Mailing-List: contact dev-help@felix.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@felix.apache.org
Received-SPF: pass (athena.apache.org: domain of karlpauls@gmail.com
 designates 209.85.216.49 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAJnwQNh+X5s9W=zknqTH2gt7+mzRYt92USbfcNvuTZxXfqaCpQ@mail.gmail.com>
References: <4EB15181.4080109@neat-it.de>
 <CAJnwQNjwSuWTSoK0BWq5WRS+GAnbaOUQwGto=hF+BUSNJT56pw@mail.gmail.com>
 <CAJnwQNh+X5s9W=zknqTH2gt7+mzRYt92USbfcNvuTZxXfqaCpQ@mail.gmail.com>
From: Karl Pauls <karlpauls@gmail.com>
Date: Wed, 2 Nov 2011 23:48:29 +0100
Message-ID: 
 <CAJnwQNgsOR=j+Wov9fejgnaZbqC-Dd72-0o5J7vpBbLB+egyvw@mail.gmail.com>
Subject: Re: Security problem in Felix - Getting full file access within the
 cache directory
To: dev@felix.apache.org
Content-Type: text/plain; charset=ISO-8859-1

Rats, you are correct. I'll commit a patch right now. Could you build
the security provider from trunk and see whether it works for you now
(it does for me)?

regards,

Karl

On Wed, Nov 2, 2011 at 11:12 PM, Karl Pauls <karlpauls@gmail.com> wrote:
> After looking at it for a bit, I agree, it seems there is a bug
> somewhere. I'll investigate (again, feel free to create a JIRA issue).
>
> regards,
>
> Karl
>
> On Wed, Nov 2, 2011 at 4:32 PM, Karl Pauls <karlpauls@gmail.com> wrote:
>> Hi,
>>
>> could you create a jira issue for tracking this and if so maybe attach
>> a reproducible scenario?
>>
>> Thanks.
>>
>> regards,
>>
>> Karl
>>
>> On Wed, Nov 2, 2011 at 3:19 PM, Michael Grammling
>> <michael.grammling@neat-it.de> wrote:
>>> Hi there,
>>>
>>> it seems that there is a security problem in the "Framework Security" module
>>> of Felix.
>>> I have full access to the bundle cache directory from each bundle.
>>>
>>> Expectation: I should only get full access to the data storage of the bundle
>>> itself.
>>> Actually I was able to create files from Bundle 25 inside the data storage
>>> of Bundle 0.
>>> I even could delete the whole directory of Bundle 0.
>>>
>>> I checked the same with Knopflerfish which does this check correctly.
>>>
>>> Do I have to set more configuration parameters?
>>> The OSGi specification defines that the framework should grant access to the
>>> bundle's data storage.
>>>
>>> Best regards,
>>> Michael
>>>
>>>
>>
>>
>>
>> --
>> Karl Pauls
>> karlpauls@gmail.com
>> http://twitter.com/karlpauls
>> http://www.linkedin.com/in/karlpauls
>> https://profiles.google.com/karlpauls
>>
>
>
>
> --
> Karl Pauls
> karlpauls@gmail.com
> http://twitter.com/karlpauls
> http://www.linkedin.com/in/karlpauls
> https://profiles.google.com/karlpauls
>


-- 
Karl Pauls
karlpauls@gmail.com
http://twitter.com/karlpauls
http://www.linkedin.com/in/karlpauls
https://profiles.google.com/karlpauls