From da680b19dc2e2cea629bfab8b3480edba00151c9 Mon Sep 17 00:00:00 2001 From: kkolinko Date: Wed, 18 Nov 2009 03:09:12 +0000 Subject: [PATCH] Updated to match the latest catalina.policy file Updated the section about implicit permissions git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@881655 13f79535-47bb-0310-9956-ffa450edef68 --- webapps/docs/security-manager-howto.xml | 99 ++++++++++++++++++++++++--------- 1 file changed, 72 insertions(+), 27 deletions(-) diff --git a/webapps/docs/security-manager-howto.xml b/webapps/docs/security-manager-howto.xml index 0701f6b18..1589227af 100644 --- a/webapps/docs/security-manager-howto.xml +++ b/webapps/docs/security-manager-howto.xml @@ -121,12 +121,19 @@ permission org.apache.naming.JndiPermission "jndi://localhost/examples/*"; but disallow it from using file access to read any other files (unless permissions for those files are explicitly granted).

-

Also, Tomcat always dynamically creates the following file permission:

- +

Also, Tomcat always dynamically creates the following file permissions:

+ permission java.io.FilePermission "** your application context**", "read"; - -

Where **your application context** equals the folder(or WAR file) under which - your application has been deployed.

+ +permission java.io.FilePermission + "** application working directory**", "read,write"; +permission java.io.FilePermission + "** application working directory**/-", "read,write,delete"; + +

Where **your application context** equals the folder (or WAR file) under which + your application has been deployed and **application working directory** is the + temporary directory provided to your application as required by the + Servlet Specification.

@@ -171,14 +178,15 @@ grant [signedBy <signer>,] [codeBase <code source>] { looks like this:

// ============================================================================ -// catalina.corepolicy - Security Policy Permissions for Tomcat 6 +// catalina.policy - Security Policy Permissions for Tomcat 7 // // This file contains a default set of security policies to be enforced (by the // JVM) when Catalina is executed with the "-security" option. In addition // to the permissions granted here, the following additional permissions are -// granted to the codebase specific to each web application: +// granted specific to each web application: // -// * Read access to the document root directory +// * Read access to its document root directory +// * Read, write and delete access to its working directory // // ============================================================================ @@ -217,8 +225,32 @@ grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { }; // These permissions apply to the logging API +// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home}, +// update this section accordingly. grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { - permission java.security.AllPermission; + permission java.util.PropertyPermission "java.util.logging.config.class", "read"; + permission java.util.PropertyPermission "java.util.logging.config.file", "read"; + permission java.util.PropertyPermission "catalina.base", "read"; + permission java.io.FilePermission + "${java.home}${file.separator}lib${file.separator}logging.properties", "read"; + permission java.io.FilePermission + "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read"; + permission java.io.FilePermission + "${catalina.base}${file.separator}logs", "read, write"; + permission java.io.FilePermission + "${catalina.base}${file.separator}logs${file.separator}*", "read, write"; + permission java.lang.RuntimePermission "shutdownHooks"; + permission java.lang.RuntimePermission "getClassLoader"; + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.util.logging.LoggingPermission "control"; + + // To enable per context logging configuration, permit read access to + // the appropriate file. Be sure that the logging configuration is + // secure before enabling such access. E.g. for the examples web + // application: + // permission java.io.FilePermission "${catalina.base}${file.separator} + // webapps${file.separator}examples${file.separator} + // WEB-INF${file.separator}classes${file.separator}logging.properties", "read"; }; // These permissions apply to the server startup code @@ -260,27 +292,40 @@ grant { permission java.util.PropertyPermission "java.vendor", "read"; permission java.util.PropertyPermission "java.vendor.url", "read"; permission java.util.PropertyPermission "java.class.version", "read"; - permission java.util.PropertyPermission "java.specification.version", "read"; - permission java.util.PropertyPermission "java.specification.vendor", "read"; - permission java.util.PropertyPermission "java.specification.name", "read"; + permission java.util.PropertyPermission "java.specification.version", "read"; + permission java.util.PropertyPermission "java.specification.vendor", "read"; + permission java.util.PropertyPermission "java.specification.name", "read"; - permission java.util.PropertyPermission "java.vm.specification.version", "read"; - permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; - permission java.util.PropertyPermission "java.vm.specification.name", "read"; - permission java.util.PropertyPermission "java.vm.version", "read"; - permission java.util.PropertyPermission "java.vm.vendor", "read"; - permission java.util.PropertyPermission "java.vm.name", "read"; + permission java.util.PropertyPermission "java.vm.specification.version", "read"; + permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; + permission java.util.PropertyPermission "java.vm.specification.name", "read"; + permission java.util.PropertyPermission "java.vm.version", "read"; + permission java.util.PropertyPermission "java.vm.vendor", "read"; + permission java.util.PropertyPermission "java.vm.name", "read"; // Required for OpenJMX permission java.lang.RuntimePermission "getAttribute"; - // Allow read of JAXP compliant XML parser debug - permission java.util.PropertyPermission "jaxp.debug", "read"; + // Allow read of JAXP compliant XML parser debug + permission java.util.PropertyPermission "jaxp.debug", "read"; + + // All JSPs need to be able to read this package + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat"; - // Precompiled JSPs need access to this package. + // Precompiled JSPs need access to these packages. + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el"; permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime"; - permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*"; - + permission java.lang.RuntimePermission + "accessClassInPackage.org.apache.jasper.runtime.*"; + + // Precompiled JSPs need access to these system properties. + permission java.util.PropertyPermission + "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read"; + permission java.util.PropertyPermission + "org.apache.el.parser.COERCE_TO_ZERO", "read"; + + // Applications using Comet need to be able to access this package + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.comet"; }; @@ -298,21 +343,21 @@ grant { // the NOAA web server. You might create a "grant" entries like this: // // The permissions granted to the context root directory apply to JSP pages. -// grant codeBase "file:${catalina.home}/webapps/examples/-" { +// grant codeBase "file:${catalina.base}/webapps/examples/-" { // permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; // permission java.net.SocketPermission "*.noaa.gov:80", "connect"; // }; // // The permissions granted to the context WEB-INF/classes directory -// grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/classes/-" { +// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" { // }; // // The permission granted to your JDBC driver -// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/driver.jar!/-" { +// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" { // permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; // }; // The permission granted to the scrape taglib -// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { +// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { // permission java.net.SocketPermission "*.noaa.gov:80", "connect"; // }; -- 2.11.0