0

I'm trying to create a symbolic link on /var/lib/pgsql/data/pg_hba.conf (default path on Fedora) pointing to the real file located somewhere else, for example /var/lib/pgsql/data/pg_hba.conf -> /home/pg_hba.conf (command for this example: sudo ln -sf /home/pg_hba.conf /var/lib/pgsql/data/pg_hba.conf).

I set /home/pg_hba.conf permissions (-rw-------), owner (postgres) and group (postgres) to be just like the original /var/lib/pgsql/data/pg_hba.conf file, I even tried to chmod 777. When I switch to user postgres and I cat /var/lib/pgsql/data/pg_hba.conf (which is now a symlink) it successfully prints the content of the /home/pg_hba.conf file.

However when I try to apply the changes by doing sudo systemctl restart postgresql I get the following error

Job for postgresql.service failed because the control process exited with error code.

See "systemctl status postgresql.service" and "journalctl -xeu postgresql.service" for details.

I checked the logs but there's no other useful information.

It's only working when I point my symlink to a file in the same directory (/var/lib/pgsql/data/) which is totally useless (ex: /var/lib/pgsql/data/pg_hba.conf -> /var/lib/pgsql/data/pg_hba.conf.bak)

If I point to anywhere else it doesn't work, even in /var/lib/pgsql which is actually the Home directory of the postgres user!

I'm new to Linux so I tried to create a symbolic link with my ~/.bashrc file just for the sake of trying (ex: ~./bashrc -> /home/.bashrc) I wrote an echo "TEST!" inside this file and applied the new configuration with . ~/.bashrc and it works just fine, my TEST! is successfully printed out.

So what's the deal with PostgreSQL? How can I fix this error and keep a symbolic link on the pg_hba.conf file?

Thanks for your answers

12
  • Why do you need to do that anyway? May 2, 2023 at 11:49
  • @NasirRiley Every time I install PostgreSQL on a new PC I have to remember to change this effing file so I can finally login with the postgres user and set a new password. So annoying, I want to save this file in a git repository like a regular dotfile May 2, 2023 at 12:15
  • I don't know what PostgreSQL or OS you are using but login is usually possible from the local system right after the database is initialized and the service started without any need to edit any of the config files. May 2, 2023 at 18:27
  • @NasirRiley I'm a Fedora. Yes it's possible to log in a shell using the sudo su - postgres command (the only way to log in actually) but it's not possible to log in from a database tool such as DBeaver or with any programming language using a connection string, which is exactly what I want to do 100% of the times. The only way to unlock this is to modify the pg_hba.conf file and change IPv4 local connections's method from ident to md5 May 3, 2023 at 7:03
  • Anyway, IMO there's no point discussing whether or not I need or don't need to do that. The thing is, I want to do that and to my understanding, a symlink should behave exactly like if the real file was directly located in this directory as long as I set the right permissions on the target file and all its parent directories (which I did). I take this challenge as a good opportunity to improve my skills and knowledge in Linux. May 3, 2023 at 7:08

1 Answer 1

0

Well, after more research about this issue, turns out the root cause comes from SELinux.

I managed to get it working by completely disabling SELinux (obviously not recommended)

/usr/bin/setenforce Permissive

I've also tried with chcon and semanage (documentation) but without any success

chcon -R -t postgresql_db_t /home
semanage fcontext -a -t postgresql_db_t /home

If anybody knows how to do this without completely disabling SELinux I'd be really interested to know.

Obviously fighting against SELinux is not the way to go so I'm giving up what I was trying to achieve but that was very interesting to learn (I've never heard of SELinux before). Even if my answer is just explaining the root cause without giving the fix, I think this is much more constructive than a "trust me bro, don't do this"...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .