public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/postgresqlBackup: set to umask to 0077

Browse Source 
* Ensure that the backup file is only readable by the owner
* Add file permission test to tests
This commit is contained in:
Markus Kowalewski 2018-11-06 21:59:29 +01:00
parent 0d30f7b023
commit a0371d4761
No known key found for this signature in database
GPG Key ID: D865C8A91D7025EB
2 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/services/backup/postgresql-backup.nix
View File

@ -20,6 +20,8 @@ let
''; '';
script = '' script = ''
umask 0077 # ensure backup is only readable by postgres user
if [ -e ${cfg.location}/${db}.sql.gz ]; then if [ -e ${cfg.location}/${db}.sql.gz ]; then
${pkgs.coreutils}/bin/mv ${cfg.location}/${db}.sql.gz ${cfg.location}/${db}.prev.sql.gz ${pkgs.coreutils}/bin/mv ${cfg.location}/${db}.sql.gz ${cfg.location}/${db}.prev.sql.gz
fi fi

1
nixos/tests/postgresql.nix
View File

@ -53,6 +53,7 @@ let
# Check backup service # Check backup service
$machine->succeed("systemctl start postgresqlBackup-postgres.service"); $machine->succeed("systemctl start postgresqlBackup-postgres.service");
$machine->succeed("zcat /var/backup/postgresql/postgres.sql.gz | grep '<test>ok</test>'"); $machine->succeed("zcat /var/backup/postgresql/postgres.sql.gz | grep '<test>ok</test>'");
$machine->succeed("stat -c '%a' /var/backup/postgresql/postgres.sql.gz | grep 600");
$machine->shutdown; $machine->shutdown;
''; '';