Extract the native library with owner-only permissions

src/main/java/org/xerial/snappy/SnappyLoader.java

@@ -28,6 +28,9 @@
 import java.net.JarURLConnection;
 import java.net.URL;
 import java.net.URLConnection;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.util.Enumeration;
 import java.util.Properties;
 import java.util.UUID;
@@ -239,6 +242,13 @@ private static File extractLibraryFile(String libFolderForCurrentOS, String libr
             try {
                 reader = getResourceAsInputStream(nativeLibraryFilePath);
                 try {
+                    // Create the file accessible only by the owner, since the temp folder is usually shared with
+                    // other users and the default umask may leave the library writable by them
+                    Path extractedLibPath = extractedLibFile.toPath();
+                    if (extractedLibPath.getFileSystem().supportedFileAttributeViews().contains("posix")) {
+                        Files.createFile(extractedLibPath,
+                                PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rwx------")));
+                    }
                     writer = new FileOutputStream(extractedLibFile);
 
                     byte[] buffer = new byte[8192];

src/test/java/org/xerial/snappy/SnappyLoaderTest.java

@@ -26,15 +26,20 @@
 
 import org.codehaus.plexus.classworlds.ClassWorld;
 import org.codehaus.plexus.classworlds.realm.ClassRealm;
+import org.junit.Assume;
 import org.junit.Test;
 import java.util.logging.Logger;
 
 import java.io.*;
 import java.lang.reflect.Method;
 import java.net.URL;
 import java.net.URLClassLoader;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermissions;
 
 import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
 
 public class SnappyLoaderTest
@@ -120,6 +125,21 @@ public void load()
         _logger.fine(String.valueOf(Snappy.maxCompressedLength(1024)));
     }
 
+    @Test
+    public void extractedLibraryIsOnlyAccessibleByOwner()
+            throws Exception
+    {
+        File lib = SnappyLoader.findNativeLibrary();
+        try {
+            Path libPath = lib.toPath();
+            Assume.assumeTrue(libPath.getFileSystem().supportedFileAttributeViews().contains("posix"));
+            assertEquals("rwx------", PosixFilePermissions.toString(Files.getPosixFilePermissions(libPath)));
+        }
+        finally {
+            lib.delete();
+        }
+    }
+
     @Test
     public void autoLoad()
             throws Exception