The shared class cache is designed for ease of cache management and usability, but the default security policy might not be appropriate.
When using the shared class cache, you must be aware of the default permissions for new files so that you can improve security by restricting access.
File | Default permissions |
---|---|
new shared caches | read permissions for group and other |
javasharedresources directory | world read, write, and execute permission |
You require write permission on both the cache file and the cache directory to destroy or grow a cache.
To limit access to a shared class cache, you can use the chmod command.
Change required | Command |
---|---|
Limit access to the user and group | chmod 770 /tmp/javasharedresources |
Limit access to the user | chmod 700 /tmp/javasharedresources |
Limit the user to read and write access only for a particular cache | chmod 600 /tmp/javasharedresources/<file for shared cache> |
Limit the user and group to read and write access only for a particular cache | chmod 660 /tmp/javasharedresources/<file for shared cache> |
JVMSHRC226E Error opening shared class cache file JVMSHRC220E Port layer error code = -302 JVMSHRC221E Platform error message: Permission denied JVMJ9VM015W Initialization error for library j9shr25(11): JVMJ9VM009E J9VMDllMain failed Could not create the Java virtual machine.