executable jar security problem (launch.script)

[ivnik]

I created an executable jar with spring boot (spring-boot-maven-plugin, true)
When run as the init.d service (as root), script executes .conf file with root privileges.

[[ -r "${jarfolder}/${configfile}" ]] && source "${jarfolder}/${configfile}"

man bash:

       source filename [arguments]
              Read  and  execute  commands from filename in the current shell environment and return the exit status of the last command executed from filename.  

[wilkinsona]

Given that you control the contents of the .conf file, its ownership and its permissions, why do you consider this to be a security problem? When installing the service, I'd make root the owner of the .conf file and make it read-only.

[ivnik]

Ok. It may be worth writing in the documentation that the conf file owner must file to be root not writable to any user (and folder where jar placed should also can not be writable to any user). Or may be check ownership/acl before execute conf file?

And what about executable jar owned by user? If my java app hacked by somebody, hacker can overwrite my executable jar and obtain root privileges after system restart.

[wilkinsona]

And what about executable jar owned by user? If my java app hacked by somebody, hacker can overwrite my executable jar and obtain root privileges after system restart.

You should lock the file down to prevent it from being changed. For example, you could use chattr +i to make it immutable. Note that using chmod isn't sufficient as the owner of the file, if compromised, could make it writable again. Even if the user is locked down and prevented from using chmod, that user still has to be able to launch the JVM which, via the Java 7 Files API, could change the permissions of the file.

We'll make some updates to the documentation to describe these best practices.

[ivnik]

The conf file must also exists and be write protected via chattr for the same reason. May be check ownership & chattr +i flag before execute conf file?

[wilkinsona]

The conf file must also exists and be write protected via chattr for the same reason

That's not the case. You don't have to use a .conf file. If you do, and you're running the service as root, then it's sufficient for it to be owned by root and to only be readable by root.

May be check ownership & chattr +i flag before execute conf file?

That's too strong an opinion for the launch script to take. You may not be running the app as root, e.g. you might be executing the app directly, rather than via init.d. Furthermore, there are also other ways to secure things other than using chattr that may be more appropriate for a particular user's environment.