Does giving a non-root user ownership of a filesytem have any security implications?
For example, the directory
/var/lib/pgsql/9.0/data and its contents needs to be owned by the postgres user. If I want to put its contents on its own filesystem, is it good practice to
- mount that filesystem directly on
- create a directory that is owned by root (such as
/mnt/pgsql_data), mount the filesystem there, create a directory owned by postgres on that filesystem (such as
/mnt/pgsql_data/data) and make
/var/lib/pgsql/9.0/dataa symlink to that directory
The only potential security problem I can see with the former is that it gives the postgres user the ability to alter the
lost+found directory (if it is an ext2, ext3, or ext4 filesystem), but I don't think this has serious implications.
What motivated me to ask this question is that creating a postgres database isn't supported if a filesystem is mounted on the data directory; see this pgsql-hackers discussion. I hadn't considered the first point of that post before.