Skip to content

Commit

Permalink
Issue #5451 - Adding configurable posix perms for ServletContext temp…
Browse files Browse the repository at this point in the history 
… directory.

Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
  • Loading branch information
@joakime
joakime committed Oct 16, 2020
1 parent 74d1473 commit 3cc549c
Show file tree
Hide file tree
Showing 4 changed files with 57 additions and 80 deletions.
17 changes: 17 additions & 0 deletions jetty-server/src/main/java/org/eclipse/jetty/server/Server.java
View file
Expand Up @@ -80,6 +80,7 @@ public class Server extends HandlerWrapper implements Attributes
private final ThreadPool _threadPool;
private final List<Connector> _connectors = new CopyOnWriteArrayList<>();
private SessionIdManager _sessionIdManager;
private String _tmpDirPosixPerms = "rwx------";
private boolean _stopAtShutdown;
private boolean _dumpAfterStart = false;
private boolean _dumpBeforeStop = false;
Expand Down Expand Up @@ -210,6 +211,11 @@ public void setStopAtShutdown(boolean stop)
_stopAtShutdown = stop;
}

public String getTempDirectoryPosixPermissions()
{
return _tmpDirPosixPerms;
}

/**
* @return Returns the connectors.
*/
Expand Down Expand Up @@ -583,6 +589,17 @@ public void setSessionIdManager(SessionIdManager sessionIdManager)
_sessionIdManager = sessionIdManager;
}

/**
* Set the POSIX permission string used for the Temp Directory creation for all webapps deployed on the server.
*
* @param perms the string for temp directory permissions
* @see java.nio.file.attribute.PosixFilePermissions#fromString(String)
*/
public void setTempDirectoryPosixPermissions(String perms)
{
_tmpDirPosixPerms = perms;
}

/*
* @see org.eclipse.util.AttributesMap#clearAttributes()
*/
Expand Down
78 changes: 0 additions & 78 deletions jetty-util/src/main/java/org/eclipse/jetty/util/IO.java
View file
Expand Up @@ -34,16 +34,8 @@
import java.nio.ByteBuffer;
import java.nio.channels.GatheringByteChannel;
import java.nio.charset.Charset;
import java.nio.file.FileStore;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.attribute.DosFileAttributeView;
import java.nio.file.attribute.FileAttribute;
import java.nio.file.attribute.PosixFileAttributeView;
import java.nio.file.attribute.PosixFilePermission;
import java.nio.file.attribute.PosixFilePermissions;
import java.util.HashSet;
import java.util.Objects;

import org.eclipse.jetty.util.log.Log;
import org.eclipse.jetty.util.log.Logger;
Expand All @@ -57,24 +49,6 @@ public class IO
{
private static final Logger LOG = Log.getLogger(IO.class);

private static final FileAttribute<?>[] NO_FILE_ATTRIBUTES = new FileAttribute[0];
private static final FileAttribute<?>[] USER_ONLY_POSIX_FILE_ATTRIBUTES =
new FileAttribute[]{
PosixFilePermissions.asFileAttribute(
new HashSet<PosixFilePermission>()
{
{
add(PosixFilePermission.OWNER_EXECUTE);
add(PosixFilePermission.OWNER_READ);
add(PosixFilePermission.OWNER_WRITE);
// we don't add GROUP or OTHER write perms here.
add(PosixFilePermission.GROUP_READ);
add(PosixFilePermission.OTHERS_READ);
}
}
)
};

public static final String
CRLF = "\r\n";

Expand Down Expand Up @@ -462,58 +436,6 @@ public static void close(Writer writer)
close((Closeable)writer);
}

/**
* Get the array of {@link FileAttribute} values for the provided path
* that will set the path to Full Read/Write for the user running Jetty,
* but Readonly for other users.
* <p>
* For Unix, that's means {@link java.nio.file.attribute.PosixFileAttributes}
* where the World and Other groups have their read / write flags removed.
* </p>
* <p>
* For Windows / Dos, that means {@link java.nio.file.attribute.DosFileAttributes}
* </p>
*/
public static FileAttribute<?>[] getUserPrivateFileAttribute(Path path)
{
FileStore fileStore = null;
try
{
// Obtain a reference to the FileStore to know what kind of read-only we are capable of.
fileStore = Files.getFileStore(Objects.requireNonNull(path));

if (fileStore == null)
{
// Not on a properly implemented FileStore (seen with 3rd party FileStore implementations)
// We cannot do anything in this case, so just return.
return NO_FILE_ATTRIBUTES;
}

if (fileStore.supportsFileAttributeView(DosFileAttributeView.class))
{
// We are on a Windows / DOS filesystem.
// It might support ACL, but we don't attempt to support that here.
return NO_FILE_ATTRIBUTES;
}

if (fileStore.supportsFileAttributeView(PosixFileAttributeView.class))
{
// We are on a Unix / Linux / OSX system
return USER_ONLY_POSIX_FILE_ATTRIBUTES;
}

// If we reached this point, we have a Path on a FileSystem / FileStore that we cannot control.
// So skip the attempt to set readable.
}
catch (IOException e)
{
if (LOG.isDebugEnabled())
LOG.debug("Unable to determine attribute types on path: {}", path, e);
}

return NO_FILE_ATTRIBUTES;
}

public static byte[] readBytes(InputStream in)
throws IOException
{
Expand Down
24 changes: 24 additions & 0 deletions jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebAppContext.java
View file
Expand Up @@ -60,6 +60,7 @@
import org.eclipse.jetty.util.AttributesMap;
import org.eclipse.jetty.util.Loader;
import org.eclipse.jetty.util.MultiException;
import org.eclipse.jetty.util.StringUtil;
import org.eclipse.jetty.util.URIUtil;
import org.eclipse.jetty.util.annotation.ManagedAttribute;
import org.eclipse.jetty.util.annotation.ManagedObject;
Expand Down Expand Up @@ -177,6 +178,7 @@ public class WebAppContext extends ServletContextHandler implements WebAppClassL

private File _tmpDir;
private boolean _persistTmpDir = false;
private String _tmpDirPosixPerms;

private String _war;
private String _extraClasspath;
Expand Down Expand Up @@ -517,6 +519,11 @@ protected void doStart() throws Exception
{
try
{
if (StringUtil.isBlank(_tmpDirPosixPerms))
{
_tmpDirPosixPerms = getServer().getTempDirectoryPosixPermissions();
}

_metadata.setAllowDuplicateFragmentNames(isAllowDuplicateFragmentNames());
Boolean validate = (Boolean)getAttribute(MetaData.VALIDATE_XML);
_metadata.setValidateXml((validate != null && validate));
Expand Down Expand Up @@ -1298,12 +1305,29 @@ public void setTempDirectory(File dir)
setAttribute(TEMPDIR, _tmpDir);
}

/**
* Set the POSIX permission string used for the Temp Directory for this specific webapp.
*
* @param perms the string for temp directory permissions
* @see java.nio.file.attribute.PosixFilePermissions#fromString(String)
*/
public void setTempDirectoryPosixPermissions(String perms)
{
this._tmpDirPosixPerms = perms;
}

@ManagedAttribute(value = "temporary directory location", readonly = true)
public File getTempDirectory()
{
return _tmpDir;
}

@ManagedAttribute(value = "temporary directory perms", readonly = true)
public String getTempDirectoryPosixPermissions()
{
return _tmpDirPosixPerms;
}

/**
* If true the temp directory for this
* webapp will be kept when the webapp stops. Otherwise,
Expand Down
18 changes: 16 additions & 2 deletions jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java
View file
Expand Up @@ -24,8 +24,12 @@
import java.net.URISyntaxException;
import java.net.URL;
import java.net.URLClassLoader;
import java.nio.file.FileStore;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.attribute.PosixFileAttributeView;
import java.nio.file.attribute.PosixFilePermission;
import java.nio.file.attribute.PosixFilePermissions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
Expand Down Expand Up @@ -507,8 +511,18 @@ public void makeTempDirectory(File parent, WebAppContext context)
}
else
{
//ensure file will always be unique by appending random digits
tmpDir = Files.createTempDirectory(parent.toPath(), temp, IO.getUserPrivateFileAttribute(parent.toPath())).toFile();
Path parentPath = parent.toPath();
FileStore fileStore = Files.getFileStore(parentPath);
if (fileStore.supportsFileAttributeView(PosixFileAttributeView.class))
{
String workDirPerms = context.getTempDirectoryPosixPermissions();
Set<PosixFilePermission> permSet = PosixFilePermissions.fromString(workDirPerms);
tmpDir = Files.createTempDirectory(parentPath, temp, PosixFilePermissions.asFileAttribute(permSet)).toFile();
}
else
{
tmpDir = Files.createTempDirectory(parentPath, temp).toFile();
}
}
configureTempDirectory(tmpDir, context);

Expand Down

0 comments on commit 3cc549c

Please sign in to comment.