Security at writing in a folder

Question

I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder for each user, as well as the input and output files.

In case of C code, the compilation code is the following:

compileCommand = pathToMinGW + "gcc " + pathToFile + fileName + ".c -o " + pathToFile + fileName

And the command for run:

executeCommand = pathToFile + fileName + ".exe"

Running the command:

Runtime runtime = Runtime.getRuntime();
Process run = runtime.exec(executeCommand);

How can I give permissions for the exec() function, to let to modify the output files from the folder where the uploaded code is, but nothing other?

Answer 1

You create an isolated user first (e.g. with no groups on it),and you run another java instance from administrator (via windows service for example), were you push the commands in a queue, and you got a queue of error codes, in e.g. SQL DB.

And in Linux, you can run also Java from root, and make a queue of commands (with files in folder and SQL, and push the commands and receive the results via another queue).

And the Java instance running exe must run from root or administrator, to be able to run another exe with different user, so you dont need to reload java every time. In windows you would need to compile a binary doing this using windows Process, to launch external command via another user. In Linux you can use "su" or "sudo" commands to do it, so you can do:

[root@abcdef ~]# su - test -c "/usr/bin/id"
uid=503(test) gid=503(test) groups=503(test) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

So your java would require access to the SQL with the queue, so this would be the easier way I suppose, I have did this way and I am so far not hacked.

ps. Queue has to be serialized and with timeout for each run.