BUG #15049: Initdb.exe failing to create DB

Hi

doesn't look like PostgreSQL bug

2018-02-05 8:53 GMT+01:00 PG Bug reporting form <noreply@postgresql.org>:

The following bug has been logged on the website:

Bug reference: 15049
Logged by: dheeraj chhabra
Email address: dheeru.chhabra@gmail.com
PostgreSQL version: 9.4.4
Operating system: Windows 2012 R2
Description:

The DB creation is failing with below output:

initdb: could not start process for command ""D:\BMC
Software\TrueSightPServer\truesightpserver\modules\pgsql\bin\initdb.exe"
-U
SVC_BMCMON -A trust -E utf8 -D "D:\BMC
Software\TrueSightPServer\truesightpserver\data\pgsql" -X "D:\BMC
Software\TrueSightPServer\truesightpserver\data\pgsql_txnlog" --pwfile
"D:\BMC
Software\TrueSightPServer\truesightpserver\tmp\
DBdata7317520133955961463ks"":
error code 1260
initdb: could not re-execute with restricted token: error code 3
The files belonging to this database system will be owned by user
"admrak".
This user must also own the server process.

The database cluster will be initialized with locale
"English_Australia.1252".
The default text search configuration will be set to "english".

Data page checksums are disabled.

creating directory D:/BMC
Software/TrueSightPServer/truesightpserver/data/pgsql ... ok
creating directory D:/BMC
Software/TrueSightPServer/truesightpserver/data/pgsql_txnlog ... ok
creating subdirectories ... ok
selecting default max_connections ... 10
selecting default shared_buffers ... 400kB
selecting dynamic shared memory implementation ... windows
creating configuration files ... ok
running bootstrap script ... Execution of PostgreSQL by a user with
administrative permissions is not
permitted.
The server must be started under an unprivileged user ID to prevent
possible system security compromises. See the documentation for
more information on how to properly start the server.
child process exited with exit code 1

You are running initdb as privileged user. It is prohibited due security.

https://dba.stackexchange.com/questions/35056/trying-to-start-a-newly-created-cluster-in-postgresql-on-windows
/messages/by-id/7be3f35d040930110679c11892@mail.gmail.com

Regards

Pavel

Hi Pavel,

We have tried running command on command prompt with same user 'admrak' who
is running the java program. The command works fine on command prompt but
failing through java-program with below error.

We have used unprivileged user( who is not part of Administrator group)
also but still the same issue with java program.

Please suggest what should we do differently to run the initdb.exe command
through java program.

-Dheeraj

Thanks and Regards
Dheeraj Chhabra
+91 8600149952

On Mon, Feb 5, 2018 at 1:37 PM, Pavel Stehule <pavel.stehule@gmail.com>
wrote:

2018-02-05 10:18 GMT+01:00 Dheeraj <dheeru.chhabra@gmail.com>:

Hi Pavel,

We have tried running command on command prompt with same user 'admrak'
who is running the java program. The command works fine on command prompt
but failing through java-program with below error.

We have used unprivileged user( who is not part of Administrator group)
also but still the same issue with java program.

Please suggest what should we do differently to run the initdb.exe command
through java program.

are you sure so your java user is unprivileged?

Regards

Pavel

On Feb 5, 2018 5:10 PM, "Pavel Stehule" <pavel.stehule@gmail.com> wrote:

2018-02-05 10:18 GMT+01:00 Dheeraj <dheeru.chhabra@gmail.com>:

Hi Pavel,

We have tried running command on command prompt with same user 'admrak'
who is running the java program. The command works fine on command prompt
but failing through java-program with below error.

We have used unprivileged user( who is not part of Administrator group)
also but still the same issue with java program.

Please suggest what should we do differently to run the initdb.exe command
through java program.

are you sure so your java user is unprivileged?

Regards

Pavel

-Dheeraj

Thanks and Regards
Dheeraj Chhabra
+91 8600149952 <+91%2086001%2049952>

On Mon, Feb 5, 2018 at 1:37 PM, Pavel Stehule <pavel.stehule@gmail.com>
wrote:

Hi

doesn't look like PostgreSQL bug

2018-02-05 8:53 GMT+01:00 PG Bug reporting form <noreply@postgresql.org>:

The following bug has been logged on the website:

Bug reference: 15049
Logged by: dheeraj chhabra
Email address: dheeru.chhabra@gmail.com
PostgreSQL version: 9.4.4
Operating system: Windows 2012 R2
Description:

The DB creation is failing with below output:

initdb: could not start process for command ""D:\BMC
Software\TrueSightPServer\truesightpserver\modules\pgsql\bin\initdb.exe"
-U
SVC_BMCMON -A trust -E utf8 -D "D:\BMC
Software\TrueSightPServer\truesightpserver\data\pgsql" -X "D:\BMC
Software\TrueSightPServer\truesightpserver\data\pgsql_txnlog" --pwfile
"D:\BMC
Software\TrueSightPServer\truesightpserver\tmp\DBdata7317520
133955961463ks"":
error code 1260
initdb: could not re-execute with restricted token: error code 3
The files belonging to this database system will be owned by user
"admrak".
This user must also own the server process.

The database cluster will be initialized with locale
"English_Australia.1252".
The default text search configuration will be set to "english".

Data page checksums are disabled.

creating directory D:/BMC
Software/TrueSightPServer/truesightpserver/data/pgsql ... ok
creating directory D:/BMC
Software/TrueSightPServer/truesightpserver/data/pgsql_txnlog ... ok
creating subdirectories ... ok
selecting default max_connections ... 10
selecting default shared_buffers ... 400kB
selecting dynamic shared memory implementation ... windows
creating configuration files ... ok
running bootstrap script ... Execution of PostgreSQL by a user with
administrative permissions is not
permitted.
The server must be started under an unprivileged user ID to prevent
possible system security compromises. See the documentation for
more information on how to properly start the server.
child process exited with exit code 1

You are running initdb as privileged user. It is prohibited due
security.

https://dba.stackexchange.com/questions/35056/trying-to-star
t-a-newly-created-cluster-in-postgresql-on-windows
/messages/by-id/7be3f35d040930110679c1
1892@mail.gmail.com

Regards

Pavel

initdb: removing data directory "D:/BMC
Software/TrueSightPServer/truesightpserver/data/pgsql"
initdb: removing transaction log directory "D:/BMC
Software/TrueSightPServer/truesightpserver/data/pgsql_txnlog"

Please suggest the resolution ASAP.

-Dheeraj

Yeah he might be privileged user.

Regards,

Pavan

Dear Pavan, Pavel,

This is little confusing. See below scenarios -

*Scenario -1: * When I run the postgresDB installation with Windows
Administrator user who has all the rights means he is privileged user. The
installation is successful. In that case it is not complaining but creating
the DB successfully. Why it is working in this case if it only needs
unprivileged user.

C:\Users\ADMINI~1\AppData\Local\Temp\extract6096>"D:\BMC
Software\TrueSightPServer\truesightpserver\modules\pgsql\bin\initdb.exe" -U
dheeraj -A trust -E utf8 -D "D:\BMC
Software\TrueSightPServer\truesightpserver\data\pgsql" -X "D:\BMC
Software\TrueSightPServer\truesightpserver\data\pgsql_txnlog" --pwfile
"D:\BMC
Software\TrueSightPServer\truesightpserver\tmp\DBdata6820706518760534179ks"
The files belonging to this database system will be owned by user "
*Administrator*".
This user must also own the server process.
The database cluster will be initialized with locale "English_United
States.1252".
The default text search configuration will be set to "english".
Data page checksums are disabled.
creating directory D:/BMC
Software/TrueSightPServer/truesightpserver/data/pgsql ... ok
creating directory D:/BMC
Software/TrueSightPServer/truesightpserver/data/pgsql_txnlog ... ok
creating subdirectories ... ok
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting dynamic shared memory implementation ... windows
creating configuration files ... ok
running bootstrap script ... ok
performing post-bootstrap initialization ... ok
syncing data to disk ... ok
*Success*. You can now start the database server using:
"D:\BMC
Software\TrueSightPServer\truesightpserver\modules\pgsql\bin\pg_ctl" -D
"D:\BMC Software\TrueSightPServer\truesightpserver\data\pgsql" -l logfile
start

*Scenario-2:* In few occasions, a normal user who is part of same
Administrator group, is failed to create the DB.

C:\Users\138580\AppData\Local\Temp\extract5416>D:\BMC\TrueSightPServer\truesightpserver\modules\pgsql\bin\initdb.exe
-U SVC_BMCMON -A trust -E utf8 -D
D:\BMC\TrueSightPServer\truesightpserver\data\pgsql -X
D:\BMC\TrueSightPServer\truesightpserver\data\pgsql_txnlog --pwfile
D:\BMC\TrueSightPServer\truesightpserver\tmp\DBdata4550223386000473763ks
initdb: could not start process for command
"D:\BMC\TrueSightPServer\truesightpserver\modules\pgsql\bin\initdb.exe -U
SVC_BMCMON -A trust -E utf8 -D
D:\BMC\TrueSightPServer\truesightpserver\data\pgsql -X
D:\BMC\TrueSightPServer\truesightpserver\data\pgsql_txnlog --pwfile
D:\BMC\TrueSightPServer\truesightpserver\tmp\DBdata4550223386000473763ks":
error code 1260
initdb: could not re-execute with restricted token: error code 3
The files belonging to this database system will be owned by user "*138580*
".
This user must also own the server process.
The database cluster will be initialized with locale
"English_Australia.1252".
The default text search configuration will be set to "english".
Data page checksums are disabled.
creating directory D:/BMC/TrueSightPServer/truesightpserver/data/pgsql ...
ok
creating directory
D:/BMC/TrueSightPServer/truesightpserver/data/pgsql_txnlog ... ok
creating subdirectories ... ok
selecting default max_connections ... 10
selecting default shared_buffers ... 400kB
selecting dynamic shared memory implementation ... windows
creating configuration files ... ok
*Execution of PostgreSQL by a user with administrative permissions is not*
*permitted*.
The server must be started under an unprivileged user ID to prevent
possible system security compromises. See the documentation for
more information on how to properly start the server.
running bootstrap script ...
child process exited with exit code 1
initdb: removing data directory
"D:/BMC/TrueSightPServer/truesightpserver/data/pgsql"
initdb: removing transaction log directory
"D:/BMC/TrueSightPServer/truesightpserver/data/pgsql_txnlog"

As you see in *scenario-1,* DB creation is successfull with Administrator
user but in *scenario-2*, the install fails with a user who is part of same
Administrator group.
Please clarify

-Dheeraj Chhabra

Thanks and Regards
Dheeraj Chhabra
+91 8600149952

On Mon, Feb 5, 2018 at 5:15 PM, Pavan Teja <pavan.postgresdba@gmail.com>
wrote:

On Tue, Feb 6, 2018 at 5:55 AM, Dheeraj <dheeru.chhabra@gmail.com> wrote:

Dear Pavan, Pavel,

This is little confusing. See below scenarios -

*Scenario -1: * When I run the postgresDB installation with Windows
Administrator user who has all the rights means he is privileged user. The
installation is successful. In that case it is not complaining but creating
the DB successfully. Why it is working in this case if it only needs
unprivileged user.

C:\Users\ADMINI~1\AppData\Local\Temp\extract6096>"D:\BMC
Software\TrueSightPServer\truesightpserver\modules\pgsql\bin\initdb.exe"
-U dheeraj -A trust -E utf8 -D "D:\BMC Software\TrueSightPServer\truesightpserver\data\pgsql"
-X "D:\BMC Software\TrueSightPServer\truesightpserver\data\pgsql_txnlog"
--pwfile "D:\BMC Software\TrueSightPServer\truesightpserver\tmp\
DBdata6820706518760534179ks"
The files belonging to this database system will be owned by user "
*Administrator*".
This user must also own the server process.
The database cluster will be initialized with locale "English_United
States.1252".
The default text search configuration will be set to "english".
Data page checksums are disabled.
creating directory D:/BMC Software/TrueSightPServer/truesightpserver/data/pgsql
... ok
creating directory D:/BMC Software/TrueSightPServer/
truesightpserver/data/pgsql_txnlog ... ok
creating subdirectories ... ok
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting dynamic shared memory implementation ... windows
creating configuration files ... ok
running bootstrap script ... ok
performing post-bootstrap initialization ... ok
syncing data to disk ... ok
*Success*. You can now start the database server using:
"D:\BMC Software\TrueSightPServer\truesightpserver\modules\pgsql\bin\pg_ctl"
-D "D:\BMC Software\TrueSightPServer\truesightpserver\data\pgsql" -l
logfile start

*Scenario-2:* In few occasions, a normal user who is part of same
Administrator group, is failed to create the DB.

C:\Users\138580\AppData\Local\Temp\extract5416>D:\BMC\TrueSightPServer\
truesightpserver\modules\pgsql\bin\initdb.exe -U SVC_BMCMON -A trust -E
utf8 -D D:\BMC\TrueSightPServer\truesightpserver\data\pgsql -X
D:\BMC\TrueSightPServer\truesightpserver\data\pgsql_txnlog --pwfile
D:\BMC\TrueSightPServer\truesightpserver\tmp\DBdata4550223386000473763ks
initdb: could not start process for command "D:\BMC\TrueSightPServer\
truesightpserver\modules\pgsql\bin\initdb.exe -U SVC_BMCMON -A trust -E
utf8 -D D:\BMC\TrueSightPServer\truesightpserver\data\pgsql -X
D:\BMC\TrueSightPServer\truesightpserver\data\pgsql_txnlog --pwfile
D:\BMC\TrueSightPServer\truesightpserver\tmp\DBdata4550223386000473763ks":
error code 1260

^ this here is probably the root of your problem. Windows errorcode 1260
means "Windows cannot open this program because it has been prevented by a
software restriction policy".

So it looks like somewhere on your system there is a policy preventing
initdb from executing itself (which it will do on Windows).

initdb: could not re-execute with restricted token: error code 3

The files belonging to this database system will be owned by user "*138580*

".
This user must also own the server process.
The database cluster will be initialized with locale
"English_Australia.1252".
The default text search configuration will be set to "english".
Data page checksums are disabled.
creating directory D:/BMC/TrueSightPServer/truesightpserver/data/pgsql
... ok
creating directory D:/BMC/TrueSightPServer/truesightpserver/data/pgsql_txnlog
... ok
creating subdirectories ... ok
selecting default max_connections ... 10
selecting default shared_buffers ... 400kB
selecting dynamic shared memory implementation ... windows
creating configuration files ... ok
*Execution of PostgreSQL by a user with administrative permissions is not*
*permitted*.

This indicates that the user is at least "partially administrative". It may
not be Administrator, but it has administrative permissions. This means
it's member of administrators, domain admins, or power users groups,
directly or indirectly.

As you see in *scenario-1,* DB creation is successfull with Administrator

user but in *scenario-2*, the install fails with a user who is part of
same Administrator group.
Please clarify

When running as administrator it successfully manages to re-execute itself
without the administrator permissions. With the second user, that is
blocked by some policy.

//Magnus