BUG #19388: Failing to connect to postgres with EACCES error

PG Bug reporting form <noreply@postgresql.org> writes:

Running on k8s pods, I have an issue where a process cannot connect to an
Azure Postgres server due to a permission error.
...
We use standard SSL without client certificates and the running process is
setup without a homedir for security reasons.

I'm pretty skeptical that that is a good idea, but if you are stubborn
about it you could explicitly specify "sslcert=/no/such/file" and so
on in your connection parameters. Another way is to make the HOME
environment variable point at a directory that actually doesn't exist,
rather than one that has access restrictions.

I noticed from the postgres source code that only ENOENT & ENOTDIR are
allowable errors but EACCES is a fail condition.
I understand the reasoning for checking for existence of certificates, but
can the Permission Denied error also be treated as "Can't get client certs,
continue to try to connect without"?

No, I don't think that would be an improvement in user experience
for most people. If your cert isn't working and libpq fails to
tell you why not, debugging that could be pretty unpleasant.

If anything, I'd lean towards removing the special exception for
ENOTDIR ... I wonder why that's there.

regards, tom lane

On Fri, Jan 23, 2026 at 7:35 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:

If anything, I'd lean towards removing the special exception for
ENOTDIR ... I wonder why that's there.

I think removing that would take some adjustments to
pqGetHomeDirectory(), so that it actually checks for the existence of
that directory before returning true. `have_homedir` is kind of a
misleading name in this context.

--Jacob

Jacob Champion <jacob.champion@enterprisedb.com> writes:

On Fri, Jan 23, 2026 at 7:35 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:

If anything, I'd lean towards removing the special exception for
ENOTDIR ... I wonder why that's there.

I think removing that would take some adjustments to
pqGetHomeDirectory(), so that it actually checks for the existence of
that directory before returning true. `have_homedir` is kind of a
misleading name in this context.

I dug into our git history and traced the appearance of ENOTDIR to

commit 5b40677986984d450a2a16e515fe44d90dfeef02
Author: Magnus Hagander <magnus@hagander.net>
Date: Sat Dec 3 15:02:53 2011 +0100

Treat ENOTDIR as ENOENT when looking for client certificate file

This makes it possible to use a libpq app with home directory set
to /dev/null, for example - treating it the same as if the file
doesn't exist (which it doesn't).

Per bug #6302, reported by Diego Elio Petteno

We could imagine pushing the stat() test into pqGetHomeDirectory,
which might be a more sensible factorization, but I don't think
it'd move the behavior much.

regards, tom lane