Hiding /etc/shadow from Debian psql wrapper

In the recent note titled 'Hiding /etc/shadow from psql' , I've mentioned how calling psql was causing auditd to log denied reads of /etc/shadow and have showed one way to deal with this. Here is the continuation of this story, as thanks to insights from @hillu.bsky.social , it's clear that I've missed an important detail. On Debian /usr/bin/psql is actually a distro specific wrapper over the…