Обсуждение: initdb -S versus superuser check and Windows restricted mode

I noticed that if you use "initdb -S", the code does its thing and
exits without ever calling get_restricted_token().  It doesn't get
to get_id() where the no-superuser check is, either.  Is this OK,
or should we reorder the operations so that fsyncing is done with
the usual restricted privileges?

You could argue that it's harmless to let root do a bunch of fsyncs,
and that's probably true, but on the other hand this doesn't meet
our usual expectations that no significant PG code runs as root.

Thoughts?
        regards, tom lane

On Sat, May 30, 2015 at 6:08 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> I noticed that if you use "initdb -S", the code does its thing and
> exits without ever calling get_restricted_token().  It doesn't get
> to get_id() where the no-superuser check is, either.  Is this OK,
> or should we reorder the operations so that fsyncing is done with
> the usual restricted privileges?
>
> You could argue that it's harmless to let root do a bunch of fsyncs,
> and that's probably true, but on the other hand this doesn't meet
> our usual expectations that no significant PG code runs as root.
>
> Thoughts?

There is indeed no harm in letting root doing only fsync, but FWIW my
vote goes for consistency with the other utilities that manipulate
PGDATA and move the calls of get_restricted_token() and get_id()
before option parsing with a HEAD-only change.
-- 
Michael