Return-Path: Delivered-To: apmail-jakarta-tomcat-dev-archive@apache.org Received: (qmail 83197 invoked from network); 24 Oct 2002 09:02:57 -0000 Received: from unknown (HELO nagoya.betaversion.org) (192.18.49.131) by daedalus.apache.org with SMTP; 24 Oct 2002 09:02:57 -0000 Received: (qmail 20202 invoked by uid 97); 24 Oct 2002 09:03:50 -0000 Delivered-To: qmlist-jakarta-archive-tomcat-dev@jakarta.apache.org Received: (qmail 20186 invoked by uid 97); 24 Oct 2002 09:03:49 -0000 Mailing-List: contact tomcat-dev-help@jakarta.apache.org; run by ezmlm Precedence: bulk List-Unsubscribe: List-Subscribe: List-Help: List-Post: List-Id: "Tomcat Developers List" Reply-To: "Tomcat Developers List" Delivered-To: mailing list tomcat-dev@jakarta.apache.org Received: (qmail 20174 invoked by uid 98); 24 Oct 2002 09:03:49 -0000 X-Antivirus: nagoya (v4218 created Aug 14 2002) Message-ID: <3DB7B72A.9040304@mail.more.net> Date: Thu, 24 Oct 2002 04:02:34 -0500 From: Glenn Nielsen Organization: MOREnet User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.0.0) Gecko/20020909 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Tomcat Developers List Subject: Re: Security Check in Classloader. References: <3DB6F5F8.40802@apache.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N Jean-Francois Arcand wrote: > Hi, > > In StandardClassLoader, starting line 815, the SecurityManager is invoked: > > // (.5) Permission to access this class when using a SecurityManager > if (securityManager != null) { > int i = name.lastIndexOf('.'); > if (i >= 0) { > try { > securityManager.checkPackageAccess(name.substring(0,i)); > } catch (SecurityException se) { > String error = "Security Violation, attempt to use " + > "Restricted Class: " + name; > System.out.println(error); > se.printStackTrace(); > log(error); > throw new ClassNotFoundException(error); > } > } > } > > Why are we calling the SecurityManager.checkPackageAccess in > StandardClassLoader? Since we give all permissions to > org.apache.catalina, I think this call is useless. This call is required > when invoked inside WebappClassLoader. > Because a paranoid Tomcat admin like me may not grant AllPermission to catalina in their security policy. Regards, Glenn -- To unsubscribe, e-mail: For additional commands, e-mail: