[rfc] hs_err log in temp readable for all

Jiri Vanek jvanek at redhat.com
Mon May 19 13:21:19 UTC 2014


I run JVM in read only directory in shared server and form time to time it fails. However, I noted that hs_logs which then go to TMP direcotry, are readable to all.
It may contains private information, and I think that this file should be readable only to its owner.

Attached webrevs fixes it:
for all hs_err logs - http://jvanek.fedorapeople.org/oracle/jdk9/stricter_permissions/minimal/1/webrev/
for hs_log in tmp only - http://jvanek.fedorapeople.org/oracle/jdk9/stricter_permissions/better/1/webrev/

If I will be even more paranoid, then i think that hs_err{pid} name is predictable, and can point to pre-created pipe. Maybe this 0600 file should be placed in 0700 directory with salt in name. Or add the salt to file itself (when created in tmp)

I will be happy to adapt the patch for your needs.

  Best regards,

More information about the hotspot-dev mailing list