This article explains how to configure a Vormetric resource set to securely allow PostgreSQL startup scripts to access encrypted GuardPoints.
Why do startup scripts need access to GuardPoints?
When Linux starts a service, Linux also runs a startup script. The startup script runs when the machine powers on or when a service manually starts. The startup script typically runs tasks that relate to the starting, stopping, and restarting of a service.
For database services, the startup script typically runs tasks that occur in folders that hold database files. With encrypted database files, you must allow the startup script to access the database folders. If not, the database will not start properly, and in some cases, interfere with the power on process for the machine.
Common GuardPoints
The system needs to access the commonly guarded (encrypted) folders inside of /var/lib/pgsql.
Access to GuardPoints
The resource is relative to the GuardPoint. In other words, if the GuardPoint is /var/lib/pgsql, and you want to allow access to a particular file in that directory, you would only need to specify that specific file in your resource parameter.
For instance if the GuardPoint is /var/lib/pgsql/, then your resource would only be pg_log.
The resources that the pgsql startup script will need access are:
/pg_log
/PG_VERSION
/base
/postmaster.pid
The following image shows the files that should be included in the Resource Set, specifically for Postgres:
Allow startup scripts to access encrypted PostgreSQL databases
Log into your DSM as Security Administrator.
In the menu bar, click Polices, and then click Manage Policies.
Mark the policy that guards your databases, such as /var/ib/sql/data, and then click Add.
Under Security Rules, click Add.
Next to Resource, click Select.
In the window that appears, click Add.
In Name, enter a descriptive name for your Resource Set.
Click Add to specify a resource that will need to be accessed in the GuardPoint upon startup.
In File, enter the specified file that needs to be accessed upon startup, and then click Ok.
For example, in the image below, four resources are included in the Resource Set (pg_log, /PG_VERSION, /base, and /psotmaster.pid). These resource must be added one at a time.
(Optional) To add resources, repeat steps 8 - 10.
Mark the newly created Resource Set, and then click Select Resource Set. In the window that appears, Resource is populated with the newly created Resource Set.
Next to Effect, click Select.
Mark Permit and Apply.
Click Select Effect.
Click Ok.
Mark the rule, and then click Up to move the new rule above the catch-all rule.
Click Ok, and then click Apply to save the changes.
(Optional) You should test to make sure your system is running properly.