Postgresql home directory is world readable
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
PostgreSQL Charm |
New
|
Undecided
|
Unassigned |
Bug Description
Part of the recommendation for CIS hardening 6.2.6 to ensure users' home directories are not world readable,
postgres user's home which is "/var/lib/
Although the behavior is the same on Bionic and Jammy as well, here is an example from Focal :
ubuntu@
total 12
drwxr-xr-x 3 postgres postgres 4096 Oct 18 07:37 .
drwxr-xr-x 48 root root 4096 Oct 18 07:37 ..
drwxr-xr-x 3 postgres postgres 4096 Oct 18 07:37 12
Looking at first glance, this seems to be related to the package installation scripts from postgresql-common packages.
With the following happening in postgresql-
# ensure home directory ownership
mkdir -p /var/lib/postgresql
su -s /bin/sh postgres -c "test -O /var/lib/postgresql &&
test -G /var/lib/
chown postgres:postgres /var/lib/postgresql
However it might be required to check as well if changing the access rules wouldn't break partially the charm, especially in regard to the functionality of some potential subordinates charm such as nrpe.