feat: restrict access to postgres socket

.gitea/workflows/cd.yaml

@@ -18,7 +18,7 @@ jobs:
         env:
           GIT_REFERENCE: ${{ github.ref }}
       - name: Build rpm package
-        run: rpmbuild -ba "%(make name).spec"
+        run: rpmbuild -ba "$(make name).spec"
       - name: Upload rpm package
         run: make upload
         env:

files/postgres/postgresql.conf

@@ -5,7 +5,7 @@
 #-------------------------------------------------------------------------------
 
 # Change pg_hba location
-hba_file = "/etc/postgres/pg_hba.conf"
+hba_file = '/etc/postgres/pg_hba.conf'
 
 
 #-------------------------------------------------------------------------------
@@ -16,7 +16,10 @@ hba_file = "/etc/postgres/pg_hba.conf"
 
 # Empty listen addresses to disable listening via TCP/IP
 # because we want only uni socket connections
-listen_addresses = ""
+listen_addresses = ''
+
+# Forbide access to users not in group postgres
+unix_socket_permissions = 0770
 
 
 #-------------------------------------------------------------------------------
@@ -26,4 +29,4 @@ listen_addresses = ""
 #-------------------------------------------------------------------------------
 
 # Redirect logs to stderr to be managed by journald
-log_destination = "stderr"
+log_destination = 'stderr'

files/systemd/postgres.conf

@@ -1,2 +1,3 @@
 [Service]
+ExecStart=
 ExecStart=/usr/bin/postgres -D ${PGDATA} -c config_file=/etc/postgres/postgresql.conf

netoik-db.spec

@@ -22,25 +22,32 @@ Install the database management system called postgresql with a predefined confi
 %make_install
 
 %post
-# Create databases and users from DB_USERS variable (separator is ",") if not existing
-echo "$DB_USERS" | IFS="," read -ra users
-for user in "${users[@]}"; do
-  if ! runuser --user=postgres -- psql --quiet --tuples-only --command='\du' | grep --invert-match postgres | grep --quiet "$user"; then
-    runuser --user=postgres -- createuser "$user"
-    runuser --user=postgres -- createdb --owner="$user" "$user"
-  fi
-done
+# Create sock directory if not existing
+mkdir --parents --mode 755 "%{_rundir}/postgresql"
+chown postgres:postgres "%{_rundir}/postgresql"
 
 # Restart services
 systemctl daemon-reload
-systemctl reenable --now postgresql.service
+systemctl reenable postgresql.service
+systemctl restart postgresql.service
+
+# Create databases and users from DB_USERS variable (separator is ",") if not existing
+IFS="," read -ra users <<< "$DB_USERS";
+for user in "${users[@]}"; do
+  usermod --append --groups postgres "$user";
+  if ! runuser --user=postgres -- psql --quiet --tuples-only --command='\du' | grep --quiet "$user"; then
+    runuser --user=postgres -- createuser "$user"
+    runuser --user=postgres -- createdb --owner="$user" "$user"
+  fi
+done 
 
 %files
-%attr(755, root, root) %{_sysconfdir}/postgres
+%dir %attr(755, root, root) %{_sysconfdir}/postgres
 %attr(644, root, root) %{_sysconfdir}/postgres/postgresql.conf
 %attr(644, root, root) %{_sysconfdir}/postgres/pg_hba.conf
+
+%dir %attr(755, root, root) %{_unitdir}/postgresql.service.d
 %attr(644, root, root) %{_unitdir}/postgresql.service.d/postgres.conf
 
 %changelog
 %autochangelog
-