openmicroscopy/openmicroscopy — pull request #3171 by sbesson (2014-11-05 14:07:15+00:00)
Title: Pass omero.db.pass via envvar to bin/omero admin reindex (rebased onto dev_5_0)

This is the same as gh-3161 but rebased onto dev_5_0.

----

For security reasons, the DB password is not passed as an xargs to the reindex
command. This commit fixes this issue by internally setting the JAVA_OPTS
environment variable which should only be visible to the process owner (and
root).

See https://www.openmicroscopy.org/community/viewtopic.php?f=5&t=7673&p=14962#p14952

To test this PR:
- set up a server with a user/password
- check `bin/omero admin reindex --reset 0` fails without this PR
- check `bin/omero admin reindex --reset 0` passes with this PR
- check `JAVA_OPTS="-Dlogback.configurationFile=stderr.xml" bin/omero admin reindex --reset 0` passes with this PR
- in both cases above, check the environment variable does not leak for another user than the one doing the reindex (e.g. via `ps auxe`)