• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Jeanne Boyarsky
  • Ron McLeod
  • Paul Clapham
  • Liutauras Vilda
Sheriffs:
  • paul wheaton
  • Rob Spoor
  • Devaka Cooray
Saloon Keepers:
  • Stephan van Hulst
  • Tim Holloway
  • Carey Brown
  • Frits Walraven
  • Tim Moores
Bartenders:
  • Mikalai Zaikin

Possible Security Issue?

 
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
You can avoid this warning from freemarker by starting Tomcat with another user. Freemarker makes a call to System.getProperty("user.dir") and try to use it as cache directory.

Anyway, it will run just fine even if there are no permissions to access it.

Rafael
[originally posted on jforum.net by Rafael Steil]
 
Migrated From Jforum.net
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I am running as a non-root user using the JSVC daemon. JSVC starts Tomcat and then switches to the non-root user. The jforum logs are created by the non-root user (and this error is in the jforum log) so I would have thought by the time this error is happening that the effective user was not root.

Thanks for the reply.
[originally posted on jforum.net by Anonymous]
 
Migrated From Jforum.net
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I wasn't sure if I should post this here or in another forum. I am not actively developing JForum but recently installed it on Tomcat with the security manager active. I took about a half day to create the security policy by granting appropriate access as access errors were generated.

One access error is on the servlet initialization freemarker is trying to read /root. I did not grant this permission and it seems to run OK, I just get the error in my log each time the Servlet is initializing (reboot Tomcat). I am running Tomcat as a non-root user with jsvc. The stack trace is below. I'm not sure why the Servlet init would try to read from /root. By this time Tomcat is already running as the non-root user. The jforum application log also has an error for the access denied which is in the second code section.

This is probably not an issue. I looked at the freemarker javadocs but I have not looked at the JForum code. I am not familiar with freemarker but it appears this is happening when the template cache is being initialized and it is probably using the /root directory by default. My apologies in advance if this is a false alarm but I thought it was worth bringing up to get others opinions.




[originally posted on jforum.net by parisila]
 
We don't have time to be charming! Quick, read this tiny ad:
a bit of art, as a gift, that will fit in a stocking
https://gardener-gift.com
reply
    Bookmark Topic Watch Topic
  • New Topic