Page History

Files on multiuser systems are generally owned by a particular user. The owner of the file can determine specify which other users on the system should be allowed to access the contents of these files.

These file systems generally use a privileges and permissions model to protect file access. When a file is created, the access permissions of the file immediately dictate who may access or operate on the file. If When a program creates a file with insufficiently restrictive access permissions, an attacker may read or modify the file before the program can modify the permissions. Consequently, files must be created with access permissions that prevent unauthorized file access.

...

In this noncompliant code example, the access permissions of any file created is are implementation-defined and may fail to prevent unauthorized access.

...

Compliant Solution (Java 1.6 and Earlier)

Java 1.6 and earlier provide no lack a mechanism for specifying default permissions upon file creation. Consequently, the problem must be avoided or solved using some mechanism external to Java, such as by using native code and Java Native Interface (JNI).

Compliant Solution (Java

...

SE 7, POSIX)

The Java 1.SE 7 new I/O facility (java.nio) provides classes for managing file access permissions. Additionally, many of the methods and constructors that create files accept an argument allowing the program to specify the initial file permissions.

...

Path file = new File("file").toPath();

// Throw exception rather than overwrite existing file
Set<OpenOption> options = new HashSet<OpenOption>();
options.add(StandardOpenOption.CREATE_NEW);
options.add(StandardOpenOption.APPEND);

// File permissions should be such that only user may read/write file
Set<PosixFilePermission> perms =
    PosixFilePermissions.fromString("rw-------");
FileAttribute<Set<PosixFilePermission>> attr =
    PosixFilePermissions.asFileAttribute(perms);

try (SeekableByteChannel sbc =
    Files.newByteChannel(file, options, attr)) {
  // write data
};

Exceptions

FIO01-EX0: If When a file is created inside a directory that is both secure and unreadable by untrusted users, then that file may be created with the default access permissions. See rule FIO00-J. Do not operate on files in shared directories for the definition of a secure directory. This could be the case if, for example, the entire file system is trusted , or is accessible only to trusted users. See FIO00-J. Do not operate on files in shared directories for the definition of a secure directory.

FIO01-EX1: Files that do not contain sensitive information need not be created with specific access permissions.

Risk Assessment

Files created with insufficiently restrictive access permissions result in information disclosure, especially if the program creating the file populates the sensitive information. The ability to determine if whether an existing file has been opened or a new file has been created provides greater assurance that a file other than only the intended file is not acted upon.

...

Bibliography

...