This file is indexed.

/usr/bin/pg_ctlcluster is in postgresql-common 165+deb8u3.

This file is owned by root:root, with mode 0o755.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
#!/usr/bin/perl -wT

# multiversion/cluster aware pg_ctl wrapper; this also supplies the correct
# configuration parameters to 'start', and makes sure that postgres really
# stops on 'stop'.
#
# (C) 2005-2009 Martin Pitt <mpitt@debian.org>
# (C) 2009 Cyril Bouthors <cyril@bouthors.org>
# (C) 2013-2014 Christoph Berg <myon@debian.org>
#
#  This program is free software; you can redistribute it and/or modify
#  it under the terms of the GNU General Public License as published by
#  the Free Software Foundation; either version 2 of the License, or
#  (at your option) any later version.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.

use strict;
use warnings;
use Getopt::Long;
use POSIX qw/setsid dup2 setlocale LC_ALL :sys_wait_h/;
use PgCommon;
use Fcntl qw(SEEK_SET O_RDWR O_CREAT O_EXCL);
use POSIX qw(lchown);

my ($version, $cluster, $pg_ctl, $force);
my (@postmaster_auxoptions, @pg_ctl_opts_from_cli);
my (%postgresql_conf, %info);
my $mode = 'smart'; # default shutdown mode
my $foreground = 0; # don't daemonize, use postgres instead of pg_ctl
my $stdlog = 0; # when run in foreground, still log to the default logfile

# Check for known broken configurations of this cluster
sub check_valid_config {
    my %postgresql_conf = read_cluster_conf_file $version, $cluster,
        'postgresql.conf';
    my $log_statement_stats = config_bool $postgresql_conf{'log_statement_stats'};
    my $log_parser_stats = config_bool $postgresql_conf{'log_parser_stats'};
    my $log_planner_stats = config_bool $postgresql_conf{'log_planner_stats'};
    my $log_executor_stats = config_bool $postgresql_conf{'log_executor_stats'};

    # statement and other statistics are mutually exclusive
    if ($log_statement_stats && ($log_parser_stats || $log_planner_stats ||
	$log_executor_stats)) {
	error ('invalid postgresql.conf: log_statement_stats and the other log_*_stats options are mutually exclusive');
    }
}

# If a pid file is already present, delete it if it is stale/invalid, or exit
# with a notice if it belongs to an already running postgres.
sub start_check_pid_file {
    my $pidfile = $info{'pgdata'}.'/postmaster.pid';
    if (PgCommon::check_pidfile_running $pidfile) {
        print "Cluster is already running.\n";
        exit 2;
    }

    # Remove invalid or stale PID file
    if (-e $pidfile) {
	unlink $pidfile;
	print "Removed stale pid file.\n";
    }
}

# Check if a pid file is not present or it is invalid. If so, clean up/abort.
sub stop_check_pid_file {
    my $pidfile = $info{'pgdata'}.'/postmaster.pid';
    my $pid = read_pidfile $pidfile;
    return if (defined $pid && PgCommon::check_pidfile_running $pidfile); 
    if ($info{'running'}) {
	error 'pid file is invalid, please manually kill the stale server process.';
    }

    # Remove invalid or stale PID file
    if (-e $pidfile) {
	unlink $pidfile;
	print "Removed stale pid file.\n";
    }
    print "Cluster is not running.\n";
    exit 2;
}

# check if a cluster reliably connects or fails
# Arguments: <version> <cluster> <port> <socket dir>
sub cluster_port_ready {
    my ($v, $c, $p, $sd) = @_;
    my $psql = get_program_path 'psql', $v;
    error 'cluster_port_ready: could not find psql binary' unless $psql;
    my $n = 0;
    my $result = 0;


    # probe until we get three successful or failed connections in a row
    $ENV{'PGPASSWORD'} = 'foo'; # prevent hangs if superuser cannot connect withouth password
    my $out;
    while ($n < ($result ? 10 : 3)) {
        select undef, undef, undef, 0.5;
        $out = `$psql -h '$sd' --port $p -l 2>&1 >/dev/null`;

        if ($? == $result) {    
            $n++;
        } else {
            $n = 0;
        }
        $result = $?;
    }

    if ($out =~ 'FATAL:') {
	print STDERR "WARNING: connection to the database failed, disabling startup checks:\n$out\n";
	return cluster_port_running $v, $c, $p;
    }
    return !$result;
}

sub start {
    my $cdir = $info{'configdir'};

    check_valid_config;

    start_check_pid_file;

    # check conflicting port
    if (cluster_port_running $version, $cluster, $info{'port'}) {
        my $sockdir = get_cluster_socketdir $version, $cluster;
        error("Port conflict: another instance is already running on $sockdir with port $info{'port'}");
    }

    # prepare environment (empty except for content of 'environment', and LANG)
    %ENV = read_cluster_conf_file $version, $cluster, 'environment';
    # set LANG so non-ascii chars in the server log are not replaced by '?' (affected are non-session contexts)
    unless (exists $ENV{LANG}) {
	my $lc_messages = PgCommon::get_conf_value $version, $cluster, 'postgresql.conf', 'lc_messages';
	$ENV{LANG} = $lc_messages if $lc_messages;
    }
    # 9.5 configures OOM killer using env vars
    if ($version >= 9.5) {
        $ENV{PG_OOM_ADJUST_FILE} = "/proc/self/oom_score_adj" unless (exists $ENV{PG_OOM_ADJUST_FILE});
        # PG_OOM_ADJUST_VALUE defaults to 0, but can be overridden here
    }

    my $postmaster_opts = '';
    my $usd = $version >= 9.3 ? 'unix_socket_directories' : 'unix_socket_directory';
    if (!(PgCommon::get_conf_value $version, $cluster, 'postgresql.conf', $usd)) {
	$postmaster_opts .= "-c $usd=\"$info{'socketdir'}\"";
    }

    $postmaster_opts .= " -c config_file=\"$cdir/postgresql.conf\""; 
    if (!(PgCommon::get_conf_value $version, $cluster, 'postgresql.conf', 'hba_file')) {
        $postmaster_opts .= " -c hba_file=\"$cdir/pg_hba.conf\"";
    }
    if (!(PgCommon::get_conf_value $version, $cluster, 'postgresql.conf', 'ident_file')) {
        $postmaster_opts .= " -c ident_file=\"$cdir/pg_ident.conf\""; 
    }

    if ((-d '/var/run/postgresql') && !defined (PgCommon::get_conf_value $version, $cluster, 'postgresql.conf', 'external_pid_file')) {
        # check whether /var/run/postgresql/ is writeable as the cluster owner
        my $vrp_writable;
        if ($> == 0) {
            change_ugid $info{'owneruid'}, $info{'ownergid'};
            $vrp_writable = -w '/var/run/postgresql';
            $< = $> = 0;
            $( = $) = 0;
        } else {
            $vrp_writable = -w '/var/run/postgresql';
        }
        if ($vrp_writable) {
            $postmaster_opts .= " -c external_pid_file=\"/var/run/postgresql/$version-$cluster.pid\"";
        }
    }

    $postmaster_opts .= ' ' . (join ' ', @postmaster_auxoptions);
    ($postmaster_opts) = $postmaster_opts =~ /(.*)/; # untaint

    if ($foreground) {
        if ($stdlog and $info{'logfile'}) {
            dup2(POSIX::open($info{logfile}, POSIX::O_WRONLY|POSIX::O_APPEND), 1);
            dup2(POSIX::open($info{logfile}, POSIX::O_WRONLY|POSIX::O_APPEND), 2);
        }
        my $postgres = get_program_path 'postgres', $version;
        exec '/bin/sh', '-c', "exec $postgres $postmaster_opts" or
            error "Executing $postgres failed: $!"
    }

    # only supply or default logfile path when none is given explicitly in
    # postgresql.conf
    my @options = ($pg_ctl, 'start', '-D', $info{'pgdata'});
    my $logsize = 0;
    if ($info{'logfile'}) {
        push @options, ('-l', $info{'logfile'});
        # remember current size of the log
        $logsize = (stat $info{'logfile'})[7] || 0; # ignore stat errors
    }

    push @options, @pg_ctl_opts_from_cli if @pg_ctl_opts_from_cli;

    my %pg_ctl_opts_from_file = read_cluster_conf_file $version, $cluster, 'pg_ctl.conf';
    push @options, split(' ', $pg_ctl_opts_from_file{'pg_ctl_options'})
	if defined $pg_ctl_opts_from_file{'pg_ctl_options'} and $pg_ctl_opts_from_file{'pg_ctl_options'} ne '';

    push @options, ('-s', '-o', $postmaster_opts);

    if (fork) {
        wait;
        error "could not exec $pg_ctl @options: $!" if $?;
    } else {
        setsid or error "could not start session: $!";
	# without this, you'll get zombies on startup
        dup2(POSIX::open('/dev/null', POSIX::O_WRONLY), 1);
        dup2(POSIX::open('/dev/null', POSIX::O_WRONLY), 2);
        exec $pg_ctl @options or error "could not exec $pg_ctl @options: $!";
    }

    # wait a bit until the socket exists
    my $success = 0;
    my $currlogsize = 0;
    my $pidfile = $info{'pgdata'}.'/postmaster.pid';
    for (my $attempt = 0; $attempt < 60; $attempt++) {
        select (undef, undef, undef, 0.5);
        $currlogsize = (stat $info{'logfile'})[7] if $info{'logfile'} && -r $info{'logfile'};
        if (cluster_port_running $version, $cluster, $info{'port'}) {
            $success = 1;
            last;
        }

        # if postgres wrote something, but the process does not exist any
        # more, there must be a problem and we can stop immediately
        last if ($currlogsize > $logsize && !PgCommon::check_pidfile_running $pidfile);
    }

    # OK, the server runs, now wait until it stabilized
    if ($success) {
	$success = cluster_port_ready $version, $cluster, $info{'port'}, $info{'socketdir'};
    }

    if (!$success) {
        if ($currlogsize) {
            print STDERR "The PostgreSQL server failed to start. Please check the log output:\n";
            open LOG, $info{'logfile'} or 
                error "Could not open log file " . $info{'logfile'};
            seek LOG, $logsize, SEEK_SET;
            print STDERR $_ while <LOG>;
        } else {
            print STDERR "The PostgreSQL server failed to start. Please check the log output.\n";
        }
        exit 1;
    }

    return 0;
}

sub stop {
    stop_check_pid_file;
    my $result = 1;

    if ($force) {
        if (!fork()) {
            close STDOUT;
            exec $pg_ctl, '-D', $info{'pgdata'}, '-s', '-w', '-m', 'fast', @pg_ctl_opts_from_cli, 'stop';
        } else {
            wait;
	    $result = $? >> 8;
        }

        # try harder if "fast" mode does not work
        if (-f $info{'pgdata'}.'/postmaster.pid') {
            print "(does not shutdown gracefully, now stopping immediately)\n";
	    $result = system $pg_ctl, '-D', $info{'pgdata'}, '-s', '-w', '-m', 'immediate', @pg_ctl_opts_from_cli, 'stop';
        }

        # if that still not helps, use the big hammer
        if (-f $info{'pgdata'}.'/postmaster.pid') {
            print "(does not shutdown, killing the process)";
            my $pid = read_pidfile ($info{'pgdata'}.'/postmaster.pid');
            kill (9, $pid) if $pid;
	    $result = 0;
        }
    } else {
        if (!fork()) {
            close STDOUT;
            exec $pg_ctl, '-D', $info{'pgdata'}, '-s', '-w', '-m', $mode, @pg_ctl_opts_from_cli, 'stop';
        } else {
            wait;
	    $result = $? >> 8;
        }
    }

    # external_pid_file files are currently not removed by postgres itself
    if ($result == 0) {
	unlink "/var/run/postgresql/$version-$cluster.pid";
    }

    return $result;
}

sub restart {
    my $result;

    if ($info{'running'}) {
	$result = stop;
	return $result if $result;
    }
    return start;
}

sub reload {
    exec $pg_ctl, '-D', $info{'pgdata'}, '-s', @pg_ctl_opts_from_cli, 'reload';
}

sub status {
    exec $pg_ctl, '-D', $info{'pgdata'}, 'status';
}

sub promote {
    exec $pg_ctl, '-D', $info{'pgdata'}, '-s', @pg_ctl_opts_from_cli, 'promote';
}

#
# main
#

exit 1 unless GetOptions ('o|options=s' => \@postmaster_auxoptions,
    'f|force' => \$force,
    'm|mode=s' => \$mode,
    'foreground' => \$foreground,
    'stdlog' => \$stdlog,
);

if ($mode =~ /^(s(mart)?|f(ast)?|i(mmediate)?)$/) {
    $mode = $1; # untaint
} else {
    print "Invalid -m mode, valid are: smart fast immediate\n";
    exit 1;
}

# accept both "version cluster action" and "version[-/]cluster action"
if (@ARGV < 2 or (@ARGV < 3 and $ARGV[0] !~ m![-/]!)) {
    print "Usage: $0 <version> <cluster> <action>\n";
    exit 1;
}

$version = shift @ARGV;
if ($version =~ m!^(\d+\.\d)[-/](.+)!) {
    ($version, $cluster) = ($1, $2);
} else {
    $cluster = shift @ARGV;
}
my $action = shift @ARGV;

@pg_ctl_opts_from_cli=();
foreach my $argv (@ARGV) {
    push @pg_ctl_opts_from_cli, $argv =~ /(.*)/; # untaint
}

($version) = $version =~ /^(\d+\.\d+)$/; # untaint
($cluster) = $cluster =~ /^([^'"\s]+)$/; # untaint
error 'specified cluster does not exist' unless $version && $cluster && cluster_exists $version, $cluster;
%info = cluster_info ($version, $cluster);

unless ($action eq 'stop') {
    # check if cluster is disabled in start.conf
    error 'Cluster is disabled' if $info{'start'} eq 'disabled';
}

# untaint environment
$ENV{'PATH'} = '/sbin:/bin:/usr/sbin:/usr/bin';
delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};

unless (-d $info{'pgdata'} && defined $info{'owneruid'}) {
    error $info{'pgdata'} . ' is not accessible or does not exist';
}

# check that owner uid/gid is valid
unless (getpwuid $info{'owneruid'}) {
    error 'The cluster is owned by user id '.$info{'owneruid'}.' which does not exist'
}
unless (getgrgid $info{'ownergid'}) {
    error 'The cluster is owned by group id '.$info{'ownergid'}.' which does not exist'
}
# owneruid and configuid need to match, unless configuid is root
if (($< == 0 or $> == 0) and $info{'configuid'} != 0 and
        $info{'configuid'} != $info{'owneruid'}) {
    my $configowner = (getpwuid $info{'configuid'})[0] || "(unknown)";
    my $dataowner = (getpwuid $info{'owneruid'})[0];
    error "Config owner ($configowner:$info{configuid}) and data owner ($dataowner:$info{owneruid}) do not match, and config owner is not root";
}

# recreate missing standard log dir
if ($> == 0 && ! -e '/var/log/postgresql' &&
    $info{'logfile'} =~ m!^/var/log/postgresql!) {
    system 'install', '-d', '-m', '1775', '-o', 'root', '-g', 'postgres', '/var/log/postgresql';
}

# recreate missing log file
if ($action ne 'stop' && $info{'logfile'} && ! -e $info{'logfile'}) {
    if ($> == 0) { # drop privileges; this is important if logfile
        # was determined via an /etc/postgresql/.../log symlink
        change_ugid $info{'owneruid'}, $info{'ownergid'};
    }
    sysopen (L, $info{'logfile'}, O_RDWR|O_CREAT|O_EXCL) or
	error 'Could not create log file ' . $info{'logfile'};
    close L;
    chmod 0640, $info{'logfile'};
    $< = $> = 0; # will silently fail if we were not root before, that's intended
    $( = $) = 0;
    if ($info{'owneruid'} < 500) {
        my $g = (getgrnam 'adm')[2];
        lchown $info{'owneruid'}, $g, $info{'logfile'} if (defined $g);
    }
}

# recreate /var/run/postgresql
if ($action ne 'stop' && ! -d $info{'socketdir'}) {
    system 'install', '-d', '-m', 2775,
	'-o', $info{'owneruid'}, '-g', $info{'ownergid'}, $info{'socketdir'};
}

# recreate stats_temp_directory
if ($action ne 'stop' && $info{'statstempdir'} && ! -d $info{'statstempdir'}) {
    system 'install', '-d', '-m', 750,
	'-o', $info{'owneruid'}, '-g', $info{'ownergid'}, $info{'statstempdir'};
}

if ($> == 0) {
    # have postgres start with increased OOM killer protection; 9.1 and
    # later has builtin support for resetting the adjustment of child processes
    if ($action eq 'start' and $version >= '9.1' and not $PgCommon::rpm) {
        if (-w '/proc/self/oom_score_adj') {
	    open F, '>/proc/self/oom_score_adj';
	    print F "-900\n";
	    close F;
	} 
    }

    chdir ('/var/lib/postgresql');
    change_ugid $info{'owneruid'}, $info{'ownergid'};
}

# we are running as the cluster owner now

if( $> != $info{'owneruid'} ) {
    error 'You must run this program as the cluster owner ('.
        (getpwuid $info{'owneruid'})[0].') or root';
}

$pg_ctl = get_program_path 'pg_ctl', $version;

if ($action =~ /^(start|stop|restart|reload|status|promote)$/) {
    no strict 'refs';
    exit &$action;
} else {
    error 'Invalid action (must be one of: start stop restart reload status promote)';
}

__END__

=head1 NAME

pg_ctlcluster - start/stop/restart/reload a PostgreSQL cluster

=head1 SYNOPSIS

B<pg_ctlcluster> [I<options>] I<cluster-version> I<cluster-name> I<action> B<--> [I<pg_ctl options>]

where I<action> = B<start>|B<stop>|B<restart>|B<reload>|B<status>|B<promote>

=head1 DESCRIPTION

This program controls the B<postgres> server for a particular cluster. It
essentially wraps the L<pg_ctl(1)> command. It determines the cluster version
and data path and calls the right version of B<pg_ctl> with appropriate
configuration parameters and paths.

You have to start this program as the user who owns the database cluster or as
root.

To ease integration with B<systemd> operation, the alternative syntax
"B<pg_ctlcluster> I<version>B<->I<cluster> I<action>" is also supported.

=head1 ACTIONS

=over 4

=item B<start>

A log file for this specific cluster is created if it does not exist yet (by
default,
C</var/log/postgresql/postgresql->I<cluster-version>C<->I<cluster-name>C<.log>),
and a PostreSQL server process (L<postgres(1)>) is started on it. Exits with
0 on success, with 2 if the server is already running, and with 1 on other
failure conditions.

=item B<stop>

Stops the L<postgres(1)> server of the given cluster. By default, "smart"
shutdown mode is used, which waits until all clients disconnected.

=item B<restart>

Stops the server if it is running and starts it (again).

=item B<reload>

Causes the configuration files to be re-read without a full shutdown of the
server.

=item B<status>

Checks whether a server is running. If it is, the PID and the command line
options that were used to invoke it are displayed.

=item B<promote>

Commands a running standby server to exit recovery and begin read-write
operations.

=back

=head1 OPTIONS

=over 4

=item B<-f>|B<--force>

For B<stop> and B<restart>, the "fast" mode is used which rolls back all active
transactions, disconnects clients immediately and thus shuts down cleanly. If
that does not work, shutdown is attempted again in "immediate" mode, which can
leave the cluster in an inconsistent state and thus will lead to a recovery run
at the next start. If this still does not help, the B<postgres> process is
killed.  Exits with 0 on success, with 2 if the server is not running, and with
1 on other failure conditions. This mode should only be used when the machine
is about to be shut down.

=item B<-m>|B<--mode> [B<smart>|B<fast>|B<immediate>]

Shutdown mode to use for B<stop> and B<restart> actions, default is B<smart>.
See pg_ctl(1) for documentation.

=item B<--foreground>

Start B<postgres> in foreground, without daemonizing via B<pg_ctl>.

=item B<--stdlog>

When B<--foreground> is in use, redirect stderr to the standard logfile in
C</var/log/postgresql/>.  (Default when not run in foreground.)

=item B<-o>|B<--options> I<option>

Pass given I<option> as command line option to the C<postgres> process. It is
possible to specify B<-o> multiple times. See L<postgres(1)> for a
description of valid options.

=item I<pg_ctl options>

Pass given I<pg_ctl options> as command line options to B<pg_ctl>. See L<pg_ctl(1)>
for a description of valid options.

=back

=head1 FILES

=over 4

=item C</etc/postgresql/>I<cluster-version>C</>I<cluster-name>C</pg_ctl.conf>

This configuration file contains cluster specific options to be passed to
L<pg_ctl(1)>.

=item C</etc/postgresql/>I<cluster-version>C</>I<cluster-name>C</start.conf>

This configuration file controls the start/stop behavior of the cluster. See
section "STARTUP CONTROL" in L<pg_createcluster(8)> for details.

=back

=head1 BUGS

Changing the port number on startup using B<-o -p> will not work as it breaks
the checks for running clusters.

=head1 SEE ALSO

L<pg_createcluster(8)>, L<pg_ctl(1)>, L<pg_wrapper(1)>, L<pg_lsclusters(1)>,
L<postgres(1)>

=head1 AUTHOR

Martin Pitt L<E<lt>mpitt@debian.orgE<gt>>