Design Issue: Including Directories Outside of WLP Root

[rsherget]

Background

Users can use the <include> tag to include extra configuration files to the server. They can do this by adding individual files or by adding an entire directory that will add all the config files within that directory.

Problem

We currently do not add any configuration files through directories that are outside of the wlp directory or whatever directory is specified by java.io.tmpdir which by default is just the /tmp directory. However, users can specify individual config files outside of the /wlp and /tmp directories.

Questions

• Do we not go through files within a directory outside of /wlp or /tmp for security reasons?

Proposed Solution

1. Make it so that config files within directories can be specified even if the directory is outside the /wlp or /tmp directories.
2. Add to docs to explain the difference in behavior between including config files by specifying directories versus specifying individual config files.

[rsherget]

The file resource, where the function getChildren() is: https://github.com/OpenLiberty/open-liberty/blob/integration/dev/com.ibm.ws.kernel.service/src/com/ibm/ws/kernel/service/location/internal/LocalFileResource.java

Where the root resources are that determine whether we can access the directory's children files: https://github.com/OpenLiberty/open-liberty/blob/integration/dev/com.ibm.ws.kernel.service/src/com/ibm/ws/kernel/service/location/internal/WsLocationAdminImpl.java

[cbridgha]

Ricky for next year, I think we were going to ask a couple other people on some history here, also look at our "packaging" behavior and see if also filters, or doesn't allow these directories?