TMA-POSTGRES-2.2

Ensure extension directory has appropriate ownership and permissions

VisokaNivo 1Automatskapostgres

Opis

The extension directory is the location of the PostgreSQL extensions. Extensions are storage engines or user defined functions (UDFs). Reads SHAREDIR from the pg_config view (superuser) and requires <sharedir>/extension to be drwxr-xr-x root:root. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

Kako se proverava

Metod provere: Komanda ljuske

shell

sd=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT setting FROM pg_config WHERE name = 'SHAREDIR'" 2>/dev/null) || exit 1; [ -n "$sd" ] || exit 1; s=$(stat -c '%a %U %G' "$sd/extension" 2>/dev/null) || exit 1; [ "$s" = "755 root root" ] && echo compliant || echo "$s"

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

chown root:root <sharedir>/extension && chmod 0755 <sharedir>/extension (sharedir from pg_config --sharedir). If the permissions needed correcting, verify that no extension files in that directory were modified.

Svojstva

Operativni sistemi: Bilo koji
Oznake: postgresdatabasefilesystempermissions
Referenca: CIS PostgreSQL 18 Benchmark v1.0.0 - 2.2 Ensure extension directory has appropriate ownership and permissions

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target postgres