0

I'm having trouble understanding/ignorant to an error I'm facing regarding the security manager and a file created solely by the running application so wondering if people can provide some insight. This started happening after I started using the newest version of the S3 Transfer Manager and this code runs in ECS Fargate.

Background on rough Dataflow

  1. Path to new file = /my/destination/myfile
  2. Create File using same path like new File("/my/destination/myfile") and createNewFile()
  3. Insert stuff into file
  4. Upload file to S3 using S3TransferManager via:
final UploadFileRequest uploadFileRequest = UploadFileRequest.builder()
    .putObjectRequest(putObjectRequest -> putObjectRequest.bucket(s3Bucket).key(s3Key))
    .source(Paths.get("/my/destination/myfile"))
    .build();

final FileUpload upload = transferManager.uploadFile(uploadFileRequest);

Error

Exception in thread "Thread-17" java.security.AccessControlException: access denied ("java.io.FilePermission" "/my/destination/myfile" "read")
    at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
    at java.base/java.security.AccessController.checkPermission(AccessController.java:897)
    at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:322)
    at java.base/java.lang.SecurityManager.checkRead(SecurityManager.java:661)
    at java.base/sun.nio.fs.UnixPath.checkRead(UnixPath.java:818)
    at java.base/sun.nio.fs.UnixFileAttributeViews$Basic.readAttributes(UnixFileAttributeViews.java:49)
    at java.base/sun.nio.fs.UnixFileSystemProvider.readAttributes(UnixFileSystemProvider.java:149)
    at java.base/sun.nio.fs.LinuxFileSystemProvider.readAttributes(LinuxFileSystemProvider.java:99)
    at java.base/java.nio.file.Files.readAttributes(Files.java:1764)
    at java.base/java.nio.file.Files.size(Files.java:2381)
    at software.amazon.awssdk.core.internal.async.FileAsyncRequestBody$FileSubscription.signalOnComplete(FileAsyncRequestBody.java:322)
    at software.amazon.awssdk.core.internal.async.FileAsyncRequestBody$FileSubscription.access$900(FileAsyncRequestBody.java:178)
    at software.amazon.awssdk.core.internal.async.FileAsyncRequestBody$FileSubscription$1.completed(FileAsyncRequestBody.java:274)
    at software.amazon.awssdk.core.internal.async.FileAsyncRequestBody$FileSubscription$1.completed(FileAsyncRequestBody.java:259)
    at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:127)
    at java.base/sun.nio.ch.SimpleAsynchronousFileChannelImpl$2.run(SimpleAsynchronousFileChannelImpl.java:335)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:829)
    at java.base/jdk.internal.misc.InnocuousThread.run(InnocuousThread.java:161)
    at my.package.S3ServiceClient.uploadToS3(S3ServiceClient.java:35)

Things I've tried

  1. Since it's a read related issue, I thought of just setting the file so that it's readable - file.setReadable(Boolean.TRUE, Boolean.FALSE); . The False flag is for the ownerOnly option. I verified this by checking that file.canRead() is True
  2. Verified that the path to the file and the one submitted to the S3 upload is the same
  3. Created a java.policy file like in similar posts with the explicit permission of grant { permission java.io.FilePermission "/my/destination/-", "read"; }; with -Djava.security.policy=$ENVROOT/security/java.policy
  4. I've checked other code bases using the S3TransferManager and none have had to touch their files/permissions that I can see outside of creating them
  5. I've tried looking around for similar issues on SO, but unfortunately there doesn't seem to be any that are closely related, or maybe it's an easy fix, but I'm unable to wrap my head around it
  6. Adding new findings since post - I've enabled -Djava.security.debug=access,failure and from there I have some new insights. When I call canRead() myself, I get access: access allowed ("java.io.FilePermission" "/my/destination/myfile" "read"). However, whenever the security manager/access control context calls it, it gets access: access denied ("java.io.FilePermission" "/my/destination/myfile" "read") instead. Furthermore, I'm seeing another line that says access: domain that failed ProtectionDomain null.

Questions

  1. Why is it that file.canRead() returns True , but the SecurityManager gives me a read exception?
  2. How do I allow it so that the SecurityManager is able to read the file?
user3842274
  • 21
  • 6

0 Answers0