Bug 1122118 - Postgresql won't start if user postgres is locked (/sbin/nologin).
Summary: Postgresql won't start if user postgres is locked (/sbin/nologin).
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: postgresql
Version: 6.5
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Pavel Raiskup
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks: 1002711 1075802 1172231 1269194 1122143
TreeView+ depends on / blocked
 
Reported: 2014-07-22 14:53 UTC by Andrew Riell
Modified: 2018-12-06 17:25 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1122143 (view as bug list)
Environment:
Last Closed: 2016-08-10 21:09:22 UTC


Attachments (Terms of Use)

Description Andrew Riell 2014-07-22 14:53:09 UTC
Description of problem:
SCAP security guide recommends that all UIDs < 500 (except root) be disabled from login by setting their shell to /sbin/nologin.  If you disable the postgres user this way, then postgresql will not start via 'service postgresql start'  This is because when the init script tries to run 'runuser -l postgres ...', it does not provide a shell switch (-s /bin/bash), to allow the runuser command to execute successfully even though the postgres is locked from login.

All the other services run, properly handle running a service with the account login disabled, Postgres is the only one we've run into that doesn't handle this properly.  

As SCAP gets more integrated into RHEL in 7, and more people start using openscap functionality, this will become even more important.  So, even if this doesn't get fixed in RHEL 6, it needs to be fixed in RHEL 7.  

What I'd like to see is the postgres package fixed so that it can run with the postgres account disabled, just like all the other services we run.  The fix is pretty trivial, and it will save me and others using SCAP a lot of headaches in the future.

Version-Release number of selected component (if applicable):


How reproducible:
Everytime.

Steps to Reproduce:
1. set postgres user to /sbin/nologin in /etc/passwd

Actual results:
postgres is unable to start the postgresql service due to no login shell

Expected results:
postgres should start as a service even when user is set to /sbin/nologin
All the other services that we run, properly handle running a service with the account disabled, Postgres is the only one I've run into that doesn't handle this properly. 

Resolution:
The workaround is to edit /etc/rc.d/init.d/postgresql, but it only lasts until the next postgresql upgrade.

Fix, add '-s /bin/bash' to runuser command lines in the /etc/init.d/postgresql script.

Additional info:

Comment 2 Pavel Raiskup 2014-07-22 15:52:22 UTC
(In reply to Andrew Riell from comment #0)
> Description of problem:
> SCAP security guide recommends that all UIDs < 500 (except root) be disabled
> from login by setting their shell to /sbin/nologin.  If you disable the
> postgres user this way, then postgresql will not start via 'service
> postgresql start'

Thanks for reporting this.

> As SCAP gets more integrated into RHEL in 7, and more people start using
> openscap functionality, this will become even more important.  So, even if
> this doesn't get fixed in RHEL 6, it needs to be fixed in RHEL 7.

Well, in RHEL 7 there is a problem only with 'postgresql-setup' and database
initialization (which is usually one-shot command).  The command 'systemctl
start postgresql' (or service postgresql start) itself is not affected.

> Fix, add '-s /bin/bash' to runuser command lines in the
> /etc/init.d/postgresql script.

You seem to be correct here.

Comment 5 Pavel Raiskup 2015-09-02 12:52:46 UTC
FTR: fixed in RHSCL 2.0 (rh-postgresql94)
postgresql-setup commit:
https://fedorapeople.org/cgit/praiskup/public_git/postgresql-setup.git/commit/?id=82b9bab207ea3cc351581bab89abce48cff2ad12


Note You need to log in before you can comment on or make changes to this bug.