[
https://issues.apache.org/jira/browse/DERBY-5363?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13093238#comment-13093238
]
Dag H. Wanvik commented on DERBY-5363:
--------------------------------------
I see that PostGresSQL, for example does limit permissions to the db user. The
"postmaster" changes its umask to 0077, so no file is
group-readable.
http://doxygen.postgresql.org/postmaster_8c_source.html
cf this code:
00501 /*
00502 * for security, no dir or file created can be group or other
accessible
00503 */
00504 umask(S_IRWXG | S_IRWXO);
where:
S_IRWXG
read, write, execute/search by group
S_IRWXO
read, write, execute/search by others
i.e. effectively 0077.
> Tighten default permissions of DB files with >= JDK6
> ----------------------------------------------------
>
> Key: DERBY-5363
> URL: https://issues.apache.org/jira/browse/DERBY-5363
> Project: Derby
> Issue Type: Improvement
> Reporter: Dag H. Wanvik
> Attachments: derby-5363-basic-1.diff, derby-5363-basic-1.stat,
> permission-5.diff, permission-5.stat, permission-6.diff, permission-6.stat,
> property-table.png, z.sql
>
>
> Before Java 6, files created by Derby would have the default
> permissions of the operating system context. Under Unix, this would
> depend on the effective umask of the process that started the Java VM.
> In Java 6 and 7, there are methods available that allows tightening up this
> (File.setReadable, setWritable), making it less likely that somebody
> would accidentally run Derby with a too lenient default.
> I suggest we take advantage of this, and let Derby by default (in Java
> 6 and higher) limit the visibility to the OS user that starts the VM,
> e.g. on Unix this would be equivalent to running with umask 0077. More
> secure by default is good, I think.
> We could have a flag, e.g. "derby.storage.useDefaultFilePermissions"
> that when set to true, would give the old behavior.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
