Foglight for Java EE Technologies 5.9.13 - Installation Guide

Managing permissions on remote filesystems

Before creating and activating an instance of the Java EE Integration Agent on a remote host, the user running the Agent Manager process must have permission to create the Installation directory (DEPLOYMENT_DIRECTORY).

Before submitting an integration task to a Java EE Integration Agent, the Java EE Integration Agent must be granted permission to make the necessary changes to application server files and to create backup copies of the files being changed. The following permissions must be granted to the user running the Agent Manager process (for the application server being integrated):

If the Agent Manager and Application Server processes use the same user, the "g" and "o" permissions can be omitted.

If the Agent Manager user is in the same group as the Application Server files being modified, the "u" and "o" can be omitted.

If the Agent Manager is not the same as the Application Server user, or in the same group, then the "o" must be included.

Windows Services permissions

For integration of Windows Services, the Agent Manager user requires permission to run the regedit.exe executable in export or import modes on one or more registry keys, under the HKEY_LOCAL_MACHINE hive.

Permissions required by the application server user

The Java EE Integration Agent automatically grants permissions on the files and directories within the DEPLOYMENT_DIRECTORY to be readable by any other user on the remote filesystem. By default, only users in the same group as the Agent Manager (and the Agent Manager user itself) can create files within the DEPLOYMENT_DIRECTORY.

If the Application Server user is the same as the Agent Manager user, or belongs to the group owning the Agent Manager files, these category permissions do not need to be changed.

Otherwise, the permissions for Dynamic Directories should be changed to rwx for the For Other (default r-x) setting.

The Java EE Integration Agent manages file permissions using a set of six categories to apply particular permissions to particular types of files. Review the categories and the files they represent in the following table.

Each category provides a set of permissions for the file or directory owner, group, and everyone else. Also provided are the abilities to set the setuid, setgid and sticky bits.

The setuid bit can be set on script files to have the launched process take on the user ID of the script file itself. This ability is not needed in stock integrations.

The setgid bit can be set on script files and directories. When set on script files, the effect is similar to the setuid bit, except the launched process takes on the group ID of the script file, instead of the user ID. When set on a directory, the setgid bit results in files created in that directory having the same group ownership as the directory itself, rather than the group of the user who creates the file. By default, the setgid bit is set on Dynamic Directories, so that the Java EE Integration Agent can maintain these directories regardless of which user creates files within them.

The sticky bit can be used on directories with other write permission to prevent a user from deleting another user’s file.

With the lone exception noted above, these file permissions should not need to be changed during stock integrations. The options exist to aid integrations where extraordinary circumstances require them.