Uploaded image for project: 'Derby'
  1. Derby
  2. DERBY-5363

Tighten permissions of DB files to owner with >= JDK7

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 10.9.1.0
    • Component/s: Miscellaneous, Services, Store
    • Labels:
      None
    • Issue & fix info:
      Release Note Needed
    • Bug behavior facts:
      Security

      Description

      Before Java 6, files created by Derby would have the default
      permissions of the operating system context. Under Unix, this would
      depend on the effective umask of the process that started the Java VM.

      In Java 6 and 7, there are methods available that allows tightening up this
      (File.setReadable, setWritable), making it less likely that somebody
      would accidentally run Derby with a too lenient default.

      I suggest we take advantage of this, and let Derby by default (in Java
      6 and higher) limit the visibility to the OS user that starts the VM,
      e.g. on Unix this would be equivalent to running with umask 0077. More
      secure by default is good, I think.

      We could have a flag, e.g. "derby.storage.useDefaultFilePermissions"
      that when set to true, would give the old behavior.

        Attachments

        1. permission-5.diff
          19 kB
          Dag H. Wanvik
        2. permission-5.stat
          1 kB
          Dag H. Wanvik
        3. z.sql
          1 kB
          Rick Hillegas
        4. permission-6.diff
          35 kB
          Dag H. Wanvik
        5. permission-6.stat
          2 kB
          Dag H. Wanvik
        6. derby-5363-basic-1.diff
          78 kB
          Dag H. Wanvik
        7. derby-5363-basic-1.stat
          3 kB
          Dag H. Wanvik
        8. property-table.png
          53 kB
          Dag H. Wanvik
        9. derby-5363-basic-2.diff
          70 kB
          Dag H. Wanvik
        10. derby-5363-basic-2.stat
          2 kB
          Dag H. Wanvik
        11. derby-5363-basic-3.diff
          68 kB
          Dag H. Wanvik
        12. derby-5363-basic-3.stat
          2 kB
          Dag H. Wanvik
        13. derby-5363-server-1.diff
          4 kB
          Dag H. Wanvik
        14. derby-5363-full-1.diff
          106 kB
          Dag H. Wanvik
        15. derby-5363-full-1.stat
          3 kB
          Dag H. Wanvik
        16. derby-5363-full-2.diff
          106 kB
          Dag H. Wanvik
        17. derby-5363-full-2.stat
          3 kB
          Dag H. Wanvik
        18. releaseNote.html
          5 kB
          Dag H. Wanvik
        19. releaseNote.html
          5 kB
          Dag H. Wanvik
        20. releaseNote.html
          5 kB
          Rick Hillegas
        21. releaseNote.html
          5 kB
          Dag H. Wanvik
        22. derby-5363-full-3.diff
          107 kB
          Dag H. Wanvik
        23. derby-5363-full-3.stat
          3 kB
          Dag H. Wanvik
        24. derby-5363-full-4.diff
          102 kB
          Dag H. Wanvik
        25. derby-5363-full-4.stat
          3 kB
          Dag H. Wanvik
        26. derby-5363-full-5.diff
          101 kB
          Dag H. Wanvik
        27. derby-5363-full-5.stat
          3 kB
          Dag H. Wanvik
        28. derby-5363-followup.diff
          1 kB
          Dag H. Wanvik
        29. derby-5363-limit-to-java7.diff
          2 kB
          Dag H. Wanvik
        30. derby-5363-limit-to-java7.stat
          0.1 kB
          Dag H. Wanvik
        31. releaseNote.html
          5 kB
          Dag H. Wanvik
        32. derby-5363-followup-linux.diff
          18 kB
          Dag H. Wanvik
        33. derby-5363-followup-linux.diff
          25 kB
          Dag H. Wanvik
        34. derby-5363-limit-to-java7b.diff
          2 kB
          Dag H. Wanvik
        35. derby-5363-limit-to-java7b.stat
          0.1 kB
          Dag H. Wanvik
        36. releaseNote.html
          6 kB
          Dag H. Wanvik
        37. derby-5363-followup-unix.diff
          17 kB
          Dag H. Wanvik
        38. derby-5363-followup-unix.stat
          1 kB
          Dag H. Wanvik
        39. derby-5363-followup-unix.diff
          17 kB
          Dag H. Wanvik
        40. releaseNote.html
          6 kB
          Rick Hillegas

          Issue Links

            Activity

              People

              • Assignee:
                dagw Dag H. Wanvik
                Reporter:
                dagw Dag H. Wanvik
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: