Start pgpool using "postgres" user by default.

Currently the Pgpool-II startup user is "root" user.
Because of the security reason, startup Pgpool-II
using non-root user is recommended.

For this reason, I modified "pgpool.service" file to start
Pgpool using  "postres" user, and allow "postrges" user to
run "if_up/down_cmd" and "arping_cmd" with sudo without a password.

The default setting of "if_up/down_cmd" and "arping_cmd" is changed:

    if_up_cmd = '/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0'
    if_down_cmd = '/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0'
    arping_cmd = '/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0'

If if_up/down_cmd or arping_cmd starts with "/",
the setting specified in "if_cmd_path" or "arping_path" will be ignored.

This patch also changes all of the config files permission to 600.

diff --git a/doc.ja/src/sgml/watchdog.sgml b/doc.ja/src/sgml/watchdog.sgml
index b893e4029a0f9aa98e8b0c9c09ea7e95e27e980a..94f5dc311d6b39dc9b20a46d5ad32053ad08ea69 100644 (file)
--- a/doc.ja/src/sgml/watchdog.sgml
+++ b/doc.ja/src/sgml/watchdog.sgml
@@ -303,9 +303,13 @@
       will use to switch the virtual IP on the system.
       Set only the path of the directory containing the binary,
       such as <literal>"/sbin"</literal> or such directory.
+      If <xref linkend="guc-if-up-cmd"> or <xref linkend="guc-if-down-cmd"> starts with "/",
+      this parameter will be ignored.
       -->
       <productname>Pgpool-II</productname>が仮想IPを切り替えるために使用するコマンドへのパスを指定します。
-      <literal>"/bin"</literal>のようにパスだけを指定します。
+      <literal>"/sbin"</literal>のようにパスだけを指定します。
+      <varname>if_up_cmd</varname>や<varname>if_down_cmd</varname>に指定したコマンドが"/"で始まる場合、
+      フルパスとみなし<varname>if_cmd_path</varname>の設定を無視します。
      </para>
      <para>
       <!--
@@ -330,12 +334,21 @@
       <!--
       Specifies the command to bring up the virtual IP.
       Set the command and parameters such as
-      <command>"ip addr add $_IP_$/24 dev eth0 label eth0:0"</command>
+      <literal>"ip addr add $_IP_$/24 dev eth0 label eth0:0"</literal>.
+      Since root privilege is required to execute this command,
+      use <command>setuid</command> on <command>ip</command> command or
+      allow Pgpool-II startup user (<literal>postgres</literal> user by default)
+      to run <command>sudo</command> command without a password, and specify it such as
+      <literal>"/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0"</literal>.
       <literal>$_IP_$</literal> will get replaced by the IP address
       specified in the <xref linkend="guc-delegate-IP">.
       -->
       仮想IPを起動するために実行するコマンドを指定します。
       <command>"ip addr add $_IP_$/24 dev eth0 label eth0:0"</command>のようにコマンドとパラメータを指定します。
+      こをコマンドを実行するには<literal>root</literal>権限が必要となりますので、一般ユーザが実行できるように
+      <command>ip</command>コマンドに<command>setuid</command>を設定するか、
+      <productname>Pgpool-II</productname>起動ユーザ(デフォルトでは<literal>postgres</literal>)がパスワードなしに<command>sudo</command>を実行できるように設定し、
+      <command>sudo</command>を介したコマンドを<literal>"/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0"</literal>のように指定します。
       <literal>$_IP_$</literal>は<xref linkend="guc-delegate-IP">で指定されたIPアドレスに置換されます。
      </para>
      <para>
@@ -359,9 +372,21 @@
       Specifies the command to bring down the virtual IP.
       Set the command and parameters such as
       <literal>"ip addr del $_IP_$/24 dev eth0"</literal>.
+      Since root privilege is required to execute this command,
+      use <command>setuid</command> on <command>ip</command> command or
+      allow Pgpool-II startup user (<literal>postgres</literal> user by default)
+      to run <command>sudo</command> command without a password, and specify it such as
+      <literal>"/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0"</literal>.
+      <literal>$_IP_$</literal> will get replaced by the IP address
+      specified in the <xref linkend="guc-delegate-IP">.
       -->
       仮想IPを停止するために実行するコマンドを指定します。
       <literal>"ip addr del $_IP_$/24 dev eth0"</literal>のようにコマンドとパラメータを指定します。
+      こをコマンドを実行するにはroot権限が必要となりますので、一般ユーザが実行できるように
+      <command>ip</command>コマンドに<command>setuid</command>を設定するか、
+      <productname>Pgpool-II</productname>起動ユーザ(デフォルトでは<literal>postgres</literal>)がパスワードなしに<command>sudo</command>を実行できるように設定し、
+      <command>sudo</command>を介したコマンドを<literal>"/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0"</literal>のように指定します。
+      <literal>$_IP_$</literal>は<xref linkend="guc-delegate-IP">で指定されたIPアドレスに置換されます。
      </para>
      <para>
       <!--
@@ -388,9 +413,13 @@
       will use to send the ARP requests after the virtual IP switch.
       Set only the path of the directory containing the binary,
       such as <literal>"/usr/sbin"</literal> or such directory.
+      If <xref linkend="guc-arping-cmd"> starts with "/",
+      this parameter will be ignored.
       -->
       IPアドレス切り替え後に<productname>Pgpool-II</productname>がARPリクエストを送信するコマンドへのパス指定します。
-      <literal>"/usr/sbin"</literal>のようにパスだけを指定します。 
+      <literal>"/usr/sbin"</literal>のようにパスだけを指定します。
+      <varname>arping_cmd</varname>に指定したコマンドが"/"で始まる場合、
+      フルパスとみなし<varname>arping_path</varname>の設定を無視します。
      </para>
      <para>
       <!--
@@ -416,13 +445,22 @@
       Specifies the command to use for sending the ARP requests
       after the virtual IP switch.
       Set the command and parameters such as
-      <literal>"arping -U $_IP_$ -w 1"</literal>.
+      <literal>"arping -U $_IP_$ -w 1 -I eth0"</literal>.
+      Since root privilege is required to execute this command,
+      use <command>setuid</command> on <command>ip</command> command or
+      allow Pgpool-II startup user (<literal>postgres</literal> user by default)
+      to run <command>sudo</command> command without a password, and specify it such as
+      <literal>"/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0"</literal>.
       <literal>$_IP_$</literal> will get replaced by
       the IP address specified in the <varname>delegate_IP</varname>.
       -->
       IPアドレス切り替え後にARPリクエストを送信するコマンドです。
-      <literal>"arping -U $_IP_$ -w 1"</literal>のようにコマンドとパラメータを指定します。
-      <literal>$_IP_$</literal>は<varname>delegate_IP</varname>で指定されたIPアドレスに置換されます。
+      <literal>"arping -U $_IP_$ -w 1 -I eth0"</literal>のようにコマンドとパラメータを指定します。
+      こをコマンドを実行するにはroot権限が必要となりますので、一般ユーザが実行できるように
+      <command>arping</command>コマンドに<literal>setuid</literal>を設定するか、
+      <productname>Pgpool-II</productname>起動ユーザ(デフォルトでは<literal>postgres</literal>ユーザ)がパスワードなしに<command>sudo</command>を実行できるように設定し、
+      <command>sudo</command>を介したコマンドを<literal>"/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0"</literal>のように設定します。
+      <literal>$_IP_$</literal>は<xref linkend="guc-delegate-IP">で指定されたIPアドレスに置換されます。
      </para>
      <para>
       <!--

diff --git a/doc/src/sgml/watchdog.sgml b/doc/src/sgml/watchdog.sgml
index 97f68c5f1b93c9af83e358dd65926516943a6bdb..3b4ef64a226f5743d48aa9c182d3c36dd9a77ae4 100644 (file)
--- a/doc/src/sgml/watchdog.sgml
+++ b/doc/src/sgml/watchdog.sgml
@@ -199,6 +199,8 @@
       will use to switch the virtual IP on the system.
       Set only the path of the directory containing the binary,
       such as <literal>"/sbin"</literal> or such directory.
+      If <xref linkend="guc-if-up-cmd"> or <xref linkend="guc-if-down-cmd"> starts with "/",
+      this parameter will be ignored.
      </para>
      <para>
       This parameter can only be set at server start.
@@ -216,7 +218,12 @@
      <para>
       Specifies the command to bring up the virtual IP.
       Set the command and parameters such as
-      <command>"ip addr add $_IP_$/24 dev eth0 label eth0:0"</command>
+      <literal>"ip addr add $_IP_$/24 dev eth0 label eth0:0"</literal>.
+      Since root privilege is required to execute this command,
+      use <command>setuid</command> on <command>ip</command> command or
+      allow <productname>Pgpool-II</productname> startup user (<literal>postgres</literal> user by default)
+      to run <command>sudo</command> command without a password, and specify it such as
+      <literal>"/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0"</literal>.
       <literal>$_IP_$</literal> will get replaced by the IP address
       specified in the <xref linkend="guc-delegate-IP">.
      </para>
@@ -237,6 +244,13 @@
       Specifies the command to bring down the virtual IP.
       Set the command and parameters such as
       <literal>"ip addr del $_IP_$/24 dev eth0"</literal>.
+      Since root privilege is required to execute this command,
+      use <command>setuid</command> on <command>ip</command> command or
+      allow <productname>Pgpool-II</productname> startup user (<literal>postgres</literal> user by default)
+      to run <command>sudo</command> command without a password, and specify it such as
+      <literal>"/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0"</literal>.
+      <literal>$_IP_$</literal> will get replaced by the IP address
+      specified in the <xref linkend="guc-delegate-IP">.
      </para>
      <para>
       This parameter can only be set at server start.
@@ -256,6 +270,8 @@
       will use to send the ARP requests after the virtual IP switch.
       Set only the path of the directory containing the binary,
       such as <literal>"/usr/sbin"</literal> or such directory.
+      If <xref linkend="guc-arping-cmd"> starts with "/",
+      this parameter will be ignored.
      </para>
      <para>
       This parameter can only be set at server start.
@@ -274,7 +290,12 @@
       Specifies the command to use for sending the ARP requests
       after the virtual IP switch.
       Set the command and parameters such as
-      <literal>"arping -U $_IP_$ -w 1"</literal>.
+      <literal>"arping -U $_IP_$ -w 1 -I eth0"</literal>.
+      Since root privilege is required to execute this command,
+      use <command>setuid</command> on <command>ip</command> command or
+      allow <productname>Pgpool-II</productname> startup user (<literal>postgres</literal> user by default)
+      to run <command>sudo</command> command without a password, and specify it such as
+      <literal>"/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0"</literal>.
       <literal>$_IP_$</literal> will get replaced by
       the IP address specified in the <varname>delegate_IP</varname>.
      </para>

diff --git a/src/config/pool_config_variables.c b/src/config/pool_config_variables.c
index f5e9b5934bb4ce4c357a6c49611ae7654c1af1f0..c91fec55c1de88792c469df8cc7c5b1205103dea 100644 (file)
--- a/src/config/pool_config_variables.c
+++ b/src/config/pool_config_variables.c
@@ -937,7 +937,7 @@ static struct config_string ConfigureNamesString[] =
                        CONFIG_VAR_TYPE_STRING, false, 0
                },
                &g_pool_config.if_up_cmd,
-               "ip addr add $_IP_$/24 dev eth0 label eth0:0",
+               "/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0",
                NULL, NULL, NULL, NULL
        },
 
@@ -947,7 +947,7 @@ static struct config_string ConfigureNamesString[] =
                        CONFIG_VAR_TYPE_STRING, false, 0
                },
                &g_pool_config.if_down_cmd,
-               "ip addr del $_IP_$/24 dev eth0",
+               "/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0",
                NULL, NULL, NULL, NULL
        },
 
@@ -967,7 +967,7 @@ static struct config_string ConfigureNamesString[] =
                        CONFIG_VAR_TYPE_STRING, false, 0
                },
                &g_pool_config.arping_cmd,
-               "arping -U $_IP_$ -w 1",
+               "/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0",
                NULL, NULL, NULL, NULL
        },
 

diff --git a/src/pgpool.spec b/src/pgpool.spec
index b178a6da6c0691bbc8404967e736d2941cc5fd8b..de268c98480b1a3e0f7cc4a8dedfbff08a87e5a2 100644 (file)
--- a/src/pgpool.spec
+++ b/src/pgpool.spec
@@ -129,6 +129,7 @@ install -d %{buildroot}%{_sysconfdir}/%{short_name}
 mv %{buildroot}%{_sysconfdir}/%{short_name}/pcp.conf.sample %{buildroot}%{_sysconfdir}/%{short_name}/pcp.conf
 mv %{buildroot}%{_sysconfdir}/%{short_name}/pgpool.conf.sample %{buildroot}%{_sysconfdir}/%{short_name}/pgpool.conf
 mv %{buildroot}%{_sysconfdir}/%{short_name}/pool_hba.conf.sample %{buildroot}%{_sysconfdir}/%{short_name}/pool_hba.conf
+touch %{buildroot}%{_sysconfdir}/%{short_name}/pool_passwd
 
 %if %{systemd_enabled}
 install -d %{buildroot}%{_unitdir}
@@ -136,7 +137,7 @@ install -m 644 %{SOURCE3} %{buildroot}%{_unitdir}/pgpool.service
 
 mkdir -p %{buildroot}%{_tmpfilesdir}
 cat > %{buildroot}%{_tmpfilesdir}/%{name}.conf <<EOF
-d %{_varrundir} 0755 root root -
+d %{_varrundir} 0755 postgres postgres -
 EOF
 %else
 install -d %{buildroot}%{_initrddir}
@@ -165,8 +166,15 @@ install doc/src/sgml/man8/*.8 %{buildroot}%{_mandir}/man8
 %clean
 rm -rf %{buildroot}
 
+%pre
+groupadd -g 26 -o -r postgres >/dev/null 2>&1 || :
+useradd -M -g postgres -o -r -d /var/lib/pgsql -s /bin/bash \
+        -c "PostgreSQL Server" -u 26 postgres >/dev/null 2>&1 || :
+
 %post
 /sbin/ldconfig
+echo 'postgres ALL=NOPASSWD: /sbin/ip' | sudo EDITOR='tee -a' visudo
+echo 'postgres ALL=NOPASSWD: /usr/sbin/arping' | sudo EDITOR='tee -a' visudo
 
 %if %{systemd_enabled}
 %systemd_post pgpool.service
@@ -232,24 +240,27 @@ fi
 %{_mandir}/man1/*.1.gz
 %{_datadir}/%{short_name}/insert_lock.sql
 %{_datadir}/%{short_name}/pgpool.pam
+%{_libdir}/libpcp.so.*
+%if %{systemd_enabled}
+%ghost %{_varrundir}
+%{_tmpfilesdir}/%{name}.conf
+%{_unitdir}/pgpool.service
+%else
+%{_initrddir}/pgpool
+%endif
+%defattr(600,postgres,postgres,-)
 %{_sysconfdir}/%{short_name}/pgpool.conf.sample-master-slave
 %{_sysconfdir}/%{short_name}/pgpool.conf.sample-replication
 %{_sysconfdir}/%{short_name}/pgpool.conf.sample-stream
 %{_sysconfdir}/%{short_name}/pgpool.conf.sample-logical
+%defattr(755,postgres,postgres,-)
 %{_sysconfdir}/%{short_name}/failover.sh.sample
 %{_sysconfdir}/%{short_name}/follow_master.sh.sample
 %{_sysconfdir}/%{short_name}/pgpool_remote_start.sample
 %{_sysconfdir}/%{short_name}/recovery_1st_stage.sample
 %{_sysconfdir}/%{short_name}/recovery_2nd_stage.sample
-%{_libdir}/libpcp.so.*
-%if %{systemd_enabled}
-%ghost %{_varrundir}
-%{_tmpfilesdir}/%{name}.conf
-%{_unitdir}/pgpool.service
-%else
-%{_initrddir}/pgpool
-%endif
-%attr(764,root,root) %config(noreplace) %{_sysconfdir}/%{short_name}/*.conf
+%attr(600,postgres,postgres) %config(noreplace) %{_sysconfdir}/%{short_name}/*.conf
+%attr(600,postgres,postgres) %config(noreplace) %{_sysconfdir}/%{short_name}/pool_passwd
 %config(noreplace) %{_sysconfdir}/sysconfig/pgpool
 
 %files devel

diff --git a/src/redhat/pgpool.service b/src/redhat/pgpool.service
index 99fbadf05421e812b72b24324d64c35d9cdd35af..bf2d3236393afe438f0371f0e060774abcf85473 100644 (file)
--- a/src/redhat/pgpool.service
+++ b/src/redhat/pgpool.service
@@ -4,6 +4,9 @@ After=syslog.target network.target
 
 [Service]
 
+User=postgres
+Group=postgres
+
 EnvironmentFile=-/etc/sysconfig/pgpool
 
 ExecStart=/usr/bin/pgpool -f /etc/pgpool-II/pgpool.conf $OPTS

diff --git a/src/sample/pgpool.conf.sample b/src/sample/pgpool.conf.sample
index 31e420dab304224c8c4c64f570f184a1345ab140..d46ba49573c04d020077117b481e77b82f03ed3f 100644 (file)
--- a/src/sample/pgpool.conf.sample
+++ b/src/sample/pgpool.conf.sample
@@ -598,18 +598,20 @@ delegate_IP = ''
                                     # If this is empty, virtual IP never bring up.
                                     # (change requires restart)
 if_cmd_path = '/sbin'
-                                    # path to the directory where if_up/down_cmd exists 
+                                    # path to the directory where if_up/down_cmd exists
+                                    # If if_up/down_cmd starts with "/", if_cmd_path will be ignored.
                                     # (change requires restart)
-if_up_cmd = 'ip addr add $_IP_$/24 dev eth0 label eth0:0'
+if_up_cmd = '/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0'
                                     # startup delegate IP command
                                     # (change requires restart)
-if_down_cmd = 'ip addr del $_IP_$/24 dev eth0'
+if_down_cmd = '/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0'
                                     # shutdown delegate IP command
                                     # (change requires restart)
 arping_path = '/usr/sbin'
                                     # arping command path
+                                    # If arping_cmd starts with "/", if_cmd_path will be ignored.
                                     # (change requires restart)
-arping_cmd = 'arping -U $_IP_$ -w 1 -I eth0'
+arping_cmd = '/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0'
                                     # arping command
                                     # (change requires restart)
 

diff --git a/src/sample/pgpool.conf.sample-logical b/src/sample/pgpool.conf.sample-logical
index 630b2259b658880cc6fb315bc06bd19076d9807b..dbe0db3ef685e9f52ef0ec74c78d3a11aa9e9f83 100644 (file)
--- a/src/sample/pgpool.conf.sample-logical
+++ b/src/sample/pgpool.conf.sample-logical
@@ -579,21 +579,23 @@ wd_ipc_socket_dir = '/tmp'
 
 delegate_IP = ''
                                     # delegate IP address
-                                    # If this is empty, virtual IP never bring up. 
+                                    # If this is empty, virtual IP never bring up.
                                     # (change requires restart)
 if_cmd_path = '/sbin'
-                                    # path to the directory where if_up/down_cmd exists 
+                                    # path to the directory where if_up/down_cmd exists
+                                    # If if_up/down_cmd starts with "/", if_cmd_path will be ignored.
                                     # (change requires restart)
-if_up_cmd = 'ip addr add $_IP_$/24 dev eth0 label eth0:0'
+if_up_cmd = '/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0'
                                     # startup delegate IP command
                                     # (change requires restart)
-if_down_cmd = 'ip addr del $_IP_$/24 dev eth0'
+if_down_cmd = '/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0'
                                     # shutdown delegate IP command
                                     # (change requires restart)
 arping_path = '/usr/sbin'
                                     # arping command path
+                                    # If arping_cmd starts with "/", if_cmd_path will be ignored.
                                     # (change requires restart)
-arping_cmd = 'arping -U $_IP_$ -w 1 -I eth0'
+arping_cmd = '/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0'
                                     # arping command
                                     # (change requires restart)
 

diff --git a/src/sample/pgpool.conf.sample-master-slave b/src/sample/pgpool.conf.sample-master-slave
index 4d7d8c8d533e5395a9f04dbe0f8880b7bac51903..f3e4eeb6dc4bb8ef342c81fe834ee70912bda9fa 100644 (file)
--- a/src/sample/pgpool.conf.sample-master-slave
+++ b/src/sample/pgpool.conf.sample-master-slave
@@ -589,21 +589,23 @@ wd_ipc_socket_dir = '/tmp'
 
 delegate_IP = ''
                                     # delegate IP address
-                                    # If this is empty, virtual IP never bring up. 
+                                    # If this is empty, virtual IP never bring up.
                                     # (change requires restart)
 if_cmd_path = '/sbin'
-                                    # path to the directory where if_up/down_cmd exists 
+                                    # path to the directory where if_up/down_cmd exists
+                                    # If if_up/down_cmd starts with "/", if_cmd_path will be ignored.
                                     # (change requires restart)
-if_up_cmd = 'ip addr add $_IP_$/24 dev eth0 label eth0:0'
+if_up_cmd = '/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0'
                                     # startup delegate IP command
                                     # (change requires restart)
-if_down_cmd = 'ip addr del $_IP_$/24 dev eth0'
+if_down_cmd = '/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0'
                                     # shutdown delegate IP command
                                     # (change requires restart)
 arping_path = '/usr/sbin'
                                     # arping command path
+                                    # If arping_cmd starts with "/", arping_path will be ignored.
                                     # (change requires restart)
-arping_cmd = 'arping -U $_IP_$ -w 1 -I eth0'
+arping_cmd = '/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0'
                                     # arping command
                                     # (change requires restart)
 

diff --git a/src/sample/pgpool.conf.sample-replication b/src/sample/pgpool.conf.sample-replication
index d74ea472bed3c8aaa9e1a72b8a6a60e70d404d75..01a7001e9b1914c1825f5fbb82b73565b30d75e0 100644 (file)
--- a/src/sample/pgpool.conf.sample-replication
+++ b/src/sample/pgpool.conf.sample-replication
@@ -590,21 +590,23 @@ wd_ipc_socket_dir = '/tmp'
 
 delegate_IP = ''
                                     # delegate IP address
-                                    # If this is empty, virtual IP never bring up. 
+                                    # If this is empty, virtual IP never bring up.
                                     # (change requires restart)
 if_cmd_path = '/sbin'
-                                    # path to the directory where if_up/down_cmd exists 
+                                    # path to the directory where if_up/down_cmd exists
+                                    # If if_up/down_cmd starts with "/", if_cmd_path will be ignored.
                                     # (change requires restart)
-if_up_cmd = 'ip addr add $_IP_$/24 dev eth0 label eth0:0'
+if_up_cmd = '/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0'
                                     # startup delegate IP command
                                     # (change requires restart)
-if_down_cmd = 'ip addr del $_IP_$/24 dev eth0'
+if_down_cmd = '/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0'
                                     # shutdown delegate IP command
                                     # (change requires restart)
 arping_path = '/usr/sbin'
                                     # arping command path
+                                    # If arping_cmd starts with "/", if_cmd_path will be ignored.
                                     # (change requires restart)
-arping_cmd = 'arping -U $_IP_$ -w 1 -I eth0'
+arping_cmd = '/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0'
                                     # arping command
                                     # (change requires restart)
 

diff --git a/src/sample/pgpool.conf.sample-stream b/src/sample/pgpool.conf.sample-stream
index c625e740ceb26c175965736eb3517977b58619b7..ef20c0ff7df4ceaf72b4a9fa4ef505dc4b989e5c 100644 (file)
--- a/src/sample/pgpool.conf.sample-stream
+++ b/src/sample/pgpool.conf.sample-stream
@@ -592,21 +592,23 @@ wd_ipc_socket_dir = '/tmp'
 
 delegate_IP = ''
                                     # delegate IP address
-                                    # If this is empty, virtual IP never bring up. 
+                                    # If this is empty, virtual IP never bring up.
                                     # (change requires restart)
 if_cmd_path = '/sbin'
-                                    # path to the directory where if_up/down_cmd exists 
+                                    # path to the directory where if_up/down_cmd exists
+                                    # If if_up/down_cmd starts with "/", if_cmd_path will be ignored.
                                     # (change requires restart)
-if_up_cmd = 'ip addr add $_IP_$/24 dev eth0 label eth0:0'
+if_up_cmd = '/usr/bin/sudo /sbin/ip addr add $_IP_$/24 dev eth0 label eth0:0'
                                     # startup delegate IP command
                                     # (change requires restart)
-if_down_cmd = 'ip addr del $_IP_$/24 dev eth0'
+if_down_cmd = '/usr/bin/sudo /sbin/ip addr del $_IP_$/24 dev eth0'
                                     # shutdown delegate IP command
                                     # (change requires restart)
 arping_path = '/usr/sbin'
                                     # arping command path
+                                    # If arping_cmd starts with "/", if_cmd_path will be ignored.
                                     # (change requires restart)
-arping_cmd = 'arping -U $_IP_$ -w 1 -I eth0'
+arping_cmd = '/usr/bin/sudo /usr/sbin/arping -U $_IP_$ -w 1 -I eth0'
                                     # arping command
                                     # (change requires restart)
 

diff --git a/src/watchdog/wd_if.c b/src/watchdog/wd_if.c
index a7ea3d240af3b352a6242beb0e3fcba436cbd4c1..87ac637654a00df308c2a17f290d68d4c7e82ef2 100644 (file)
--- a/src/watchdog/wd_if.c
+++ b/src/watchdog/wd_if.c
@@ -118,7 +118,12 @@ wd_IP_up(void)
        command = wd_get_cmd(pool_config->if_up_cmd);
        if (command)
        {
-               snprintf(path, sizeof(path), "%s/%s", pool_config->if_cmd_path, command);
+
+               if (command[0] == '/')
+                       snprintf(path, sizeof(path), "%s", command);
+               else
+                       snprintf(path, sizeof(path), "%s/%s", pool_config->if_cmd_path, command);
+
                rtn = exec_if_cmd(path, pool_config->if_up_cmd);
                pfree(command);
        }
@@ -135,7 +140,11 @@ wd_IP_up(void)
                command = wd_get_cmd(pool_config->arping_cmd);
                if (command)
                {
-                       snprintf(path, sizeof(path), "%s/%s", pool_config->arping_path, command);
+                       if (command[0] == '/')
+                               snprintf(path, sizeof(path), "%s", command);
+                       else
+                               snprintf(path, sizeof(path), "%s/%s", pool_config->if_cmd_path, command);
+
                        rtn = exec_if_cmd(path, pool_config->arping_cmd);
                        pfree(command);
                }
@@ -191,7 +200,11 @@ wd_IP_down(void)
        command = wd_get_cmd(pool_config->if_down_cmd);
        if (command)
        {
-               snprintf(path, sizeof(path), "%s/%s", pool_config->if_cmd_path, command);
+               if (command[0] == '/')
+                       snprintf(path, sizeof(path), "%s", command);
+               else
+                       snprintf(path, sizeof(path), "%s/%s", pool_config->if_cmd_path, command);
+
                rtn = exec_if_cmd(path, pool_config->if_down_cmd);
                pfree(command);
        }

diff --git a/src/watchdog/wd_utils.c b/src/watchdog/wd_utils.c
index 658024d5a9b253e22175a46d23c7818ecb4cbff5..c36d34f30e6091e1253a9cf628c4f19473b687a2 100644 (file)
--- a/src/watchdog/wd_utils.c
+++ b/src/watchdog/wd_utils.c
@@ -72,6 +72,9 @@ wd_check_network_command_configurations(void)
 
        /* check setuid bit of ifup command */
        command = wd_get_cmd(pool_config->if_up_cmd);
+       if (command[0] == '/')
+               return;
+
        if (command)
        {
                snprintf(path, sizeof(path), "%s/%s", pool_config->if_cmd_path, command);