Resolving Security Compliance Findings for World-Writable Permissions on DevTest JRE Directories

Products

• Service Virtualization

Issue/Introduction

Security penetration tests or automated vulnerability scans (such as Nessus/Tenable) may flag the bundled JRE/bin directory in DevTest installations as "world-writable." This is often identified as a security compliance risk, as files writable by "others" could potentially be modified by unauthorized users on the system.

Environment

• Product: DevTest (all versions)
• OS: Linux/Unix-based environments

Resolution

It is supported and safe to remove "world-writable" (other) write permissions from the bundled JRE/bin directory. This remediation will not impact DevTest functionality (including Registry, VSE, virtual service deployment/execution, or Workstation startup), provided that the service user account retains proper Read and Execute permissions.

Remediation Steps

1. Stop Services: Stop all DevTest services to ensure no files are in use during the permission change. This includes:
   • Enterprise Dashboard
   • Registry
   • Portal
   • VSE
   • Broker
2. Locate Directory: Navigate to the DevTest installation directory (e.g., LISA_HOME/jre/bin).
3. Restrict Permissions: Remove write permissions for "others" by executing the following command:
   bash

    

   chmod o-w *

   (Note: Ensure this is applied to both the files and the directory itself if flagged.)
4. Verify Ownership: Confirm that the user account responsible for running DevTest services retains "Read" and "Execute" permissions. Standard practice is to set permissions to 755 or 775.
5. Restart Services: Restart all DevTest services.
6. Validation: Verify that the Registry and VSE components start successfully and that the Workstation launches without error.