Tomcat 5.5 startup script fail if temp directory contains subdirectories

Bug #161882 reported by Fabio Da Soghe
6
Affects Status Importance Assigned to Milestone
tomcat5.5 (Debian)
Fix Released
Unknown
tomcat5.5 (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

In Ubuntu Gutsy 7.10, tomcat 5.5 has a little bug in the startup script (/etc/init.d/tomcat5.5) that prevents Tomcat from starting again when a web application has created a subdirectory in the temp directory (located at /var/lib/tomcat5.5/temp).

To me this happens because a Java library I use (Geotools) does exactly that. The first start goes well, and it creates the directory /var/lib/tomcat5.5/temp/Geotools/Databases/HSQL.

The second start fail. This is the error I get on the console:

 * Starting Tomcat servlet engine tomcat5.5
rm: cannot remove `/var/lib/tomcat5.5/temp/Geotools': Is a directory
rm: cannot remove `/var/lib/tomcat5.5/temp/Geotools/Databases': Is a directory
rm: cannot remove `/var/lib/tomcat5.5/temp/Geotools/Databases/HSQL': Is a directory

I have to delete manually the directory /var/lib/tomcat5.5/temp/Geotools in order to let Tomcat start again.

Fabio Da Soghe

Revision history for this message
Fabio Da Soghe (fabio-dasoghe) wrote :

I did a little patch (attached as diff file to be applied to /etc/init.d/tomcat5.5).
Basically, it seems the command that has to clean up the temp directory didn't take into consideration the presence of subdirectories. I added the -r option to the rm command :-)

Could it be possible to have this patch applied to the official repository package? Thanks in advance!

Cheers,

Fabio

Revision history for this message
Matti Lindell (mlind) wrote :

This is fixed in Debian unstable.

Changed in tomcat5.5:
status: Unknown → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package tomcat5.5 - 5.5.25-5ubuntu1

---------------
tomcat5.5 (5.5.25-5ubuntu1) hardy; urgency=low

  * Merge from Debian unstable (LP: #153672, LP: #159661, LP: #161882,
    LP: #173692, LP: #179491), remaining changes:
    - debian/control: Change the Maintainer address.
    - debian/rules: Force flag passed to rm to `prune files that should not be
      installed at all'.

tomcat5.5 (5.5.25-5) unstable; urgency=low

  * debian/tomcat5.5.init: Check if tomcat-users.xml exists.
    Thanks to Javier Serrano Polo for the patch. Closes: #445857.
  * debian/tomcat5.5-webapps.postrm: Purge links created in postinst script.
    Closes: #453879.
  * debian/tomcat5.5-admin.links: Fix symlink for commons-io.jar.
    Closes: #452366.
  * debian/tomcat5.5.init: Check user id of the user running the init script.
    Closes: #457956.
  * Renamed /etc/cron.daily/tomcat5.5 to /etc/cron.daily/tomcat55.
    Closes: #454296.
  * debian/tomcat5.5.init: source /etc/default/locale and export LANG so
    tomcat gets started with system locale. Originally reported to
    https://bugs.launchpad.net/ubuntu/+source/tomcat5.5/+bug/153672.

tomcat5.5 (5.5.25-4) unstable; urgency=high

  * CVE-2007-5342: Fix unauthorized modification of data because of
    too open permissions. Closes: #458237.
  * Always clean temporary directory on startup. Closes: #456608.

tomcat5.5 (5.5.25-3) unstable; urgency=low

  * debian/libtomcat5.5-java.links: Removed links for xml-apis.jar and
    xercesImpl.jar. Closes: #443382, #455495.
  * Added libgnumail-java to Build-Depends. Closes: #454312.
  * Updated Standards-Version to 3.7.3.

tomcat5.5 (5.5.25-2) unstable; urgency=high

  [ Michael Koch ]
  CVE-2007-5461:
  * Fix absolute path traversal vulnerability. Closes: #448664.

  [ Marcus Better ]
  * Add required commons-io symlink to the admin webapp, which fixes WAR
    file uploads. (Closes: #452366)
  * debian/control: Use the new Homepage and Vcs-* fields.
  * debian/NEWS: Remove outdated entry.

 -- Matti Lindell <email address hidden> Thu, 03 Jan 2008 20:30:59 +0200

Changed in tomcat5.5:
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.