[
https://issues.apache.org/jira/browse/HADOOP-6898?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13018423#comment-13018423
]
Hadoop QA commented on HADOOP-6898:
-----------------------------------
+1 overall. Here are the results of testing the latest attachment
http://issues.apache.org/jira/secure/attachment/12475985/hadoop-6898.0.txt
against trunk revision 1090485.
+1 @author. The patch does not contain any @author tags.
+1 tests included. The patch appears to include 3 new or modified tests.
+1 javadoc. The javadoc tool did not generate any warning messages.
+1 javac. The applied patch does not increase the total number of javac
compiler warnings.
+1 findbugs. The patch does not introduce any new Findbugs (version 1.3.9)
warnings.
+1 release audit. The applied patch does not increase the total number of
release audit warnings.
+1 core tests. The patch passed core unit tests.
+1 contrib tests. The patch passed contrib unit tests.
+1 system test framework. The patch passed system test framework compile.
Test results:
https://hudson.apache.org/hudson/job/PreCommit-HADOOP-Build/340//testReport/
Findbugs warnings:
https://hudson.apache.org/hudson/job/PreCommit-HADOOP-Build/340//artifact/trunk/build/test/findbugs/newPatchFindbugsWarnings.html
Console output:
https://hudson.apache.org/hudson/job/PreCommit-HADOOP-Build/340//console
This message is automatically generated.
> FileSystem.copyToLocal creates files with 777 permissions
> ---------------------------------------------------------
>
> Key: HADOOP-6898
> URL: https://issues.apache.org/jira/browse/HADOOP-6898
> Project: Hadoop Common
> Issue Type: Bug
> Components: fs, security
> Reporter: Todd Lipcon
> Assignee: Aaron T. Myers
> Priority: Blocker
> Fix For: 0.22.0
>
> Attachments: hadoop-6898.0.txt
>
>
> FileSystem.copyToLocal ends up calling through to FileUtil.copy, which calls
> create() on the target file system without passing any permission object.
> Therefore, the file ends up getting created locally with 777 permissions,
> which is dangerous -- even if the caller then fixes up permissions
> afterwards, it exposes a window in which an attacker can open the file.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
