Derby
  1. Derby
  2. DERBY-5363

Tighten permissions of DB files to owner with >= JDK7

    Details

    • Type: Improvement Improvement
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 10.9.1.0
    • Component/s: Miscellaneous, Services, Store
    • Labels:
      None
    • Issue & fix info:
      Release Note Needed
    • Bug behavior facts:
      Security

      Description

      Before Java 6, files created by Derby would have the default
      permissions of the operating system context. Under Unix, this would
      depend on the effective umask of the process that started the Java VM.

      In Java 6 and 7, there are methods available that allows tightening up this
      (File.setReadable, setWritable), making it less likely that somebody
      would accidentally run Derby with a too lenient default.

      I suggest we take advantage of this, and let Derby by default (in Java
      6 and higher) limit the visibility to the OS user that starts the VM,
      e.g. on Unix this would be equivalent to running with umask 0077. More
      secure by default is good, I think.

      We could have a flag, e.g. "derby.storage.useDefaultFilePermissions"
      that when set to true, would give the old behavior.

      1. permission-5.diff
        19 kB
        Dag H. Wanvik
      2. permission-5.stat
        1 kB
        Dag H. Wanvik
      3. z.sql
        1 kB
        Rick Hillegas
      4. permission-6.diff
        35 kB
        Dag H. Wanvik
      5. permission-6.stat
        2 kB
        Dag H. Wanvik
      6. derby-5363-basic-1.diff
        78 kB
        Dag H. Wanvik
      7. derby-5363-basic-1.stat
        3 kB
        Dag H. Wanvik
      8. property-table.png
        53 kB
        Dag H. Wanvik
      9. derby-5363-basic-2.diff
        70 kB
        Dag H. Wanvik
      10. derby-5363-basic-2.stat
        2 kB
        Dag H. Wanvik
      11. derby-5363-basic-3.diff
        68 kB
        Dag H. Wanvik
      12. derby-5363-basic-3.stat
        2 kB
        Dag H. Wanvik
      13. derby-5363-server-1.diff
        4 kB
        Dag H. Wanvik
      14. derby-5363-full-1.diff
        106 kB
        Dag H. Wanvik
      15. derby-5363-full-1.stat
        3 kB
        Dag H. Wanvik
      16. derby-5363-full-2.diff
        106 kB
        Dag H. Wanvik
      17. derby-5363-full-2.stat
        3 kB
        Dag H. Wanvik
      18. releaseNote.html
        5 kB
        Dag H. Wanvik
      19. releaseNote.html
        5 kB
        Dag H. Wanvik
      20. releaseNote.html
        5 kB
        Rick Hillegas
      21. releaseNote.html
        5 kB
        Dag H. Wanvik
      22. derby-5363-full-3.diff
        107 kB
        Dag H. Wanvik
      23. derby-5363-full-3.stat
        3 kB
        Dag H. Wanvik
      24. derby-5363-full-4.diff
        102 kB
        Dag H. Wanvik
      25. derby-5363-full-4.stat
        3 kB
        Dag H. Wanvik
      26. derby-5363-full-5.diff
        101 kB
        Dag H. Wanvik
      27. derby-5363-full-5.stat
        3 kB
        Dag H. Wanvik
      28. derby-5363-followup.diff
        1 kB
        Dag H. Wanvik
      29. derby-5363-limit-to-java7.diff
        2 kB
        Dag H. Wanvik
      30. derby-5363-limit-to-java7.stat
        0.1 kB
        Dag H. Wanvik
      31. releaseNote.html
        5 kB
        Dag H. Wanvik
      32. derby-5363-followup-linux.diff
        18 kB
        Dag H. Wanvik
      33. derby-5363-followup-linux.diff
        25 kB
        Dag H. Wanvik
      34. derby-5363-limit-to-java7b.diff
        2 kB
        Dag H. Wanvik
      35. derby-5363-limit-to-java7b.stat
        0.1 kB
        Dag H. Wanvik
      36. releaseNote.html
        6 kB
        Dag H. Wanvik
      37. derby-5363-followup-unix.diff
        17 kB
        Dag H. Wanvik
      38. derby-5363-followup-unix.stat
        1 kB
        Dag H. Wanvik
      39. derby-5363-followup-unix.diff
        17 kB
        Dag H. Wanvik
      40. releaseNote.html
        6 kB
        Rick Hillegas

        Issue Links

          Activity

            People

            • Assignee:
              Dag H. Wanvik
              Reporter:
              Dag H. Wanvik
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development