[GitHub] [kafka] cadonna commented on a change in pull request #9583: [KAFKA-10705]: Make state stores not readable by others

[GitBox <gi...@apache.org>]

cadonna commented on a change in pull request #9583:
URL: https://github.com/apache/kafka/pull/9583#discussion_r522770608



##########
File path: streams/src/main/java/org/apache/kafka/streams/processor/internals/StateDirectory.java
##########
@@ -102,6 +107,15 @@ public StateDirectory(final StreamsConfig config, final Time time, final boolean
             log.warn("Using /tmp directory in the state.dir property can cause failures with writing the checkpoint file" +
                 " due to the fact that this directory can be cleared by the OS");
         }
+        final Path basePath = Paths.get(baseDir.getPath());
+        final Path statePath = Paths.get(stateDir.getPath());
+        final Set<PosixFilePermission> perms = PosixFilePermissions.fromString("rwxr-x---");

Review comment:
       I thought it would be handy to be able to log into a node to debug state store issues, e.g., with some RocksDB command line tools, with a user that is able to read not able to write, i.e., is in the group but it is not the owner.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org