tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Alan <alanwil...@gmail.com>
Subject webapps examples and security manager
Date Tue, 22 Sep 2009 16:22:18 GMT
Hi there,

I installed tomcat5 via Fink on Snow Leopard 10.6.1 kernel 64 bits:

amadeus[2249]:/sw/var/log/tomcat5% $CATALINA_HOME/bin/catalina.sh version
Using CATALINA_BASE:   /sw/var/tomcat5
Using CATALINA_HOME:   /sw/var/tomcat5
Using CATALINA_TMPDIR: /sw/var/tomcat5/temp
Using JRE_HOME:       /Library/Java/Home
Server version: Apache Tomcat/5.5.26
Server built:   Jan 28 2008 01:35:23
Server number:  5.5.26.0
OS Name:        Mac OS X
OS Version:     10.6.1
Architecture:   x86_64
JVM Version:    1.6.0_15-b03-219
JVM Vendor:     Apple Inc.

Tomcat's webapps examples works fine, but then I wanted to use security manager.

I put that:

export CATALINA_OPTS="-DTOMCAT5LAUNCH=true -Djava.security.manager
-Djava.security.policy=$CATALINA_HOME/conf/catalina.policy"

then it still works but I don't like what I see in log catalina.out:

2009-09-22 16:34:41.010 java[24510:1603] CFPreferences: user home
directory at file://localhost/sw/var/empty/ is unavailable. User
domains will be volatile.
Could not load Logmanager "org.apache.juli.ClassLoaderLogManager"
java.security.AccessControlException: access denied
(java.lang.RuntimePermission setContextClassLoader)
	at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
	at java.security.AccessController.checkPermission(AccessController.java:546)
[snip]
	at org.apache.catalina.startup.Bootstrap.<clinit>(Bootstrap.java:54)
Can't load log handler "1catalina.org.apache.juli.FileHandler"
java.lang.ClassNotFoundException: 1catalina.org.apache.juli.FileHandler
java.lang.ClassNotFoundException: 1catalina.org.apache.juli.FileHandler
	at java.net.URLClassLoader$1.run(URLClassLoader.java:200)
[snip]

My catalina.policy is this (didn't touch it yet):

// These permissions apply to javac
grant codeBase "file:${java.home}/lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions
grant codeBase "file:${java.home}/jre/lib/ext/-" {
        permission java.security.AllPermission;
};

// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/../lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions when
// ${java.home} points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/lib/ext/-" {
        permission java.security.AllPermission;
};


// ========== CATALINA CODE PERMISSIONS =======================================


// These permissions apply to the launcher code
grant codeBase "file:${catalina.home}/bin/commons-launcher.jar" {
        permission java.security.AllPermission;
};

// These permissions apply to the daemon code
grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
        permission java.security.AllPermission;
};

// These permissions apply to the commons-logging API
grant codeBase "file:${catalina.home}/bin/commons-logging-api.jar" {
        permission java.security.AllPermission;
};

// These permissions apply to the server startup code
grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
        permission java.security.AllPermission;
};

// These permissions apply to the JMX server
grant codeBase "file:${catalina.home}/bin/jmx.jar" {
        permission java.security.AllPermission;
};

// These permissions apply to JULI
grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
        permission java.util.PropertyPermission
"java.util.logging.config.class", "read";
        permission java.util.PropertyPermission
"java.util.logging.config.file", "read";
        permission java.lang.RuntimePermission "shutdownHooks";
        permission java.io.FilePermission
"${catalina.base}${file.separator}conf${file.separator}logging.properties",
"read";
        permission java.util.PropertyPermission "catalina.base", "read";
        permission java.util.logging.LoggingPermission "control";
        permission java.io.FilePermission
"${catalina.base}${file.separator}logs", "read, write";
        permission java.io.FilePermission
"${catalina.base}${file.separator}logs${file.separator}*", "read,
write";
        permission java.lang.RuntimePermission "getClassLoader";
        // To enable per context logging configuration, permit read
access to the appropriate file.
        // Be sure that the logging configuration is secure before
enabling such access
        // eg for the examples web application:
        // permission java.io.FilePermission
"${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties",
"read";
};

// These permissions apply to the servlet API classes
// and those that are shared across all class loaders
// located in the "common" directory
grant codeBase "file:${catalina.home}/common/-" {
        permission java.security.AllPermission;
};

// These permissions apply to the container's core code, plus any additional
// libraries installed in the "server" directory
grant codeBase "file:${catalina.home}/server/-" {
        permission java.security.AllPermission;
};

// The permissions granted to the balancer WEB-INF/classes and
WEB-INF/lib directory
grant codeBase "file:${catalina.home}/webapps/balancer/-" {
        permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.tomcat.util.digester";
        permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.tomcat.util.digester.*";
};
// ========== WEB APPLICATION PERMISSIONS =====================================


// These permissions are granted by default to all web applications
// In addition, a web application will be given a read FilePermission
// and JndiPermission for all files and directories in its document root.
grant {
    // Required for JNDI lookup of named JDBC DataSource's and
    // javamail named MimePart DataSource used to send mail
    permission java.util.PropertyPermission "java.home", "read";
    permission java.util.PropertyPermission "java.naming.*", "read";
    permission java.util.PropertyPermission "javax.sql.*", "read";

    // OS Specific properties to allow read access
    permission java.util.PropertyPermission "os.name", "read";
    permission java.util.PropertyPermission "os.version", "read";
    permission java.util.PropertyPermission "os.arch", "read";
    permission java.util.PropertyPermission "file.separator", "read";
    permission java.util.PropertyPermission "path.separator", "read";
    permission java.util.PropertyPermission "line.separator", "read";

    // JVM properties to allow read access
    permission java.util.PropertyPermission "java.version", "read";
    permission java.util.PropertyPermission "java.vendor", "read";
    permission java.util.PropertyPermission "java.vendor.url", "read";
    permission java.util.PropertyPermission "java.class.version", "read";
    permission java.util.PropertyPermission
"java.specification.version", "read";
    permission java.util.PropertyPermission "java.specification.vendor", "read";
    permission java.util.PropertyPermission "java.specification.name", "read";

    permission java.util.PropertyPermission
"java.vm.specification.version", "read";
    permission java.util.PropertyPermission
"java.vm.specification.vendor", "read";
    permission java.util.PropertyPermission
"java.vm.specification.name", "read";
    permission java.util.PropertyPermission "java.vm.version", "read";
    permission java.util.PropertyPermission "java.vm.vendor", "read";
    permission java.util.PropertyPermission "java.vm.name", "read";

    // Required for OpenJMX
    permission java.lang.RuntimePermission "getAttribute";

    // Allow read of JAXP compliant XML parser debug
    permission java.util.PropertyPermission "jaxp.debug", "read";

    // Precompiled JSPs need access to this package.
    permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.jasper.runtime";
    permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.jasper.runtime.*";

    // Precompiled JSPs need access to this system property.
    permission java.util.PropertyPermission
"org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
};

Any help would be more than appreciated.

Many thanks in advance,

Alan

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Mime
View raw message