ADH-5802 #18
Merged
ADH-5802 #18
+345
−74
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Updating AuditFileSpool, AuditFileQueueSpool, and AuditFileCacheProviderSpool: - The spool file permission property is now retrieved to "644" if not specified. - After file creation, permissions are enforced via AuditFileUtil.setPermissions().
- Introduce new configuration property "policy.cache.file.perms" to specify cache file permissions. - Default to "644" if the property is not set, ensuring secure file creation.
…ectories - Introduce new property "filespool.dir.perms" (default "755") to specify permissions for spool directories. - Update AuditFileSpool, AuditFileQueueSpool, and AuditFileCacheProviderSpool to use the new method instead of mkdirs() for log and archive directories.
…ache directory creation - Add new property "policy.cache.dir.perms" (default "755") to control cache directory permissions. - Replace "mkdirs()" with Files.createDirectories(), passing the directory permissions via a FileAttribute.
…files and directories - Add tests in AuditFileUtilTest for parsePermissions() with "666" and "777" to verify correct conversion to "rw-rw-rw-" and "rwxrwxrwx". - Add test for createDirectoryWithPermissions() with "777" to ensure that directories are created with full read/write/execute permissions. - Update AuditFileUtil.createDirectoryWithPermissions() to explicitly call Files.setPosixFilePermissions() after directory creation, ensuring the desired permissions are applied. - Correct calls in AuditFileSpool, AuditFileQueueSpool, and AuditFileCacheProviderSpool: use setPermissions() on indexDoneFile instead of indexFile.
…and directories - Introduce a new FileUtils utility class with methods: - parsePermissions(String permStr): converts a 3-digit permission string (e.g., "644", "755") to a Set of POSIX permissions. - setPermissions(File file, Set<PosixFilePermission> perms): sets the specified permissions on a file. - createDirectoryWithPermissions(File dir, Set<PosixFilePermission> perms): creates directories with the desired permissions and enforces them. - Update RangerRolesProvider: - Add new fields for cache file and cache directory permissions. - Parse permission strings from configuration using FileUtils.parsePermissions(). - Replace mkdirs() with FileUtils.createDirectoryWithPermissions() when creating the cache directory. - Ensure that newly created cache files are created with and set to the specified permissions. - Update PolicyRefresher: - Parse cache file and directory permissions using FileUtils.parsePermissions(). - Use FileUtils.createDirectoryWithPermissions() to create the cache directory with proper permissions. - Create the cache file with explicit permissions by calling Files.createFile() and Files.setPosixFilePermissions(). - Update RangerTagEnricher: - Parse and store cache file and directory permissions. - Pass cache file permissions to RangerTagRefresher. - When writing to the cache file, ensure it is created with and assigned the correct permissions.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Enforced File Permissions:
The patches add configurable file permission settings for audit spool files and cache files. By introducing properties like filespool.perms (defaulting to “644”).
Controlled Directory Creation:
With the introduction of filespool.dir.perms and policy.cache.dir.perms (defaulting to “755”), directories are now created using NIO.2’s Files.createDirectories() along with explicit POSIX permissions.