Pivotal tc Server default UMASK changed to 0027

Products

• VMware Tanzu tc Server

Issue/Introduction

Symptoms:
Any operator or developer planning for tcServer instance implementation or upgrade should be aware of the following: 

• The Apache Software Foundation's Tomcat team has changed the default UMASK to 0027 to tighten up files permissions for additional security in Tomcat 8.5.0. 

Environment

Cause

The changelog here lists the following:

Tighten up the default file permissions for the .tar.gz distribution so no files or directories are world readable by default. Configure Tomcat to run with a default umask of 0027 which may be overridden by setting UMASK in setenv.sh. (markt)

In “catalina.sh” file, the following sets the umask to 0027:

# Set UMASK unless it has been overridden
if [ -z "$UMASK" ]; then
    UMASK="0027"
fi
umask $UMASK

Resolution

To resolve this issue, follow the below instructions:

1. Edit the file bin/setenv.sh under your tc Server instance's directory. If this file does not exist, create it.

2. Add the line, export UMASK=XXXX, where XXXX is the umask that you would like applied.

3. Save the file and restart your tc Server instance.