[SLIDER-931] Security permissions on set up ZK path are too lax

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Slider 0.80
• Fix Version/s: Slider 0.81
• Component/s: client
• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 01/Sep/15 17:57
• Updated: 04/Sep/15 15:00
• Resolved: 04/Sep/15 15:00

Description

Slider creates a unique ZK path for each app launch, deleting it on teardown

HBase security tests are throwing up that the path is being created world writeable, rather than world-read. Being world write means its possible for malicious code to replace the path with a different one.

This is only a risk on a secure cluster; ZK's security model on insecure clusters is only a hint that can be bypassed