security: CVE-2017-12172 CVE-2017-15097

* postgresql-setup.in: Drop the root permissions ASAP, at the
beginning of the script.  Removing --datadir and
--new-systemd-unit options.  Removing the direct calls to
chown/chmod, since we create the files under 'postgres' user, and
we have set the umask to 0077.  The root_prereq call dropped,
the script can be run directly by 'postgres' user now.
($RESTORECON, $USER): New helper variables.
($SU_POSTGRES): Dropped, since we don't need to drop root
permissions on multiple places.
(generate_systemd_dropin, exit_handler): Drop this functions, not
needed since we don't support --new-systemd-unit option now.
(upgrade): Don't add semicolon into env-var hacks, since we
separate the hacks by new-line, semicolon is redundant.  Switching
from run_cmd_as_dbadmin to direct call (su is not needed), but to
keep the semantics of env-var hacks we need to 'eval' them (so
closing the env-hacks into parentheses to not affect script
variables.
* postgresql.init.in ($RESTORECON): New helper variable, must be
always set to some value, even when /sbin/restorecon is not found.
(admin_cmd): Replacement for run_cmd_as_dbadmin from library, but
now working better with arguments which need to be quoted.  Also
setting umask automatically.
(start): Use 'admin_cmd' instead of working with files under root,
or using run_cmd_as_dbadmin.
* sbin/new-systemd-unit.in: New helper script as a replacement for
the --new-systemd-unit option in postgresql-setup.
* share/postgresql-setup/library.sh.in (root_prereq): Since
this is now used in early state of *-new-systemd-unit script, we
need to reflect $PGSETUP_TEST variable to be able to run help2man
script.
(run_cmd_as_dbadmin): Dropped, no script needs this.
* configure.ac (PGADMINUSER): New substitution.
(SU_POSTGRES): Use PGADMINUSER, allows distributors to replace the
username.
(SCL_SOURCE): Always define to some value (true by default), this
simplifies working with the @SCL_SOURCE@ pattern.  Drop the
trailing semicolon, callers should do this.
* doc/Makefile.inc: Generate new $(new_unit_man) manpage.  Install
it only on systemd-aware systems.
* sbin/Makefile.inc: New file.
* .gitignore: Ignore new script under sbin/ directory.
* Makefile.am: Reflect new build subdir sbin/.
* README.rpm-dist.template: Document the (new) way how to
automatically generate new systemd unit.

Author: praiskup

.gitignore

@@ -20,6 +20,7 @@ macros.postgresql*
 package.m4
 postgresql*-check-db-dir
 postgresql*-ctl
+postgresql*-new-systemd-unit
 postgresql*.service
 /postgresql*-setup
 postgresql*-setup.1

Makefile.am

@@ -114,10 +114,12 @@ EXTRA_DIST += \
 
 include $(srcdir)/share/postgresql-setup/Makefile.inc
 include $(srcdir)/lib/rpm/Makefile.inc
+include $(srcdir)/sbin/Makefile.inc
 include $(srcdir)/doc/Makefile.inc
 
 GENERATED_FILES += \
 	$(bin_SCRIPTS) \
+	$(sbin_SCRIPTS) \
 	$(libexec_SCRIPTS) \
 	$(pgdoc_DATA) \
 	$(pkgsysconf_DATA) \

NEWS

@@ -4,6 +4,14 @@ Bugfixes in 6.0 version
 
 * Dropped dependency on /bin/find utility.
 
+* The postgresql-setup doesn't need root permissions.  It is better to not
+  run this script as 'root' user from now.
+
+Incompatible changes in 6.0 version
+
+* The postgresql-setup doesn't support --new-systemd-unit option.  Please use
+  postgresql-new-systemd-unit script instead (as 'root').
+
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Bugfixes in 5.1 version

README.rpm-dist.template

@@ -396,14 +396,19 @@ m4_ifelse([@WANT_SYSVINIT@], [1], m4_dnl
   <orderedlist>
     <listitem>
       <para>
-        Run the following command to create the necessary configuration and to
-        initialize the new database cluster
+        Run the following command to create the necessary systemd configuration:
+      </para>
+      <screen>
+        <prompt># </prompt><userinput>@NAME_BINARYBASE@-new-systemd-unit \</userinput>
+        <userinput>    --unit postgresql@secondary \</userinput>
+        <userinput>    --datadir /path/to/data/directory</userinput>
+      </screen>
+      <para>
+        And then run this command to initialize the new database cluster:
       </para>
       <screen>
         <prompt>$ </prompt><userinput>@NAME_BINARYBASE@-setup --initdb \</userinput>
         <userinput>    --unit postgresql@secondary \</userinput>
-        <userinput>    --new-systemd-unit \</userinput>
-        <userinput>    --datadir /path/to/data/directory \</userinput>
         <userinput>    --port NNNN</userinput>
       </screen>
       <para>

configure.ac

@@ -69,7 +69,10 @@ test -z "$ac_cv_path_SED" &&
 AC_PATH_PROGS([SU], [runuser su])
 test -z "$ac_cv_path_SU" &&
     AC_MSG_ERROR([Neither 'runuser' nor 'su' program found])
-SU_POSTGRES="$SU -s /bin/sh -l postgres"
+
+PGSETUP_SUBST_OPT([PGADMINUSER], [postgres],
+                  [System-default PostgreSQL admin username])
+SU_POSTGRES="$SU -s /bin/sh -l $PGADMINUSER"
 _AX_TEXT_TPL_SUBST([SU_POSTGRES])
 
 AC_PATH_PROG([MOUNTPOINT], [mountpoint], [false])
@@ -154,12 +157,12 @@ PGSETUP_SUBST_OPT([SCLS], [],
 
 SCL_BINDIR=/usr/bin
 SCL_BINARY=scl
-SCL_SOURCE=
+SCL_SOURCE=:
 SCL_SHELL_WRAPPER=
 if test -n "$SCLS"
 then
     SCL_SHELL_WRAPPER="$SCL_BINDIR/$SCL_BINARY enable $SCLS -- "
-    SCL_SOURCE="source scl_source enable $SCLS ;"
+    SCL_SOURCE="source scl_source enable $SCLS"
 fi
 
 _AX_TEXT_TPL_SUBST([SCL_SHELL_WRAPPER])

doc/Makefile.inc

@@ -23,11 +23,23 @@ HELP2MAN_RUN = \
 
 setup_man = %D%/$(NAME_BINARYBASE)-setup.1
 
+new_unit_man = %D%/$(NAME_BINARYBASE)-new-systemd-unit.1
+
 dist_man_MANS = $(setup_man)
 
+if ! WANT_SYSVINIT
+dist_man_MANS += $(new_unit_man)
+endif
+
 $(setup_man): $(NAME_BINARYBASE)-setup
 	$(AM_V_GEN)odir=`dirname "$@"` ; mkdir -p "$$odir" ; \
 	export input=$(builddir)/$(NAME_BINARYBASE)-setup ; \
 	    $(HELP2MAN_RUN)
 
-DISTCLEANFILES += $(setup_man)
+$(new_unit_man): sbin/$(NAME_BINARYBASE)-new-systemd-unit
+	$(AM_V_GEN)odir=`dirname "$@"`; mkdir -p "$$odir" ; \
+	export PGSETUP_TEST=: ; \
+	export input=$(builddir)/sbin/$(NAME_BINARYBASE)-new-systemd-unit ; \
+	    $(HELP2MAN_RUN)
+
+DISTCLEANFILES += $(setup_man) $(new_unit_man)