manuzhang opened a new pull request, #6987:
URL: https://github.com/apache/datafusion-comet/pull/6987
## Which issue does this PR close?
No public issue. This addresses a security scan finding in the bundled
native-library fallback.
## Rationale for this change
When loading from `java.library.path` fails, the bundled fallback reserves a
lock-file name but copies the library to a separate, unreserved path in
`java.io.tmpdir`. A local user with access to that shared namespace can
substitute the library path before `System.load`.
## What changes are included in this PR?
- Extract into an atomically created owner-only directory and create the
library exclusively with `CREATE_NEW`, rejecting existing files and symbolic
links.
- Resolve the temporary root and require trusted ownership and safe write
permissions on every ancestor. Sticky shared directories are allowed; unsafe or
non-Unix locations fail closed.
- Set restrictive permissions at creation and make the completed library
read-only before loading.
- Close the bundled resource stream, remove failed extractions, and delete
retained libraries before their directories at JVM exit.
- Preserve the existing bundled-library reuse behavior and use a directory
prefix ignored by legacy Comet cleanup.
## How are these changes tested?
On macOS with Java 17:
The root-reactor run used base `7d294535`. The extraction patch is unchanged
on current `main` (`7d8d9b15`), and all 12 focused Java regressions were rerun
on the PR head.
- Root-reactor compilation and `NativeLibraryTest`: **12 tests passed**,
covering permissions, exclusive creation, symlink rejection, unsafe ancestors,
copy/load failure cleanup, unique paths, and shutdown cleanup.
- The same 12 tests passed with `java.io.tmpdir=/tmp`.
- A native shared-library/JNI smoke test passed using both the default
temporary directory and shared sticky `/tmp`.
- Spotless checks for changed Java files and `git diff --check` passed.
```sh
./mvnw -o test-compile surefire:test -Dtest=NativeLibraryTest \
-Dscalastyle.skip=true \
'-DspotlessFiles=.*Native(Base|Library|LibraryTest)\.java'
```
No Linux run or live race against a second local principal was performed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
