From d306092cbc3f4b57da63dc91c7cb67444b52a86b Mon Sep 17 00:00:00 2001 From: Lucas Capistrant Date: Mon, 14 Jan 2019 07:22:04 -0600 Subject: [PATCH] Explicitly secure rw perms for recovery.conf at creation time (#910) We don't want anybody except patroni/postgres user reading this file, it contains replication user and password. --- patroni/postgresql.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/patroni/postgresql.py b/patroni/postgresql.py index 6452aea4..a8cfd7be 100644 --- a/patroni/postgresql.py +++ b/patroni/postgresql.py @@ -5,6 +5,7 @@ import re import shlex import shutil import socket +import stat import subprocess import tempfile import time @@ -1186,6 +1187,7 @@ class Postgresql(object): def write_recovery_conf(self, recovery_params): with open(self._recovery_conf, 'w') as f: + os.chmod(self._recovery_conf, stat.S_IWRITE | stat.S_IREAD) for name, value in recovery_params.items(): f.write("{0} = '{1}'\n".format(name, value))