Ensure extension directory has appropriate ownership and permissions

高等級 1自動化postgres

說明

The extension directory is the location of the PostgreSQL extensions. Extensions are storage engines or user defined functions (UDFs). Reads SHAREDIR from the pg_config view (superuser) and requires <sharedir>/extension to be drwxr-xr-x root:root. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

檢查方式

稽核方法: Shell 指令

shell

sd=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT setting FROM pg_config WHERE name = 'SHAREDIR'" 2>/dev/null) || exit 1; [ -n "$sd" ] || exit 1; s=$(stat -c '%a %U %G' "$sd/extension" 2>/dev/null) || exit 1; [ "$s" = "755 root root" ] && echo compliant || echo "$s"

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

chown root:root <sharedir>/extension && chmod 0755 <sharedir>/extension (sharedir from pg_config --sharedir). If the permissions needed correcting, verify that no extension files in that directory were modified.

屬性

作業系統: 不限
標籤: postgresdatabasefilesystempermissions
參考資料: CIS PostgreSQL 18 Benchmark v1.0.0 - 2.2 Ensure extension directory has appropriate ownership and permissions

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target postgres