[SOLR-14015] remove blanket filesystem read access from solr-tests.policy

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 8.4
• Assignee: Robert Muir
• Reporter: Robert Muir
• Created: 05/Dec/19 01:59
• Updated: 21/Jan/20 16:56
• Resolved: 05/Dec/19 21:46

Description

The lucene policy is strict and specifies only specific locations.
Unfortunately currently the solr policy allows read to ALL FILES

The tests shouldn't be able to read anywhere, e.g. my .ssh/ directory or whatever.
It is a necessary painful step to eventually eliminate directory traversal attacks, etc.

Issue Links

• relates to: SOLR-14020 move hadoop hacks out of lucene TestSecurityManager into a solr one