Does giving a non-root user ownership of a filesytem have any security implications?
For example, the directory /var/lib/pgsql/9.0/data
and its contents needs to be owned by the postgres user. If I want to put its contents on its own filesystem, is it good practice to
- mount that filesystem directly on
/var/lib/pgsql/9.0/data
or
- create a directory that is owned by root (such as
/mnt/pgsql_data
), mount the filesystem there, create a directory owned by postgres on that filesystem (such as/mnt/pgsql_data/data
) and make/var/lib/pgsql/9.0/data
a symlink to that directory
The only potential security problem I can see with the former is that it gives the postgres user the ability to alter the lost+found
directory (if it is an ext2, ext3, or ext4 filesystem), but I don't think this has serious implications.
What motivated me to ask this question is that creating a postgres database isn't supported if a filesystem is mounted on the data directory; see this pgsql-hackers discussion. I hadn't considered the first point of that post before.