TMA-POSTGRES-2.2

Ensure extension directory has appropriate ownership and permissions

高レベル 1自動postgres

説明

The extension directory is the location of the PostgreSQL extensions. Extensions are storage engines or user defined functions (UDFs). Reads SHAREDIR from the pg_config view (superuser) and requires <sharedir>/extension to be drwxr-xr-x root:root. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

チェック方法

監査方法: シェルコマンド

shell

sd=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT setting FROM pg_config WHERE name = 'SHAREDIR'" 2>/dev/null) || exit 1; [ -n "$sd" ] || exit 1; s=$(stat -c '%a %U %G' "$sd/extension" 2>/dev/null) || exit 1; [ "$s" = "755 root root" ] && echo compliant || echo "$s"

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

chown root:root <sharedir>/extension && chmod 0755 <sharedir>/extension (sharedir from pg_config --sharedir). If the permissions needed correcting, verify that no extension files in that directory were modified.

プロパティ

オペレーティングシステム: すべて
タグ: postgresdatabasefilesystempermissions
参照: CIS PostgreSQL 18 Benchmark v1.0.0 - 2.2 Ensure extension directory has appropriate ownership and permissions

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target postgres