[NIFI-2818] NIFI requires write access to NIFI_HOME/lib upon start

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0.0, 0.7.0
• Fix Version/s: 1.1.0
• Labels: security
• Assignee: Joe Witt
• Reporter: Andre F de Miranda
• Created: 24/Sep/16 11:50
• Updated: 17/Nov/16 13:10
• Resolved: 11/Nov/16 19:57

Description

As part of NIFI-1500 we noted that NiFi requires what can be described as excessive filesystem privileges to be executed.

One of the issues identified is that NiFi requires write access to NIFI_HOME/lib as illustrated by the following:

nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-nar-utils/src/main/java/org/apache/nifi/nar/NarUnpacker.java

 for (Path narLibraryDir : narLibraryDirs) {

                File narDir = narLibraryDir.toFile();
                FileUtils.ensureDirectoryExistAndCanAccess(narDir);

                File[] dirFiles = narDir.listFiles(NAR_FILTER);
                if (dirFiles != null) {
                    List<File> fileList = Arrays.asList(dirFiles);
                    narFiles.addAll(fileList);
                }
            }

Issue Links

• relates to: NIFI-1500 NiFi requires too much write permissions to bootstrap
• links to: GitHub Pull Request #1059