Berkeley DB Reference Guide: Environment
Description: Berkeley DB: An embedded database programmatic toolkit.
Keywords: embedded,database,programmatic,toolkit,b+tree,btree,hash,hashing,transaction,transactions,locking,logging,access method,access methods,java,C,C++

### Berkeley DB Reference Guide: Environment |

# Security

There are two important security concerns when writing Berkeley DB applications:

1. The first concern is the directory used as the database home environment. It is important that the environment home directory be carefully created to have the correct permissions for the system to ensure that databases are not accessible to users without the correct permissions.

2. The second concern is the use of environment variables in file naming, e.g., DB_USE_ENVIRON and DB_USE_ENVIRON_ROOT. If a Berkeley DB application is running with additional permissions, (e.g., UNIX setuid or setgid permissions), and either of these variables is set, users could potentially cause the application to read and write databases to which the user would not normally have access.

   By default, Berkeley DB always creates files readable and writeable by the owner and the group (i.e., S_IRUSR, S_IWUSR, S_IRGRP and S_IWGRP, or octal mode 0660 on historic UNIX systems). The group ownership of created files is based on the system and directory defaults, and is not further specified by Berkeley DB.

   Finally, if an unnamed database is created and the cache is too small to hold the database in memory, Berkeley DB will create a temporary physical file to enable it to page the database to disk as needed. In this case, environment variables such as TMPDIR may be used to specify the location of that temporary file. While temporary backing files are created readable and writeable by the owner only (i.e., S_IRUSR and S_IWUSR, or octal mode 0600 on historic UNIX systems), some filesystems may not sufficiently protect temporary files created in random directories from improper access. Applications storing sensitive data in unnamed databases should probably specify the DB_TMP_DIR configuration value to be absolutely safe.

Copyright Sleepycat Software