[Tomcat-users] running tomcat with root user

epicwinter@hotmail.com wrote:
I have the latest tomcat 6 installed under centos 5.2. The problem I am having is that it appears that I have to run tomcat as root user, because the spring app that tomcat starts needs to write files to other users' home directories. The tomcat user doesn't have access to these directories.

I tried making these users part of a shared group, but to complicate the problem the users are jailed using jailkit. So it doesn't appear that jailkit lets me add group write privileges to the home directories and maintain a working jail.

Can anyone suggest another alternative? I am not linux user expert so maybe there is an obvious solution i am missing?

Date: Sun, 1 Feb 2009 11:04:10 +0100
From: aw@ice-sa.com
To: users@tomcat.apache.org
Subject: Re: running tomcat with root user

epicwinter@hotmail.com wrote:
If you are courageous, you could try using ACL's.
One pre-requisite is that the filesystem type on which the users's
directories are located, must support ACL. The other pre-requisite is
that ACLs be actually enabled on that filesystem. This has to do with
the "mount" command that mounts the filesystem.
I am no specialist myself, and you'll have to get some help from a Linux
forum for that.
The next part is to understand the commands that deal with ACL's, and
that is why I said that you have to be courageous. They are not for the
faint-hearted.
Try :
man setfacl
man getfacl

Very briefly :
ACL = Access Control List
They are a possibility to set access permissions to files and
directories, in a more detailed and flexible way than Unix usual
"rwxrwxrwx"-style permissions.
You can have a directory belonging to user X and group Y, but still
allow users of group Z (e.g. Tomcat) to write to it.

All of the above of course may or may not be compatible with the "jail"
you are mentioning. I make no guarantees there.
And otherwise, you'll have to run Tomcat as root and that's it.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

epicwinter@hotmail.com wrote:

Thanks for the reply and suggestion , i am doing some heavy reading right now on ACLs. Very interesting, looks like a possible solution. I am doing this on a remote server with one drive so I am a little nervous about making these changes and seeing if it comes back up. I am also concerned if there would be a performance hit. I really wish there was a simpler solution. I wonder how insecure it really would be to run tomcat as root or if there was a way to make it "more" secure

From: epicwinter@hotmail.com
I have the latest tomcat 6 installed under centos 5.2. The
problem I am having is that it appears that I have to run
tomcat as root user, because the spring app that tomcat
starts needs to write files to other users' home directories.
The tomcat user doesn't have access to these directories.

I tried making these users part of a shared group, but to
complicate the problem the users are jailed using jailkit.
So it doesn't appear that jailkit lets me add group write
privileges to the home directories and maintain a working jail.

Can anyone suggest another alternative? I am not linux user
expert so maybe there is an obvious solution i am missing?

From: Peter.Crowther@melandra.com
To: users@tomcat.apache.org
Date: Sun, 1 Feb 2009 12:59:33 +0000
Subject: RE: running tomcat with root user
Beyond Andre's solution of ACLs, there's another one that's more complex but might be more secure. It requires a slight shift in architecture.

1) Run Tomcat as the tomcat user. Change the way it writes files, so that instead of writing to the user directory it writes the details to a queue that you have control over. That could be a database, or a chunk of filestore.

2) Write a second daemon that runs as root, that reads the queue, does whatever checks you require so that it believes the queued requests are genuine, then writes the queued items to the users' directories.

This reduces the attack surface of the system, in that tomcat's not running as root. You'd have to be careful with the security of the daemon and the queue but, if well-designed, the overall security may be better than running Tomcat as root.

- Peter

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

On Sat, 2009-01-31 at 19:25 -0800, epicwinter@hotmail.com wrote:
I have the latest tomcat 6 installed under centos 5.2. The problem I am having is that it appears that I have to run tomcat as root user, because the spring app that tomcat starts needs to write files to other users' home directories. The tomcat user doesn't have access to these directories.

I tried making these users part of a shared group, but to complicate the problem the users are jailed using jailkit. So it doesn't appear that jailkit lets me add group write privileges to the home directories and maintain a working jail.

Can anyone suggest another alternative? I am not linux user expert so maybe there is an obvious solution i am missing?
thanks

From: Brian Millett
problem I am having is that it appears that I have to run
tomcat as root user, because the spring app that tomcat
starts needs to write files to other users' home directories.
The tomcat user doesn't have access to these directories.
complicate the problem the users are jailed using jailkit.
So it doesn't appear that jailkit lets me add group write
privileges to the home directories and maintain a working jail.
http://commons.apache.org/daemon/jsvc.html

epicwinter@hotmail.com wrote:
You are correct, I found a setting that relaxes the group access permissions on the jailkit.

Now I just have one more problem. When tomcat creates files in these user directories I need the permissions to be set appropriately. What is the best way to set the umask value when running tomcat using jsvc?

André Warnier wrote:
epicwinter@hotmail.com wrote:
That's a good question.
I don't think jsvc would take any account of the Tomcat user's .profile
file.
ACLs would allow you to do that however :-)
(Seriously, I believe you can set an ACL on the target directory that
would make it so that when this particular user (Tomcat) creates a file
there, it has by default a given set of permissions).
Otherwise, you might have to do some kind of chmod from within your
webapp itself, after it creates the file. I don't know what Java method
that would be.

epicwinter@hotmail.com wrote:
That is a possible solution. There is a fairly heavy amount of files uploaded from many different users so it would mean a lot of configuration and a lot of maintenance to that config as i add new users. So I am trying to avoid the operating system chmod commands in my code.

Date: Mon, 2 Feb 2009 22:00:24 +0100
From: aw@ice-sa.com
To: users@tomcat.apache.org
Subject: Re: running tomcat with root user.....umask in jsvc?

epicwinter@hotmail.com wrote:
I don't really like that either, and it does break if you ever (yuk)
would decide to run your code on some other platform.
As far as I can tell, it would only change the umask for the current
process (the shell executing your startup script) and all its offsprings
(jsvc, tomcat). But it will do it for *everything* that these processes
do (such as creating temporary files, logfiles, etc..). That may indeed
not be very secure. For instance, one thing which Tomcat to my knowledge
does (if you have not disabled it) is to rewrite the "conf/users.xml"
file each time it starts up (or stops ?). That particular file is not
essential, and maybe Tomcat does not do that anymore in recent versions,
but there might be other such things lurking around unexpectedly.
That was my concern, I think it is a very mild security concern but still an issue nonetheless. Since the tomcat user doesn't have shell access or root access I can't see it being a big issue, it would be nice if you could set the umask for just the class loader or running java process.
I'm still a bit curious about how you did organise the upload
directories and their rights and groups etc.. finally, because you want
this one Tomcat user to be able to write into upload directories owned
originally by other users, right ? Or at least, you want these other
users afterward to have access to these files somehow.
So you must have established some common group or groups between the
Tomcat user, and these other users, right ?
I am just wondering if by doing this, you have not "weakened" the
general protection of all that stuff.

Date: Tue, 3 Feb 2009 00:10:30 +0100
From: aw@ice-sa.com
To: users@tomcat.apache.org
Subject: Re: running tomcat with root user.....umask in jsvc?

epicwinter@hotmail.com wrote:
[...]
I'm not a great security specialist, but your setup looks indeed safe
enough, if the users are chrooted to their home directories.
I can't imagine how they could break out and access things they shouldn't.

Just one more question : how do you arrange to know who is uploading a
file, and thus where to put it ?
Well each customer gets assigned it's own jailed user. The uploading facility is completely underneath a swing gui so all the customer knows is that the upload button works. When the customer logs in to their swing client they load some settings requested from the server, one of these settings happens to be their sftp login for the server and the other is the upload directory. So the server holds all this info in config files and the ysers don't even ever know what their login is.


As a footnote : having a basic problem similar to yours (under Apache,
not Tomcat), I ended up with a solution like this, implemented with
Apache and mod_perl, but which should be also transposable to Tomcat
with servlet filters and such :

To allow users to upload their files, I implemented the standard DAV
module in Apache (which also exists in Tomcat). This way, they can do
drag-and-drop directly from within their Windows Explorer, to one
directory structure on the server. And, I did not have to re-invent the
wheel for uploading files.

But that did not at first allow me to know who was uploading the file,
and what to do with it.
To know who was doing it, I thus added an HTTP authentication.
But still, DAV doesn't care, and uploads all the files under the user
Apache (Tomcat) runs under.

So I added a couple of filters, one in front and one behind DAV. The
front-end filter takes note of who this is (from the Apache
authentication), and where the user thinks he is uploading the file to
(from the URL), then changes the "PUT" URL sneakily (a la mod_rewrite),
so that DAV now uploads the file in fact somewhere completely different,
outside of the directories where the user thinks he is uploading.

Then right after DAV, another filter picks up the uploaded file from the
known place where DAV put it, and moves it to the real destination and
with the correct ownership and permissions (which it gets from where the
first filter saved them).

It is a bit like another solution suggested earlier based on a separate
daemon, only here everything happens in real-time.

I am sure this could be done in Tomcat with a servlet filter around the
DAV webapp.
I haven't done much with those filters, but i like the idea of using the filters for something like this, it is nice that it is at least somewhat external to core code.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org