Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#35322 - [ca-certificates-java] /etc/default/cacerts should can read by group and others

Attached to Project: Arch Linux
Opened by squirrel (squirely) - Thursday, 16 May 2013, 10:21 GMT
Last edited by Jan de Groot (JGC) - Friday, 17 May 2013, 11:53 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Jan de Groot (JGC)
Pierre Schmitz (Pierre)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
/etc/default/cacerts only can read by root, this cause throw an java.security.PrivilegedActionException when normal user execute a java app to access a http resource.

Additional info:
* package version(s): 20121112+nmu2-2
* config and/or log files etc.


Steps to reproduce:
I have a java app need to access http resource, it throw an java.security.PrivilegedActionException after upgrade to 20121112+nmu2-2, it's ok before upgrade.

Check /etc/default/cacerts, I found it can only read by root, add read permission for group and others, then app runs ok.
This task depends upon

Closed by  Jan de Groot (JGC)
Friday, 17 May 2013, 11:53 GMT
Reason for closing:  Not a bug
Comment by Jan de Groot (JGC) - Thursday, 16 May 2013, 11:51 GMT
/etc/default/cacerts should not be readable, as it contains the password for the keystore (which is quite public though if you don't change it)

The only difference between -1 and -2 is that the init-jks-keystore binary was moved from /usr/sbin to /usr/bin. Your application should not care about that binary at all, as it is only supposed to be run by root on certificate installation.

Loading...