[
https://issues.apache.org/jira/browse/HADOOP-6898?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Nigel Daley updated HADOOP-6898:
--------------------------------
Priority: Blocker (was: Critical)
Marking it as a blocker for now. Not, however, a regression.
> FileSystem.copyToLocal creates files with 777 permissions
> ---------------------------------------------------------
>
> Key: HADOOP-6898
> URL: https://issues.apache.org/jira/browse/HADOOP-6898
> Project: Hadoop Common
> Issue Type: Bug
> Components: fs, security
> Reporter: Todd Lipcon
> Priority: Blocker
> Fix For: 0.22.0
>
>
> FileSystem.copyToLocal ends up calling through to FileUtil.copy, which calls
> create() on the target file system without passing any permission object.
> Therefore, the file ends up getting created locally with 777 permissions,
> which is dangerous -- even if the caller then fixes up permissions
> afterwards, it exposes a window in which an attacker can open the file.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
