mirror of
https://github.com/outbackdingo/patroni.git
synced 2026-01-27 10:20:10 +00:00
01d07f86cd
Postgres supports two types of permissions: 1. owner only 2. group readable By default the first one is used because it provides better security. But, sometimes people want to run a backup tool with the user that is different from postgres. In this case the second option becomes very useful. Unfortunately it didn't work correctly because Patroni was creating files with owner access only permissions. This PR changes the behavior and permissions on files and directories that are created by Patroni will be calculated based on permissions of PGDATA. I.e., they will get group readable access when it is necessary. Close #1899 Close #1901
34 lines
1.3 KiB
Python
34 lines
1.3 KiB
Python
import unittest
|
|
import stat
|
|
|
|
from mock import Mock, patch
|
|
|
|
from patroni.file_perm import pg_perm
|
|
|
|
|
|
class TestFilePermissions(unittest.TestCase):
|
|
|
|
@patch('os.stat')
|
|
@patch('os.umask')
|
|
@patch('patroni.file_perm.logger.error')
|
|
def test_set_umask(self, mock_logger, mock_umask, mock_stat):
|
|
mock_umask.side_effect = Exception
|
|
mock_stat.return_value.st_mode = stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP
|
|
pg_perm.set_permissions_from_data_directory('test')
|
|
|
|
# umask is called with PG_MODE_MASK_GROUP
|
|
self.assertEqual(mock_umask.call_args[0][0], stat.S_IWGRP | stat.S_IRWXO)
|
|
self.assertEqual(mock_logger.call_args[0][0], 'Can not set umask to %03o: %r')
|
|
|
|
mock_umask.reset_mock()
|
|
mock_stat.return_value.st_mode = stat.S_IRWXU
|
|
pg_perm.set_permissions_from_data_directory('test')
|
|
# umask is called with PG_MODE_MASK_OWNER (permissions changed from group to owner)
|
|
self.assertEqual(mock_umask.call_args[0][0], stat.S_IRWXG | stat.S_IRWXO)
|
|
|
|
@patch('os.stat', Mock(side_effect=FileNotFoundError))
|
|
@patch('patroni.file_perm.logger.error')
|
|
def test_set_permissions_from_data_directory(self, mock_logger):
|
|
pg_perm.set_permissions_from_data_directory('test')
|
|
self.assertEqual(mock_logger.call_args[0][0], 'Can not check permissions on %s: %r')
|