Skip to content

handlePgpass: warn about incorrect .pgpass permissions as psql does#595

Merged
arp242 merged 1 commit intolib:masterfrom
martinatsynqfm:pgpass-permissions-warning
Jan 1, 2026
Merged

handlePgpass: warn about incorrect .pgpass permissions as psql does#595
arp242 merged 1 commit intolib:masterfrom
martinatsynqfm:pgpass-permissions-warning

Conversation

@martinatsynqfm
Copy link
Contributor

this implements the comment

i got confused today when trying to connect my program to a password-protected database. manually copying the password into the Connect string worked, but storing it in .pgpass did not. when i checked with psql, i found my error, of course

@martinatsynqfm
Copy link
Contributor Author

checks failed

https://travis-ci.org/lib/pq/jobs/217185835 looks like an intermittent issue

i don't understand https://travis-ci.org/lib/pq/jobs/217185858

@johto
Copy link
Contributor

johto commented Mar 31, 2017

I don't think it's kosher for a library to write to stderr like this.

If we want warnings there should probably be a separate interface for that (but the sql.DB interface makes that a bit cumbersome, here, again).

@martinatsynqfm
Copy link
Contributor Author

martinatsynqfm commented Mar 31, 2017

i agree that it's not nice for a library to log warnings this way. i couldn't find any mechanism that was already in use for warnings, though

do you think this driver could either

  • receive a callback function or a Writer or a Logger for sending warnings back, or
  • offer a way to let library users specify that they want hard errors if pgpass can't be used

@martinatsynqfm
Copy link
Contributor Author

then again, this is exactly what the official libpq does:

$ cat main.c
#include <err.h>
#include <stdlib.h>

#include <postgresql/libpq-fe.h>

int main() {
  PGconn *pg;
  pg = PQconnectdb("dbname=postgres");

  if (PQstatus(pg) != CONNECTION_OK)
    errx(EXIT_FAILURE, "PostgreSQL connection failed: %s", PQerrorMessage(pg));

  fprintf(stderr, "success!\n");

  return EXIT_SUCCESS;
}
$ gcc main.c -lpq
$ chmod 640 ~/.pgpass
$ ./a.out
WARNING: password file "/home/mastensg/.pgpass" has group or world access; permissions should be u=rw (0600) or less
success!
$

@matrosov-nikita
Copy link

@martinatsynqfm could you please take a look at this issue? Approach with PGPASSFILE on windows doesn't work at all because of incorrect permissions check mentioned in this PR.

@arp242 arp242 force-pushed the pgpass-permissions-warning branch 2 times, most recently from 439274d to a1adfc5 Compare January 1, 2026 07:20
Write warning to stderr instead of silently not using it. Writing to
stderr is not super great, but this is also what libpq does and for now
it's better than nothing.

Also skip this check on Windows, which is also what libpq does. See
fe-connect.c

Fixes lib#940
@arp242 arp242 force-pushed the pgpass-permissions-warning branch from a1adfc5 to 967ca11 Compare January 1, 2026 07:24
@arp242 arp242 merged commit 8c874a4 into lib:master Jan 1, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants