[DERBY-5492] Restrictive file permissions: permissions removed also for owner on NTFS if Acl does not contain explicit entry for owner

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 10.9.1.0
• Fix Version/s: 10.9.1.0
• Component/s: Store
• Labels: derby_backport_reject_10_8
• Bug behavior facts: Security
• Assignee: Dag H. Wanvik
• Reporter: Dag H. Wanvik
• Created: 07/Nov/11 10:29
• Updated: 08/Jul/13 20:57
• Resolved: 09/Nov/11 09:40

Description

It turns out that the file owner does not necessarily get an explicit AclEntry; this depends on whether the created file has sufficient permissions already through, say, a permission for everybody to write. The present logic removes all AclEntries except those granted to the file's owner, erroneously presuming there would be such an entry always. This led to all AclEntries being removed.

This error is seen in Oracle's nightly regressions for Windows, but did not reproduced when running manually on Windows. This was due to different default inherited permissions on the directories in which the regression tests were run.

Issue Links

• is part of: DERBY-5363 Tighten permissions of DB files to owner with >= JDK7