create index can fail under the SecurityManager when trying to access files in the tmp folder of a database

• Key: DERBY-616
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Critical
• Assignee: Suresh Thalamati
• Reporter: Daniel John Debrunner
• Component/s: Store
• Affects Version/s: 10.0.2.1, 10.1.1.0, 10.2.1.6
• Fix Version/s: 10.1.3.1, 10.2.1.6

Description

Seen in tests lang/wisconsin.sql and jdbcapi/maxfieldsize.java when running with the network server and the new security policy file that grants permisions on a per-jar basis. Unless permission is given to the network serve code (since it is in the stack) to access temp files in the database the test will fail.

  permission java.io.FilePermission "${derby.system.home}${/}wombat${/}tmp${/}-", "read, write, delete";

Most likely the temp files are being accessed in without a privileged block.

Easy to reproduce once the new policy file changes are checked in (see http://wiki.apache.org/db-derby/SecurityManagerTesting) by removing the permission in the derby_tests.policy file and running these tests using the jar files.

Comments

[Myrna van Lunteren]

DERBY-943 is most likely related to this issue.
See also the mail archives:
http://mail-archives.apache.org/mod_mbox/db-derby-dev/200602.mbox/[e-mail]%3e
and:
http://mail-archives.apache.org/mod_mbox/db-derby-dev/200602.mbox/[e-mail]%3e

So, For 'fixing' the nightly failure issue of DERBY-943, I will add the read, write, delete java.io.FilePermission to derby_tests.policy for the syscatdb/tmp dir (and under) in the derbynet.jar section. When this (DERBY-616) bug gets fixed, that section should also be taken out, and syscat.sql should be confirmed to work successfully with ibm142 jvm.

[Suresh Thalamati]

DERBY-616:

-- Added a missing privileged blocks for I/O call in StreamFileContainer.java ,
this class is used by the sort during index creation ..etc.
   
-- Enabled some of the tests which were not running under security manager
   earlier because of this bug to run by default with security manager.

-- removed the additional permissions from the derby test policy file
   that were added earlier to avoid this bug for some test cases.

TESTS : derbyall test suite passed on Windows XP/JDK142/ with sane classes
directory and insane jars.

It would be great if some can review and commit this patch.

svn stat:
M java\engine\org\apache\derby\impl\store\raw\data\StreamFileContainer.java

M java\testing\org\apache\derbyTesting\functionTests\tests\lang\compressTable_app.properties
M java\testing\org\apache\derbyTesting\functionTests\tests\lang\authorize_app.properties
M java\testing\org\apache\derbyTesting\functionTests\tests\lang\wisconsin_app.properties
M java\testing\org\apache\derbyTesting\functionTests\tests\lang\syscat_app.properties
M java\testing\org\apache\derbyTesting\functionTests\tests\store\holdCursorExternalSortJDBC30_app.properties
M java\testing\org\apache\derbyTesting\functionTests\tests\store\access_app.properties
M java\testing\org\apache\derbyTesting\functionTests\tests\store\testsqldecimal_app.properties
M java\testing\org\apache\derbyTesting\functionTests\util\derby_tests.policy

[Mike Matrigali]

I have reviewed, tested and committed the submitted patch for this issue.

m1_142:13>svn commit

Sending java\engine\org\apache\derby\impl\store\raw\data\StreamFileContai
ner.java
Sending java\testing\org\apache\derbyTesting\functionTests\tests\lang\aut
horize_app.properties
Sending java\testing\org\apache\derbyTesting\functionTests\tests\lang\com
pressTable_app.properties
Sending java\testing\org\apache\derbyTesting\functionTests\tests\lang\sys
cat_app.properties
Sending java\testing\org\apache\derbyTesting\functionTests\tests\lang\wis
consin_app.properties
Sending java\testing\org\apache\derbyTesting\functionTests\tests\store\ac
cess_app.properties
Sending java\testing\org\apache\derbyTesting\functionTests\tests\store\ho
ldCursorExternalSortJDBC30_app.properties
Sending java\testing\org\apache\derbyTesting\functionTests\tests\store\te
stsqldecimal_app.properties
Sending java\testing\org\apache\derbyTesting\functionTests\util\derby_tes
ts.policy
Transmitting file data .........
Committed revision 384282.

[Mike Matrigali]

backported this fix from trunk into 10.1 line:

m101_142:62>svn commit

Sending java\engine\org\apache\derby\impl\store\raw\data\StreamFileContai
ner.java
Sending java\testing\org\apache\derbyTesting\functionTests\tests\lang\aut
horize_app.properties
Sending java\testing\org\apache\derbyTesting\functionTests\tests\lang\wis
consin_app.properties
Sending java\testing\org\apache\derbyTesting\functionTests\util\derby_tes
ts.policy
Transmitting file data ....
Committed revision 397945.