Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of knst.kolinko@gmail.com
 designates 209.85.214.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <COL401-EAS21498427286309F264CB795F5A40@phx.gbl>
References: <COL401-EAS21498427286309F264CB795F5A40@phx.gbl>
Date: Thu, 9 May 2013 16:06:16 +0400
Message-ID: 
 <CABzHfVmnsmynj=oydG70yoDXXbFXw+NR_NxE3aaoQMCWJoJdZQ@mail.gmail.com>
Subject: Re: Catalina.policy java.security.AllPermission
From: Konstantin Kolinko <knst.kolinko@gmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: text/plain; charset=ISO-8859-1

2013/5/9 Alejandro Garcia <alexander001_2@msn.com>:
> Thanks!
>
> It is because I am run my app in a Web Hosting that runs with SM enable.
>

(...)

SM can protect you from running webapps that you do not know or do not
trust. It cannot protect a web hoster from you (or from someone else
who uses a password that was stolen from you). It cannot be the only
line of defense.

If they run with SM, but allow you to edit conf/catalina.policy file,
then this is just a "feature" they provide and it is up to you to use
it or not.  If you want to use it, you need some knowledge. If you do
not, assign AllPermission to the whole codebase and be done with it.

> grant codeBase "file:${catalina.home}/
webapps/WebRed/-" {

Web applications are in ${catalina.base}, not ${catalina.home},
unless both are the same.

> permission java.io.FilePermission "${catalina.home}/webapps/
WebRed", "read,write";
> permission java.io.FilePermission "${catalina.home}/webapps/WebRed/-", "read,write,delete";

Your webapp updates its own files at runtime?
It should not. (Thus you do not need "write" or "delete" permissions here).

> permission java.util.PropertyPermission "org.apache.catalina.manager.
util", "read";
> permission java.util.PropertyPermission "org.apache.catalina.manager", "read";
> permission java.util.PropertyPermission "org.apache.catalina", "read";
> permission java.util.PropertyPermission "org.apache.catalina.core", "read";

Why? There are no such system properties.

> permission java.lang.RuntimePermission "accessClassInPackage.org.
apache.catalina";
> permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
> permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
> permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.core";

Why? Do you need reflective access to Tomcat internal classes?
(And if you give such permissions, you can as well assign
AllPermissions to that code, as these permissions alone could be
abused).

> permission java.lang.RuntimePermission "accessClassInPackage.org.
springframework.web.context";
> permission java.lang.RuntimePermission "accessClassInPackage.org.springframework.web.context.request";
> permission java.lang.RuntimePermission "accessClassInPackage.org.springframework.web.filter";
> permission java.lang.RuntimePermission "accessClassInPackage.org.
icefaces.util";


Why? Access to these packages is not restricted by Tomcat. (They are
not in "package.access" property in conf/catalina.properties).

The way to debug security permission issues is described here:
http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html#Troubleshooting

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org