Description of problem:
SCAP security guide recommends that all UIDs < 500 (except root) be disabled from login by setting their shell to /sbin/nologin.  If you disable the postgres user this way, then postgresql will not start via 'service postgresql start'  This is because when the init script tries to run 'runuser -l postgres ...', it does not provide a shell switch (-s /bin/bash), to allow the runuser command to execute successfully even though the postgres is locked from login.

All the other services run, properly handle running a service with the account login disabled, Postgres is the only one we've run into that doesn't handle this properly.  

As SCAP gets more integrated into RHEL in 7, and more people start using openscap functionality, this will become even more important.  So, even if this doesn't get fixed in RHEL 6, it needs to be fixed in RHEL 7.  

What I'd like to see is the postgres package fixed so that it can run with the postgres account disabled, just like all the other services we run.  The fix is pretty trivial, and it will save me and others using SCAP a lot of headaches in the future.

Version-Release number of selected component (if applicable):


How reproducible:
Everytime.

Steps to Reproduce:
1. set postgres user to /sbin/nologin in /etc/passwd

Actual results:
postgres is unable to start the postgresql service due to no login shell

Expected results:
postgres should start as a service even when user is set to /sbin/nologin
All the other services that we run, properly handle running a service with the account disabled, Postgres is the only one I've run into that doesn't handle this properly. 

Resolution:
The workaround is to edit /etc/rc.d/init.d/postgresql, but it only lasts until the next postgresql upgrade.

Fix, add '-s /bin/bash' to runuser command lines in the /etc/init.d/postgresql script.

Additional info: