Race between file reader and writer in FileSessionCredentialsProvider
- Dominant language
- Java
- Stars
- 14.1k
- Forks
- 3.8k
- Avg merge
- 2d 31m
- Merged PRs (30d)
- 209
Description
A race is possible between the file updater and the Druid process reading the file. It could be enforced only with mandatory file locking, but file locking is advisory by default in Linux.
If Druid targets only Linux (is it?) probably some Linux-specific code could be added to configure mandatory file locking for `sessionCredentialsFile`.
Contributor guide
Research direction
Start with FileSessionCredentialsProvider and trace how the sessionCredentialsFile is updated and read. Determine whether Druid supports Linux-only file-locking behavior, then define completion as preventing readers from observing a partially updated credentials file and covering the race with an appropriate test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, linux
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100