• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Liutauras Vilda
  • Jeanne Boyarsky
  • Devaka Cooray
  • Paul Clapham
Sheriffs:
  • Tim Cooke
  • Knute Snortum
  • Bear Bibeault
Saloon Keepers:
  • Ron McLeod
  • Tim Moores
  • Stephan van Hulst
  • Piet Souris
  • Ganesh Patekar
Bartenders:
  • Frits Walraven
  • Carey Brown
  • Tim Holloway

Possible Security Issue?

 
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
You can avoid this warning from freemarker by starting Tomcat with another user. Freemarker makes a call to System.getProperty("user.dir") and try to use it as cache directory.

Anyway, it will run just fine even if there are no permissions to access it.

Rafael
[originally posted on jforum.net by Rafael Steil]
 
Migrated From Jforum.net
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I am running as a non-root user using the JSVC daemon. JSVC starts Tomcat and then switches to the non-root user. The jforum logs are created by the non-root user (and this error is in the jforum log) so I would have thought by the time this error is happening that the effective user was not root.

Thanks for the reply.
[originally posted on jforum.net by Anonymous]
 
Migrated From Jforum.net
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I wasn't sure if I should post this here or in another forum. I am not actively developing JForum but recently installed it on Tomcat with the security manager active. I took about a half day to create the security policy by granting appropriate access as access errors were generated.

One access error is on the servlet initialization freemarker is trying to read /root. I did not grant this permission and it seems to run OK, I just get the error in my log each time the Servlet is initializing (reboot Tomcat). I am running Tomcat as a non-root user with jsvc. The stack trace is below. I'm not sure why the Servlet init would try to read from /root. By this time Tomcat is already running as the non-root user. The jforum application log also has an error for the access denied which is in the second code section.

This is probably not an issue. I looked at the freemarker javadocs but I have not looked at the JForum code. I am not familiar with freemarker but it appears this is happening when the template cache is being initialized and it is probably using the /root directory by default. My apologies in advance if this is a false alarm but I thought it was worth bringing up to get others opinions.




[originally posted on jforum.net by parisila]
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
Boost this thread!