nixpkgs/nixos
aszlig ef553788d0
postgresql: Move socket dir to /run/postgresql
The default, which is /tmp, has a few issues associated with it:

One being that it makes it easy for users on the system to spoof a
PostgreSQL server if it's not running, causing applications to connect
to their provided sockets instead of just failing to connect.

Another one is that it makes sandboxing of PostgreSQL and other services
unnecessarily difficult. This is already the case if only PrivateTmp is
used in a systemd service, so in order for such a service to be able to
connect to PostgreSQL, a bind mount needs to be done from /tmp to some
other path, so the service can access it. This pretty much defeats the
whole purpose of PrivateTmp.

We regularily run into issues with this in the past already (one example
would be https://github.com/NixOS/nixpkgs/pull/24317) and with the new
systemd-confinement mode upcoming in
https://github.com/NixOS/nixpkgs/pull/57519, it makes it even more
tedious to sandbox services.

I've tested this change against all the postgresql NixOS VM tests and
they still succeed and I also grepped through the source tree to replace
other occasions where we might have /tmp hardcoded. Luckily there were
very few occasions.

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @ocharles, @thoughtpolice, @danbst
2019-03-15 04:52:35 +01:00
..
doc nixos/doc: add types prefix to addCheck example 2019-03-11 22:56:56 +01:00
lib nixos: doc: optionally include all modules in manual generation 2019-03-05 09:41:40 +00:00
maintainers Merge pull request #44573 from vincentbernat/feature/cloudstack 2019-02-24 08:28:42 -08:00
modules postgresql: Move socket dir to /run/postgresql 2019-03-15 04:52:35 +01:00
tests misc: Remove myself from list of maintainers 2019-03-12 23:50:52 +01:00
COPYING
default.nix nixos: export packages of the current configuration (its pkgs argument) 2018-02-09 19:35:27 +00:00
README
release-combined.nix pantheon: init a 5.0 2019-01-24 20:54:14 +00:00
release-small.nix Add the boot test to release-small.nix 2018-02-27 20:09:07 +01:00
release.nix nixos/sd-image-aarch64-new-kernel: Added to release 2018-12-26 11:03:32 +00:00

*** NixOS ***

NixOS is a Linux distribution based on the purely functional package
management system Nix.  More information can be found at
http://nixos.org/nixos and in the manual in doc/manual.