Ensure extension directory has appropriate ownership and permissions

高级别 1自动化postgres

说明

The extension directory is the location of the PostgreSQL extensions. Extensions are storage engines or user defined functions (UDFs). Reads SHAREDIR from the pg_config view (superuser) and requires <sharedir>/extension to be drwxr-xr-x root:root. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

检查方式

审计方法: Shell 命令

shell

sd=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT setting FROM pg_config WHERE name = 'SHAREDIR'" 2>/dev/null) || exit 1; [ -n "$sd" ] || exit 1; s=$(stat -c '%a %U %G' "$sd/extension" 2>/dev/null) || exit 1; [ "$s" = "755 root root" ] && echo compliant || echo "$s"

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

chown root:root <sharedir>/extension && chmod 0755 <sharedir>/extension (sharedir from pg_config --sharedir). If the permissions needed correcting, verify that no extension files in that directory were modified.

属性

操作系统: 任意
标签: postgresdatabasefilesystempermissions
参考: CIS PostgreSQL 18 Benchmark v1.0.0 - 2.2 Ensure extension directory has appropriate ownership and permissions

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target postgres