Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: common-issues@hadoop.apache.org
Date: Tue, 12 Apr 2011 19:32:06 +0000 (UTC)
From: "Tom White (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: 
 <2119999565.53213.1302636726138.JavaMail.tomcat@hel.zones.apache.org>
Subject: [jira] [Commented] (HADOOP-6898) FileSystem.copyToLocal creates
 files with 777 permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/HADOOP-6898?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13019002#comment-13019002 ] 

Tom White commented on HADOOP-6898:
-----------------------------------

+1

> FileSystem.copyToLocal creates files with 777 permissions
> ---------------------------------------------------------
>
>                 Key: HADOOP-6898
>                 URL: https://issues.apache.org/jira/browse/HADOOP-6898
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: fs, security
>            Reporter: Todd Lipcon
>            Assignee: Aaron T. Myers
>            Priority: Blocker
>             Fix For: 0.22.0
>
>         Attachments: hadoop-6898.0.txt
>
>
> FileSystem.copyToLocal ends up calling through to FileUtil.copy, which calls create() on the target file system without passing any permission object. Therefore, the file ends up getting created locally with 777 permissions, which is dangerous -- even if the caller then fixes up permissions afterwards, it exposes a window in which an attacker can open the file.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira