pg_embedded_setup_unpriv detects its effective user ID at runtime. Root
processes follow the privileged branch and complete all filesystem work as
nobody; non-root invocations leave permissions untouched and keep the
caller’s UID on the runtime directories. On unsupported Unix targets such as
macOS, root execution fails fast with a "privilege drop is not supported on
this target" error rather than attempting the Linux worker path.
Both flows create the runtime directory with mode 0700 and the data
directory with mode 0700 on Unix. Existing directories are re-chowned or
re-mode’d to enforce the expected invariants, allowing two consecutive runs
to succeed without manual cleanup. Windows skips POSIX mode changes; choose
paths whose ACLs are private to the test account when secrets matter.
The XDG cache home stays 0755 so team-mates can inspect extracted binaries
and logs when debugging CI issues. The runtime directory is clamped to 0700
because it holds the PostgreSQL socket, postmaster.pid, and .pgpass, so
leaking read or execute access would expose credentials or let other users
interfere with the helper’s cluster lifecycle.