jmestwa-coder opened a new pull request, #4229: URL: https://github.com/apache/logging-log4j2/pull/4229
`PosixViewAttribute` applies permissions and ownership through symbolic links: - `FileUtils.defineFilePosixAttributeView` looks the view up without `NOFOLLOW_LINKS`, so `setPermissions`/`setOwner`/`setGroup` land on the link target - `walkFileTree` still hands symlinks to `visitFile`, so the `followLinks="false"` default documented on `AbstractPathAction` has no effect here - a link planted in `basePath` whose name matches the `PathCondition` glob redirects the chmod/chown onto any file the process can reach - `FileManager.defineAttributeView` goes through the same helper Requesting the view with `NOFOLLOW_LINKS` makes the change fail on a link rather than hit its target, and the visitor now skips symlinks so a planted one does not abort the rollover action. ## Checklist * Base your changes on `2.x` branch if you are targeting Log4j 2; use `main` otherwise * `./mvnw verify` succeeds ([the build instructions](https://logging.apache.org/log4j/2.x/development.html#building)) * Non-trivial changes contain an entry file in the `src/changelog/.2.x.x` directory * Tests are provided -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
