Commit Graph

23 Commits

Author SHA1 Message Date
Noah Misch dfc015dcf4 start-scripts: switch to $PGUSER before opening $PGLOG.
By default, $PGUSER has permission to unlink $PGLOG.  If $PGUSER
replaces $PGLOG with a symbolic link, the server will corrupt the
link-targeted file by appending log messages.  Since these scripts open
$PGLOG as root, the attack works regardless of target file ownership.

"make install" does not install these scripts anywhere.  Users having
manually installed them in the past should repeat that process to
acquire this fix.  Most script users have $PGLOG writable to root only,
located in $PGDATA.  Just before updating one of these scripts, such
users should rename $PGLOG to $PGLOG.old.  The script will then recreate
$PGLOG with proper ownership.

Reviewed by Peter Eisentraut.  Reported by Antoine Scemama.

Security: CVE-2017-12172
2017-11-06 07:11:10 -08:00
Peter Eisentraut 05cd12ed5b pg_ctl: Change default to wait for all actions
The different actions in pg_ctl had different defaults for -w and -W,
mostly for historical reasons.  Most users will want the -w behavior, so
make that the default.

Remove the -w option in most example and test code, so avoid confusion
and reduce verbosity.  pg_upgrade is not touched, so it can continue to
work with older installations.

Reviewed-by: Beena Emerson <memissemerson@gmail.com>
Reviewed-by: Ryan Murphy <ryanfmurphy@gmail.com>
2017-01-14 09:15:08 -05:00
Peter Eisentraut e574f15d62 Updates to reflect that pg_ctl stop -m fast is the default
Various example and test code used -m fast explicitly, but since it's
the default, this can be omitted now or should be replaced by a better
example.

pg_upgrade is not touched, so it can continue to operate with older
installations.
2017-01-13 21:25:36 -05:00
Peter Eisentraut da0dbea9c3 Make whitespace consistent inside some script files
I don't know what the global standard might be, but at least adjacent
code should use the same whitespace.
2017-01-12 10:17:37 -05:00
Tom Lane f320cbb615 Fix typo in linux startup script.
Missed a "$" in what was meant to be a variable substitution.  Careless
mistake in commit f23425fa95.
2015-04-26 09:43:15 -04:00
Tom Lane f23425fa95 Improve handling of OOM score adjustment in sample Linux start script.
Per a suggestion from Christoph Berg.
2014-07-01 17:23:16 -04:00
Tom Lane df8b7bc9ff Improve our mechanism for controlling the Linux out-of-memory killer.
Arrange for postmaster child processes to respond to two environment
variables, PG_OOM_ADJUST_FILE and PG_OOM_ADJUST_VALUE, to determine whether
they reset their OOM score adjustments and if so to what.  This is superior
to the previous design involving #ifdef's in several ways.  The behavior is
now available in a default build, and both ends of the adjustment --- the
original adjustment of the postmaster's level and the subsequent
readjustment by child processes --- can now be controlled in one place,
namely the postmaster launch script.  So it's no longer necessary for the
launch script to act on faith that the server was compiled with the
appropriate options.  In addition, if someone wants to use an OOM score
other than zero for the child processes, that doesn't take a recompile
anymore; and we no longer have to cater separately to the two different
historical kernel APIs for this adjustment.

Gurjeet Singh, somewhat revised by me
2014-06-18 20:12:51 -04:00
Peter Eisentraut 187ca5e8e9 Revert "pg_ctl: Add idempotent option"
This reverts commit 8730618458.  The
behavior in certain cases is still being debated, and it's too late to
solve this before beta.
2013-04-29 21:55:12 -04:00
Tom Lane 3353583d7e Don't try to pass -I switch to postmaster in contrib/start-scripts/linux.
Undo thinko in commit 8730618458.
Per bug #8098 from Catherine Devlin.
2013-04-19 13:28:45 -04:00
Peter Eisentraut 8730618458 pg_ctl: Add idempotent option
This changes the behavior of the start and stop actions to exit
successfully if the server was already started or stopped.

This changes the default behavior of the start action:  Before, if the
server was already running, it would print a message and succeed.  Now,
that situation will result in an error.  When running in idempotent
mode, no message is printed and pg_ctl exits successfully.

It was considered to just make the idempotent behavior the default and
only option, but pg_upgrade needs the old behavior.
2013-04-13 23:42:42 -04:00
Tom Lane 93f4d7f806 Support Linux's oom_score_adj API as well as the older oom_adj API.
The simplest way to handle this is just to copy-and-paste the relevant
code block in fork_process.c, so that's what I did. (It's possible that
something more complicated would be useful to packagers who want to work
with either the old or the new API; but at this point the number of such
people is rapidly approaching zero, so let's just get the minimal thing
done.)  Update relevant documentation as well.
2012-06-13 15:35:52 -04:00
Magnus Hagander 9f2e211386 Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
Bruce Momjian 1f0cf56be2 Update startup scripts for Linux and FreeBSD.
Kevin Grittner
2010-02-23 22:15:35 +00:00
Tom Lane d5e0029862 Add some simple support and documentation for using process-specific oom_adj
settings to prevent the postmaster from being OOM-killed on Linux systems.

Alex Hunsaker and Tom Lane
2010-01-11 18:39:32 +00:00
Tom Lane 8f5500e6bd Make it reasonably safe to use pg_ctl to start the postmaster from a boot-time
script.

To do this, have pg_ctl pass down its parent shell's PID in an environment
variable PG_GRANDPARENT_PID, and teach CreateLockFile() to disregard that PID
as a false match if it finds it in postmaster.pid.  This allows us to cope
with one level of postgres-owned shell process even with pg_ctl in the way,
so it's just as safe as starting the postmaster directly.  You still have to
be careful about how you write the initscript though.

Adjust the comments in contrib/start-scripts/ to not deprecate use of
pg_ctl.  Also, fix the ROTATELOGS option in the OSX script, which was
indulging in exactly the sort of unsafe coding that renders this fix
pointless :-(.  A pipe inside the "sudo" will probably result in more
than one postgres-owned process hanging around.
2009-08-27 16:59:38 +00:00
Peter Eisentraut 6809c064d7 Be consistent about not using ECHO_N/ECHO_C (seems unnecessary on Linux). 2006-07-13 14:44:33 +00:00
Tom Lane c8196c87a7 Adjust postmaster to recognize that a lockfile containing its parent's PID
must be stale.  Tweak example startup scripts to not use pg_ctl but launch
the postmaster directly, thereby ensuring that only the postmaster's direct
parent shell will be a postgres-owned process.  In combination these should
fix the longstanding problem of the postmaster sometimes refusing to start
during reboot because it thinks the old lockfile is not stale.
2004-10-01 18:30:25 +00:00
PostgreSQL Daemon 969685ad44 $Header: -> $PostgreSQL Changes ... 2003-11-29 19:52:15 +00:00
Bruce Momjian 9df03060e9 Fix for Linux startup script.
Slawomir Sudnik
2003-07-26 20:42:55 +00:00
Bruce Momjian 310c084921 Add Linux restart --- Slawomir Sudnik
Add "-l $PGLOG" for restart --- Darko Prenosil
2003-06-12 02:02:24 +00:00
Bruce Momjian d4cafeba31 Patch to add comments to Linux startup script.
Rene Pijlman
2001-07-30 14:52:42 +00:00
Peter Eisentraut 031e1afa23 Pass -D option to pg_ctl because export PGDATA won't be preserved across
'su -l'.

Reported by <VASQUEZ_JASON@LILLY.COM>.
2001-04-19 19:17:44 +00:00
Peter Eisentraut bbac19a973 Remove outdated contrib/linux start scripts. Beat some sense into
contrib/init.d start script.  Place into more aptly named directory.  Maybe
we could add scripts for other platforms here later.
2001-02-08 19:53:33 +00:00