temp\ ".

creating template1 database in c:/testdb/base/1 ... The current
directory is invalid.

It looks like somehow the current working directory is unmapped or cannot
be found.

Is there any chance you have mapped network drives in use?

No sir, I have only one drive (C) in reproduce environment.

I have tested some more case and found that,
In Windows2012, execute some command in folder which is subordinate
of "C:\Windows\TEMP\" with user that insufficient permission to
access that folder will produce this error.

initdb was executed with "Administrator" privileges, but
then initdb do popen() with none "Administrator" privileges
(by child process).
Child process not have enough privileges to access to
Current folder ("c:\Windows\Temp\dir"), so the
"The current directory is invalid." message was produced.

I found this phenomenon only in "C:\Windows\TEMP\" (Windows2012R2).

Best regards,
Dang Minh Huong
NEC Solution Innovators, Ltd.
http://www.nec-solutioninnovators.co.jp/en/

--

Craig Ringer http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services

--
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

On 20 January 2016 at 16:22, Huong Dangminh <huo-dangminh@ys.jp.nec.com>
wrote:

initdb was executed with "Administrator" privileges, but
then initdb do popen() with none "Administrator" privileges
(by child process).

That makes sense. It intentionally drops privileges.

You probably have to set the ACLs up so that it can still see and write to
the directory even after it has dropped privileges. That will include
setting ACLs on the parent directories so that it can see inside them.
Explicitly granting rights to the admin user you're running as is probably
sufficient but I'm not sure.

The best thing to do is probably to run initdb with non-administrator
rights and grant permissions directly.

This is the same kind of problem you get on linux systems if you 'cd' to
some root-only directory then 'sudo -u somenormaluser ls'. You get an error
saying the current directory isn't readable or similar.

--
Craig Ringer http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services

On 1/20/2016 12:30 AM, Craig Ringer wrote:

On 20 January 2016 at 16:22, Huong Dangminh
<huo-dangminh@ys.jp.nec.com <mailto:huo-dangminh@ys.jp.nec.com>> wrote:

initdb was executed with "Administrator" privileges, but
then initdb do popen() with none "Administrator" privileges
(by child process).

That makes sense. It intentionally drops privileges.

You probably have to set the ACLs up so that it can still see and
write to the directory even after it has dropped privileges. That will
include setting ACLs on the parent directories so that it can see
inside them. Explicitly granting rights to the admin user you're
running as is probably sufficient but I'm not sure.

The best thing to do is probably to run initdb with non-administrator
rights and grant permissions directly.

This is the same kind of problem you get on linux systems if you 'cd'
to some root-only directory then 'sudo -u somenormaluser ls'. You get
an error saying the current directory isn't readable or similar.

in the newer versions of Windows (Server 2012 is roughly equivalent to
Windows 8), the \Windows\ directory is heavily protected from user
processes doing much of anything. This is almost akin to what selinux
does to the linux system directories, but much less configurable.

there's no WAY I would want to put a postgres database in there. I
generally create a \PostgreSQL\ directory in the root of whatever drive
I'm going to put my data in, then a X.Y (9.4 or whatever) directory
under that, and a data directory under that... so
C:\PostgreSQL\9.4\data would be my default choice of data directories
for 9.4 on a C: only system, if the system has a separate data volume,
of course I'd use that instead.

--
john r pierce, recycling bits in santa cruz

Hi,

Thank you all for your advices.

We have simply solved this problem with change the running initdb's folder to not to "c:\windows\temp\something".

Best regards,
bocap.

Ngày 20-01-2016, vào lúc 07:28, cpolish@surewest.net viết: