Re: [HACKERS] SSL over Unix-domain sockets

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: [HACKERS] SSL over Unix-domain sockets
Дата
Msg-id 19369.1200622879@sss.pgh.pa.us
обсуждение исходный текст
Ответ на Re: [HACKERS] SSL over Unix-domain sockets  (Bruce Momjian <bruce@momjian.us>)
Ответы Re: [HACKERS] SSL over Unix-domain sockets  (Bruce Momjian <bruce@momjian.us>)
Re: [HACKERS] SSL over Unix-domain sockets  (Bruce Momjian <bruce@momjian.us>)
Список pgsql-patches
Bruce Momjian <bruce@momjian.us> writes:
> I am confused because you say "dangling" then you say "to the real
> socket".  You are saying it isn't dangling when the server is running?

Exactly.  When the server is running it provides a perfectly good path
to the postmaster.  The point (and the main difference from your PIDfile
proposal) is that it's supposed to be there all the time, even when the
postmaster isn't running.  This is what provides protection against the
spoofer getting there first.

> If you are going to require the admin to modify the tmp cleanup script,
> the admin might as well create the symlink at the same time and have it
> recreate on boot.

No, that's not the same, because it doesn't provide protection against
the symlink getting deleted later on.

            regards, tom lane

В списке pgsql-patches по дате отправления:

Предыдущее
От: Bruce Momjian
Дата:
Сообщение: Re: [HACKERS] SSL over Unix-domain sockets
Следующее
От: Bruce Momjian
Дата:
Сообщение: Re: [HACKERS] SSL over Unix-domain sockets