You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "Brian Bockelman (Commented) (JIRA)" <ji...@apache.org> on 2012/02/07 00:16:59 UTC
[jira] [Commented] (HADOOP-8025) change default distcp log location
to be /tmp rather than cwd
[ https://issues.apache.org/jira/browse/HADOOP-8025?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13201756#comment-13201756 ]
Brian Bockelman commented on HADOOP-8025:
-----------------------------------------
Hi Allen,
Writing into /tmp is pretty scary to me due to things like symlink attacks. (If I want to find a security bug in a project, a simple place to start is to grep for usage of "/tmp"). It's not obvious to me whether or not the suggested patch opens distcp to symlink attacks.
If the proper flags are indeed used later on, I would suggest adding a comment to this patch pointing out why its not a problem.
Brian
PS - I'm probably a touch grouchy about this because I file tickets for user applications approximately monthly for leaving cruft in /tmp! Once it gets in the code, it never seems to escape.
> change default distcp log location to be /tmp rather than cwd
> -------------------------------------------------------------
>
> Key: HADOOP-8025
> URL: https://issues.apache.org/jira/browse/HADOOP-8025
> Project: Hadoop Common
> Issue Type: Improvement
> Affects Versions: 1.0.0
> Reporter: Allen Wittenauer
> Priority: Trivial
> Attachments: HADOOP-8025-branch-1.0.txt
>
>
> distcp loves to leave emtpy files around. this puts them in /tmp so at least they are easy to find and kill.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira