Jetty

tmp directory is created with wrong uid when running jetty with setuid feature

Details

  • Type: Improvement Improvement
  • Status: Closed Closed
  • Priority: Major Major
  • Resolution: Fixed
  • Affects Version/s: 6.1.3
  • Fix Version/s: None
  • Component/s: Security and SSL
  • Labels:
    None
  • Environment:
    ubuntu linux
  • Number of attachments :
    0

Description

I'm running jetty with the new setuid feature but can't get any jsp's working, because the created tmp directory (e.g. mine is /tmp/Jetty_0_0_0_0_80_web____odwq8l under linux) will be created with the uid of the user starting jetty before setuid becomes effective (which is root in my case). When jetty tries to generate the java source from the jsp, an exception occures.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Greg Wilkins added a comment -

For now, if you create a directory $JETTY_HOME/work it will be used as the temp directory and will
should avoid this issue.

Alternately you could write a config file that does:

configure connectors.
calls open on connectors.
does setUid
starts the server.

This ordering will also avoid the issue and will not run any webapps as root.

Show
Greg Wilkins added a comment - For now, if you create a directory $JETTY_HOME/work it will be used as the temp directory and will should avoid this issue. Alternately you could write a config file that does: configure connectors. calls open on connectors. does setUid starts the server. This ordering will also avoid the issue and will not run any webapps as root.
Hide
Permalink
Greg Wilkins added a comment -

Maybe we should make this ordering the recommended approach?

Show
Greg Wilkins added a comment - Maybe we should make this ordering the recommended approach?
Greg Wilkins made changes -
Field Original Value New Value
Assignee Jan Bartel [ janb ]
Greg Wilkins made changes -
Issue Type Bug [ 1 ] Improvement [ 4 ]
Hide
Permalink
Jan Bartel added a comment -

Jetty's setuid feature was enhanced so that you can elect to only open the connectors as the root user, then setuid to the non-privileged user before starting up the webapps. In this way, all of the tmp dirs and log dirs should be created as the non-privileged user.

Show
Jan Bartel added a comment - Jetty's setuid feature was enhanced so that you can elect to only open the connectors as the root user, then setuid to the non-privileged user before starting up the webapps. In this way, all of the tmp dirs and log dirs should be created as the non-privileged user.
Jan Bartel made changes -
Status Open [ 1 ] Closed [ 6 ]
Resolution Fixed [ 1 ]

People

  • Assignee:
    Jan Bartel
    Reporter:
    Stefan Podkowinski
Vote (0)
Watch (0)

Dates

  • Created:
    Updated:
    Resolved: