can't create directory error needs more information

Description

Several users are reporting start up errors on windows.

There error is coming from here, this error message doesn't explain why it can't create the directory, every other create directory exception in Lucee includes a reason (So I'm assuming this is the cause)

https://github.com/lucee/Lucee/blob/5.3/core/src/main/java/lucee/commons/io/res/type/file/FileResource.java#L331

Environment

Windows

Activity

Show:
Andreas R
May 23, 2020, 12:15 PM
Edited

This happens when Tomcat tries to access a physical webroot path with no write permissions. “users are reporting start up errors on windows” because when installed by the installer, tomcat runs it with the lower priviliged “local service” account. But lucees installer doesn’t change/add file permissions automatically to IIS webroot folders, so users/admins have to add these permissions manually. When that happens, tomcat returns an empty default 500 Error page, while over IIS the page shows a part of the stack trace. Running the Lucee service as SYSTEM is obviously not a secure option.

Jordan openend an issue on his installer repository already. However, I don’t know if the installer is the one who should do this handling, because:

  1. There are users who have and like the web-inf folder outside of the webroot

  2. There are users using IIS sites WITHOUT tomcat (some may have ASP only, or PHP only or whatever)

  3. There are IIS configurations with over dozens and dozens of SITES. An automatic approach may cause unwanted changes to sites that tomcat shouldn’t have write permissions (security concern)

  4. For security reasons it is better for every admin to know where he is granting write access to. I always prefere the manual way on this. But this may be more a personal opinion.

In my opinion this should be handeled by Lucee itself , not the installer. The installer could do it as an OPTION only, example with a checkbox to “add file permissions for Lucee to all IIS Sites” (but I still don’t know if this is even possible by the installer and it might not be trivial). Why I think that it should be done that way: It can happen in other servlet containers too, even with tomcat as stand alone. In my opinion it would be nice to show an detailed crafted exception (message), with even no detailed stack trace, telling something like “Lucee needs write access to create the WEB-INF folder for this site. It’s probably that this Lucee istance is running with a secure/safe user account that has no write permissions to do so. To correct this, please add write permissions for that account manually to its webroot or web-context location”. Some ideas?


Zac Spitzer
May 23, 2020, 1:35 PM

Two things, if Lucee can't access the folder, it can't change the permissions and only the installer runs with enough permissions to do this.

Another user reports the same problem under the default Lucee ROOT webapp (i.e port 8888) directory, which unlike inetpub should be unaffected by permissions problems?

Andreas R
May 24, 2020, 9:23 PM
Edited

Zac, I had an idea: I’ve made an ultra quick test on this, have to test it further though, but:
If the web-contexts gets outside the webroot folders, specifying in CFMLservlet of web.xml like this here:


then tomcat service would create the folder inside the installation folder (just like it does with the lucee-server directory) without any permission issues and every single web-context that is specified via cfml_mod or what ever, would have no problem at all. This is just a little change and Jordan wouldn’t need to do anything, but change the web.xml within the installer.

AND this would enhance security. I thought you’ve added this “moving web-inf folder outside webroot” as a LDEV here somewhere, but can’t find it .

Of course, I don’t know if this would cause further impact. Just leaving this thought over here.

Zac Spitzer
May 25, 2020, 8:28 AM

this is the wrong task for this topic, this task is just about improving a specific error message, not WEB-INF problem, see the linked task

I doubt that moving the context dirs out of the webroots will help as a different user was getting the same error in C:\lucee\tomcat\webapps\ROOT

Assignee

Unassigned

Reporter

Zac Spitzer

Priority

New

Labels

Fix versions

None

Affects versions

Configure