[NIFI-1500] NiFi requires too much write permissions to bootstrap

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 0.5.0
• Component/s: Core Framework
• Labels: security
• Flags: Important
• Assignee: Unassigned
• Reporter: Andre F de Miranda
• Created: 11/Feb/16 02:17
• Updated: 17/Nov/16 13:10

Description

As part of NIFI-1461 it was observed that NiFi boot strapping and start up process require access that may be described as excessive.

The following access requirements should be reviewed (all paths are relative to NiFi's installation path):

Issue 1 - bin/nifi.sh requires write access to bin

Access is used to write nifi.pid

Issue 2 - NiFi requires write access to lib crashing otherwise

2016-02-11 13:00:35,497 INFO [main] org.apache.nifi.NiFi Launching NiFi...
2016-02-11 13:00:35,524 INFO [main] org.apache.nifi.BootstrapListener Started Bootstrap Listener, Listening for incoming requests on port 52097
2016-02-11 13:00:35,545 INFO [main] org.apache.nifi.BootstrapListener Successfully initiated communication with Bootstrap
2016-02-11 13:00:35,555 WARN [main] org.apache.nifi.nar.NarUnpacker Unable to load NAR library bundles due to java.io.IOException: /opt/nifi/nifi-0.5.0-SNAPSHOT/./lib directory does not have read/write privilege Will proceed without loading any further Nar bundles
2016-02-11 13:00:35,559 ERROR [main] org.apache.nifi.NiFi Failure to launch NiFi due to java.lang.IllegalStateException: Unable to find the framework NAR ClassLoader.
java.lang.IllegalStateException: Unable to find the framework NAR ClassLoader.
        at org.apache.nifi.NiFi.<init>(NiFi.java:116) ~[nifi-runtime-0.5.0-SNAPSHOT.jar:0.5.0-SNAPSHOT]
        at org.apache.nifi.NiFi.main(NiFi.java:227) ~[nifi-runtime-0.5.0-SNAPSHOT.jar:0.5.0-SNAPSHOT]
2016-02-11 13:00:35,561 INFO [Thread-1] org.apache.nifi.NiFi Initiating shutdown of Jetty web server...
2016-02-11 13:00:35,561 INFO [Thread-1] org.apache.nifi.NiFi Jetty web server shutdown completed (nicely or otherwise).

Issue 3 - NiFi requires write access to conf

Access is used by the process to save flows.xml.gz and to create templates and archives upon first start.

Issue 4 - NiFi requires write access to .

Application uses access upon first start to create the following directories:

• *_repositories;
• logs;
• state;
• work;

Issue Links

• is related to: NIFI-2818 NIFI requires write access to NIFI_HOME/lib upon start
• relates to: NIFI-1461 RPM should create nifi user and give it access to the /opt/nifi and subdirectories