Bug 1122118

Summary: Postgresql won't start if user postgres is locked (/sbin/nologin).
Product: Red Hat Enterprise Linux 6 Reporter: Andrew Riell <ariell>
Component: postgresqlAssignee: Pavel Raiskup <praiskup>
Status: CLOSED WONTFIX QA Contact: qe-baseos-daemons
Severity: high Docs Contact:
Priority: unspecified    
Version: 6.5CC: cww, databases-maint, hhorak, ktoyama
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1122143 (view as bug list) Environment:
Last Closed: 2016-08-10 21:09:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1002711, 1075802, 1122143, 1172231, 1269194    

Description Andrew Riell 2014-07-22 14:53:09 UTC 
Description of problem:
SCAP security guide recommends that all UIDs < 500 (except root) be disabled from login by setting their shell to /sbin/nologin.  If you disable the postgres user this way, then postgresql will not start via 'service postgresql start'  This is because when the init script tries to run 'runuser -l postgres ...', it does not provide a shell switch (-s /bin/bash), to allow the runuser command to execute successfully even though the postgres is locked from login.

All the other services run, properly handle running a service with the account login disabled, Postgres is the only one we've run into that doesn't handle this properly.  

As SCAP gets more integrated into RHEL in 7, and more people start using openscap functionality, this will become even more important.  So, even if this doesn't get fixed in RHEL 6, it needs to be fixed in RHEL 7.  

What I'd like to see is the postgres package fixed so that it can run with the postgres account disabled, just like all the other services we run.  The fix is pretty trivial, and it will save me and others using SCAP a lot of headaches in the future.

Version-Release number of selected component (if applicable):


How reproducible:
Everytime.

Steps to Reproduce:
1. set postgres user to /sbin/nologin in /etc/passwd

Actual results:
postgres is unable to start the postgresql service due to no login shell

Expected results:
postgres should start as a service even when user is set to /sbin/nologin
All the other services that we run, properly handle running a service with the account disabled, Postgres is the only one I've run into that doesn't handle this properly. 

Resolution:
The workaround is to edit /etc/rc.d/init.d/postgresql, but it only lasts until the next postgresql upgrade.

Fix, add '-s /bin/bash' to runuser command lines in the /etc/init.d/postgresql script.

Additional info:
Comment 2 Pavel Raiskup 2014-07-22 15:52:22 UTC 
(In reply to Andrew Riell from comment #0)
> Description of problem:
> SCAP security guide recommends that all UIDs < 500 (except root) be disabled
> from login by setting their shell to /sbin/nologin.  If you disable the
> postgres user this way, then postgresql will not start via 'service
> postgresql start'

Thanks for reporting this.

> As SCAP gets more integrated into RHEL in 7, and more people start using
> openscap functionality, this will become even more important.  So, even if
> this doesn't get fixed in RHEL 6, it needs to be fixed in RHEL 7.

Well, in RHEL 7 there is a problem only with 'postgresql-setup' and database
initialization (which is usually one-shot command).  The command 'systemctl
start postgresql' (or service postgresql start) itself is not affected.

> Fix, add '-s /bin/bash' to runuser command lines in the
> /etc/init.d/postgresql script.

You seem to be correct here.
Comment 5 Pavel Raiskup 2015-09-02 12:52:46 UTC 
FTR: fixed in RHSCL 2.0 (rh-postgresql94)
postgresql-setup commit:
https://fedorapeople.org/cgit/praiskup/public_git/postgresql-setup.git/commit/?id=82b9bab207ea3cc351581bab89abce48cff2ad12