Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 69d0c1404c17
Choose a base ref
...
head repository: NixOS/nixpkgs
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 5a9eaf02ae3c
Choose a head ref
  • 5 commits
  • 6 files changed
  • 2 contributors

Commits on Mar 15, 2019

  1. postgresql: Move socket dir to /run/postgresql 

    The default, which is /tmp, has a few issues associated with it:

One being that it makes it easy for users on the system to spoof a
PostgreSQL server if it's not running, causing applications to connect
to their provided sockets instead of just failing to connect.

Another one is that it makes sandboxing of PostgreSQL and other services
unnecessarily difficult. This is already the case if only PrivateTmp is
used in a systemd service, so in order for such a service to be able to
connect to PostgreSQL, a bind mount needs to be done from /tmp to some
other path, so the service can access it. This pretty much defeats the
whole purpose of PrivateTmp.

We regularily run into issues with this in the past already (one example
would be #24317) and with the new
systemd-confinement mode upcoming in
#57519, it makes it even more
tedious to sandbox services.

I've tested this change against all the postgresql NixOS VM tests and
they still succeed and I also grepped through the source tree to replace
other occasions where we might have /tmp hardcoded. Luckily there were
very few occasions.

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @ocharles, @thoughtpolice, @danbst
    @aszlig
    aszlig committed Mar 15, 2019

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    ef55378 View commit details

Commits on Mar 16, 2019

  1. nixos/manual: Document PostgreSQL socket change 

    This is a backwards-incompatible change and while it won't probably
affect a whole lot of users, it makes sense to give them a heads-up
anyway.

Signed-off-by: aszlig <aszlig@nix.build>
    @aszlig
    aszlig committed Mar 16, 2019

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    116bdc9 View commit details

  2. postgresql: Only use /run/postgresql on Linux 

    We only have /run on modern GNU/Linux systems and it's not necessarily
the case for Mac OS X or *BSD, so let's add the patch only if
stdenv.isLinux.

Thanks to @danbst for catching this.

Signed-off-by: aszlig <aszlig@nix.build>
    @aszlig
    aszlig committed Mar 16, 2019
    Copy the full SHA
    f510601 View commit details

Commits on Mar 24, 2019

  1. Merge branch 'master' into postgresql-socket-in-run

    @danbst
    danbst authored Mar 24, 2019
    Copy the full SHA
    40cc269 View commit details

  2. Merge pull request #57677 from aszlig/postgresql-socket-in-run 

    postgresql: Move socket dir to /run/postgresql
    @danbst
    danbst authored Mar 24, 2019
    Copy the full SHA
    5a9eaf0 View commit details
10 changes: 10 additions & 0 deletions nixos/doc/manual/release-notes/rl-1909.xml
View file
Original file line number Diff line number Diff line change
@@ -62,6 +62,16 @@
compatible with Python 3.
</para>
</listitem>
<listitem>
<para>
PostgreSQL now uses
<filename class="directory">/run/postgresql</filename> as its socket
directory instead of <filename class="directory">/tmp</filename>. So
if you run an application like eg. Nextcloud, where you need to use
the Unix socket path as the database host name, you need to change it
accordingly.
</para>
</listitem>
</itemizedlist>
</section>

1 change: 1 addition & 0 deletions nixos/modules/services/databases/postgresql.nix
View file
Original file line number Diff line number Diff line change
@@ -238,6 +238,7 @@ in
User = "postgres";
Group = "postgres";
PermissionsStartOnly = true;
RuntimeDirectory = "postgresql";
Type = if lib.versionAtLeast cfg.package.version "9.6"
then "notify"
else "simple";
2 changes: 1 addition & 1 deletion nixos/modules/services/web-apps/nextcloud.nix
View file
Original file line number Diff line number Diff line change
@@ -172,7 +172,7 @@ in {
Database host.
Note: for using Unix authentication with PostgreSQL, this should be
set to <literal>/tmp</literal>.
set to <literal>/run/postgresql</literal>.
'';
};
dbport = mkOption {
2 changes: 1 addition & 1 deletion nixos/modules/services/web-apps/nextcloud.xml
View file
Original file line number Diff line number Diff line change
@@ -33,7 +33,7 @@
config = {
<link linkend="opt-services.nextcloud.config.dbtype">dbtype</link> = "pgsql";
<link linkend="opt-services.nextcloud.config.dbuser">dbuser</link> = "nextcloud";
<link linkend="opt-services.nextcloud.config.dbhost">dbhost</link> = "/tmp"; # nextcloud will add /.s.PGSQL.5432 by itself
<link linkend="opt-services.nextcloud.config.dbhost">dbhost</link> = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
<link linkend="opt-services.nextcloud.config.dbname">dbname</link> = "nextcloud";
<link linkend="opt-services.nextcloud.config.adminpassFile">adminpassFile</link> = "/path/to/admin-pass-file";
<link linkend="opt-services.nextcloud.config.adminuser">adminuser</link> = "root";
2 changes: 1 addition & 1 deletion pkgs/servers/sql/postgresql/default.nix
View file
Original file line number Diff line number Diff line change
@@ -60,7 +60,7 @@ let
(if atLeast "9.6" then ./patches/less-is-more-96.patch else ./patches/less-is-more.patch)
(if atLeast "9.6" then ./patches/hardcode-pgxs-path-96.patch else ./patches/hardcode-pgxs-path.patch)
./patches/specify_pkglibdir_at_runtime.patch
];
] ++ lib.optional stdenv.isLinux ./patches/socketdir-in-run.patch;

installTargets = [ "install-world" ];

13 changes: 13 additions & 0 deletions pkgs/servers/sql/postgresql/patches/socketdir-in-run.patch
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
diff --git a/src/include/pg_config_manual.h b/src/include/pg_config_manual.h
index 743401cb96..be5c5f61d2 100644
--- a/src/include/pg_config_manual.h
+++ b/src/include/pg_config_manual.h
@@ -179,7 +179,7 @@
* here's where to twiddle it. You can also override this at runtime
* with the postmaster's -k switch.
*/
-#define DEFAULT_PGSOCKET_DIR "/tmp"
+#define DEFAULT_PGSOCKET_DIR "/run/postgresql"

/*
* This is the default event source for Windows event log.