| [66] | 1 | <html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 6.0 - Security Manager HOW-TO</title><meta value="Glenn Nielsen" name="author"><meta value="glenn@voyager.apg.more.net" name="email"><meta value="Jean-Francois Arcand" name="author"><meta value="jeanfrancois.arcand@sun.com" name="email"></head><body vlink="#525D76" alink="#525D76" link="#525D76" text="#000000" bgcolor="#ffffff"><table cellspacing="0" width="100%" border="0"><!--PAGE HEADER--><tr><td><!--PROJECT LOGO--><a href="http://tomcat.apache.org/"><img border="0" alt=" |
|---|
| 2 | The Apache Tomcat Servlet/JSP Container |
|---|
| 3 | " align="right" src="./../images/tomcat.gif"></a></td><td><font face="arial,helvetica,sanserif"><h1>Apache Tomcat 6.0</h1></font></td><td><!--APACHE LOGO--><a href="http://www.apache.org/"><img border="0" alt="Apache Logo" align="right" src="./../images/asf-logo.gif"></a></td></tr></table><table cellspacing="4" width="100%" border="0"><!--HEADER SEPARATOR--><tr><td colspan="2"><hr size="1" noshade></td></tr><tr><!--RIGHT SIDE MAIN BODY--><td align="left" valign="top" width="80%"><table cellspacing="4" width="100%" border="0"><tr><td valign="top" align="left"><h1>Apache Tomcat 6.0</h1><h2>Security Manager HOW-TO</h2></td><td nowrap="true" valign="top" align="right"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Background"><strong>Background</strong></a></font></td></tr><tr><td><blockquote> |
|---|
| 4 | |
|---|
| 5 | <p>The Java <strong>SecurityManager</strong> is what allows a web browser |
|---|
| 6 | to run an applet in its own sandbox to prevent untrusted code from |
|---|
| 7 | accessing files on the local file system, connecting to a host other |
|---|
| 8 | than the one the applet was loaded from, and so on. In the same way |
|---|
| 9 | the SecurityManager protects you from an untrusted applet running in |
|---|
| 10 | your browser, use of a SecurityManager while running Tomcat can protect |
|---|
| 11 | your server from trojan servlets, JSPs, JSP beans, and tag libraries. |
|---|
| 12 | Or even inadvertent mistakes.</p> |
|---|
| 13 | |
|---|
| 14 | <p>Imagine if someone who is authorized to publish JSPs on your site |
|---|
| 15 | inadvertently included the following in their JSP:</p> |
|---|
| 16 | <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre> |
|---|
| 17 | <% System.exit(1); %> |
|---|
| 18 | </pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div> |
|---|
| 19 | |
|---|
| 20 | <p>Every time this JSP was executed by Tomcat, Tomcat would exit. |
|---|
| 21 | Using the Java SecurityManager is just one more line of defense a |
|---|
| 22 | system administrator can use to keep the server secure and reliable.</p> |
|---|
| 23 | |
|---|
| 24 | <p><strong>WARNING</strong> - A security audit |
|---|
| 25 | have been conducted using the Tomcat 6 codebase. Most of the critical |
|---|
| 26 | package have been protected and a new security package protection mechanism |
|---|
| 27 | has been implemented. Still, make sure that you are satisfied with your SecurityManager |
|---|
| 28 | configuration before allowing untrusted users to publish web applications, |
|---|
| 29 | JSPs, servlets, beans, or tag libraries. <strong>However, running with a |
|---|
| 30 | SecurityManager is definitely better than running without one.</strong></p> |
|---|
| 31 | |
|---|
| 32 | </blockquote></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Permissions"><strong>Permissions</strong></a></font></td></tr><tr><td><blockquote> |
|---|
| 33 | |
|---|
| 34 | <p>Permission classes are used to define what Permissions a class loaded |
|---|
| 35 | by Tomcat will have. There are a number of Permission classes that are |
|---|
| 36 | a standard part of the JDK, and you can create your own Permission class |
|---|
| 37 | for use in your own web applications. Both techniques are used in |
|---|
| 38 | Tomcat 6.</p> |
|---|
| 39 | |
|---|
| 40 | |
|---|
| 41 | <table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#828DA6"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Standard Permissions"><strong>Standard Permissions</strong></a></font></td></tr><tr><td><blockquote> |
|---|
| 42 | |
|---|
| 43 | <p>This is just a short summary of the standard system SecurityManager |
|---|
| 44 | Permission classes applicable to Tomcat. See |
|---|
| 45 | <a href="http://java.sun.com/security/">http://java.sun.com/security/</a> |
|---|
| 46 | for more information.</p> |
|---|
| 47 | |
|---|
| 48 | <ul> |
|---|
| 49 | <li><strong>java.util.PropertyPermission</strong> - Controls read/write |
|---|
| 50 | access to JVM properties such as <code>java.home</code>.</li> |
|---|
| 51 | <li><strong>java.lang.RuntimePermission</strong> - Controls use of |
|---|
| 52 | some System/Runtime functions like <code>exit()</code> and |
|---|
| 53 | <code>exec()</code>. Also control the package access/definition.</li> |
|---|
| 54 | <li><strong>java.io.FilePermission</strong> - Controls read/write/execute |
|---|
| 55 | access to files and directories.</li> |
|---|
| 56 | <li><strong>java.net.SocketPermission</strong> - Controls use of |
|---|
| 57 | network sockets.</li> |
|---|
| 58 | <li><strong>java.net.NetPermission</strong> - Controls use of |
|---|
| 59 | multicast network connections.</li> |
|---|
| 60 | <li><strong>java.lang.reflect.ReflectPermission</strong> - Controls |
|---|
| 61 | use of reflection to do class introspection.</li> |
|---|
| 62 | <li><strong>java.security.SecurityPermission</strong> - Controls access |
|---|
| 63 | to Security methods.</li> |
|---|
| 64 | <li><strong>java.security.AllPermission</strong> - Allows access to all |
|---|
| 65 | permissions, just as if you were running Tomcat without a |
|---|
| 66 | SecurityManager.</li> |
|---|
| 67 | </ul> |
|---|
| 68 | |
|---|
| 69 | </blockquote></td></tr></table> |
|---|
| 70 | |
|---|
| 71 | |
|---|
| 72 | <table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#828DA6"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Tomcat Custom Permissions"><strong>Tomcat Custom Permissions</strong></a></font></td></tr><tr><td><blockquote> |
|---|
| 73 | |
|---|
| 74 | <p>Tomcat utilizes a custom permission class called |
|---|
| 75 | <strong>org.apache.naming.JndiPermission</strong>. This permission |
|---|
| 76 | controls read access to JNDI named file based resources. The permission |
|---|
| 77 | name is the JNDI name and there are no actions. A trailing "*" can be |
|---|
| 78 | used to do wild card matching for a JNDI named file resource when |
|---|
| 79 | granting permission. For example, you might include the following |
|---|
| 80 | in your policy file:</p> |
|---|
| 81 | <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre> |
|---|
| 82 | permission org.apache.naming.JndiPermission "jndi://localhost/examples/*"; |
|---|
| 83 | </pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div> |
|---|
| 84 | |
|---|
| 85 | <p>A Permission entry like this is generated dynamically for each web |
|---|
| 86 | application that is deployed, to allow it to read its own static resources |
|---|
| 87 | but disallow it from using file access to read any other files (unless |
|---|
| 88 | permissions for those files are explicitly granted).</p> |
|---|
| 89 | |
|---|
| 90 | <p>Also, Tomcat always dynamically creates the following file permission:</p> |
|---|
| 91 | <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre> |
|---|
| 92 | permission java.io.FilePermission "** your application context**", "read"; |
|---|
| 93 | </pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div> |
|---|
| 94 | <p>Where **your application context** equals the folder(or WAR file) under which |
|---|
| 95 | your application has been deployed. </p> |
|---|
| 96 | |
|---|
| 97 | </blockquote></td></tr></table> |
|---|
| 98 | |
|---|
| 99 | |
|---|
| 100 | </blockquote></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Configuring Tomcat With A SecurityManager"><strong>Configuring Tomcat With A SecurityManager</strong></a></font></td></tr><tr><td><blockquote> |
|---|
| 101 | |
|---|
| 102 | <h3>Policy File Format</h3> |
|---|
| 103 | |
|---|
| 104 | <p>The security policies implemented by the Java SecurityManager are |
|---|
| 105 | configured in the <code>$CATALINA_BASE/conf/catalina.policy</code> file. |
|---|
| 106 | This file completely replaces the <code>java.policy</code> file present |
|---|
| 107 | in your JDK system directories. The <code>catalina.policy</code> file |
|---|
| 108 | can be edited by hand, or you can use the |
|---|
| 109 | <a href="http://java.sun.com/products/jdk/1.2/docs/tooldocs/solaris/policytool.html">policytool</a> |
|---|
| 110 | application that comes with Java 1.2 or later.</p> |
|---|
| 111 | |
|---|
| 112 | <p>Entries in the <code>catalina.policy</code> file use the standard |
|---|
| 113 | <code>java.policy</code> file format, as follows:</p> |
|---|
| 114 | <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre> |
|---|
| 115 | // Example policy file entry |
|---|
| 116 | |
|---|
| 117 | grant [signedBy <signer>,] [codeBase <code source>] { |
|---|
| 118 | permission <class> [<name> [, <action list>]]; |
|---|
| 119 | }; |
|---|
| 120 | </pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div> |
|---|
| 121 | |
|---|
| 122 | <p>The <strong>signedBy</strong> and <strong>codeBase</strong> entries are |
|---|
| 123 | optional when granting permissions. Comment lines begin with "//" and |
|---|
| 124 | end at the end of the current line. The <code>codeBase</code> is in the |
|---|
| 125 | form of a URL, and for a file URL can use the <code>${java.home}</code> |
|---|
| 126 | and <code>${catalina.home}</code> properties (which are expanded out to |
|---|
| 127 | the directory paths defined for them by the <code>JAVA_HOME</code>, |
|---|
| 128 | <code>CATALINA_HOME</code> and <code>CATALINA_BASE</code> environment |
|---|
| 129 | variables).</p> |
|---|
| 130 | |
|---|
| 131 | <h3>The Default Policy File</h3> |
|---|
| 132 | |
|---|
| 133 | <p>The default <code>$CATALINA_BASE/conf/catalina.policy</code> file |
|---|
| 134 | looks like this:</p> |
|---|
| 135 | <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre> |
|---|
| 136 | // ============================================================================ |
|---|
| 137 | // catalina.corepolicy - Security Policy Permissions for Tomcat 6 |
|---|
| 138 | // |
|---|
| 139 | // This file contains a default set of security policies to be enforced (by the |
|---|
| 140 | // JVM) when Catalina is executed with the "-security" option. In addition |
|---|
| 141 | // to the permissions granted here, the following additional permissions are |
|---|
| 142 | // granted to the codebase specific to each web application: |
|---|
| 143 | // |
|---|
| 144 | // * Read access to the document root directory |
|---|
| 145 | // |
|---|
| 146 | // $Id: security-manager-howto.xml 633912 2008-03-05 16:24:07Z jim $ |
|---|
| 147 | // ============================================================================ |
|---|
| 148 | |
|---|
| 149 | |
|---|
| 150 | // ========== SYSTEM CODE PERMISSIONS ========================================= |
|---|
| 151 | |
|---|
| 152 | |
|---|
| 153 | // These permissions apply to javac |
|---|
| 154 | grant codeBase "file:${java.home}/lib/-" { |
|---|
| 155 | permission java.security.AllPermission; |
|---|
| 156 | }; |
|---|
| 157 | |
|---|
| 158 | // These permissions apply to all shared system extensions |
|---|
| 159 | grant codeBase "file:${java.home}/jre/lib/ext/-" { |
|---|
| 160 | permission java.security.AllPermission; |
|---|
| 161 | }; |
|---|
| 162 | |
|---|
| 163 | // These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre |
|---|
| 164 | grant codeBase "file:${java.home}/../lib/-" { |
|---|
| 165 | permission java.security.AllPermission; |
|---|
| 166 | }; |
|---|
| 167 | |
|---|
| 168 | // These permissions apply to all shared system extensions when |
|---|
| 169 | // ${java.home} points at $JAVA_HOME/jre |
|---|
| 170 | grant codeBase "file:${java.home}/lib/ext/-" { |
|---|
| 171 | permission java.security.AllPermission; |
|---|
| 172 | }; |
|---|
| 173 | |
|---|
| 174 | |
|---|
| 175 | // ========== CATALINA CODE PERMISSIONS ======================================= |
|---|
| 176 | |
|---|
| 177 | |
|---|
| 178 | // These permissions apply to the daemon code |
|---|
| 179 | grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { |
|---|
| 180 | permission java.security.AllPermission; |
|---|
| 181 | }; |
|---|
| 182 | |
|---|
| 183 | // These permissions apply to the logging API |
|---|
| 184 | grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { |
|---|
| 185 | permission java.security.AllPermission; |
|---|
| 186 | }; |
|---|
| 187 | |
|---|
| 188 | // These permissions apply to the server startup code |
|---|
| 189 | grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { |
|---|
| 190 | permission java.security.AllPermission; |
|---|
| 191 | }; |
|---|
| 192 | |
|---|
| 193 | // These permissions apply to the servlet API classes |
|---|
| 194 | // and those that are shared across all class loaders |
|---|
| 195 | // located in the "lib" directory |
|---|
| 196 | grant codeBase "file:${catalina.home}/lib/-" { |
|---|
| 197 | permission java.security.AllPermission; |
|---|
| 198 | }; |
|---|
| 199 | |
|---|
| 200 | |
|---|
| 201 | // ========== WEB APPLICATION PERMISSIONS ===================================== |
|---|
| 202 | |
|---|
| 203 | |
|---|
| 204 | // These permissions are granted by default to all web applications |
|---|
| 205 | // In addition, a web application will be given a read FilePermission |
|---|
| 206 | // and JndiPermission for all files and directories in its document root. |
|---|
| 207 | grant { |
|---|
| 208 | // Required for JNDI lookup of named JDBC DataSource's and |
|---|
| 209 | // javamail named MimePart DataSource used to send mail |
|---|
| 210 | permission java.util.PropertyPermission "java.home", "read"; |
|---|
| 211 | permission java.util.PropertyPermission "java.naming.*", "read"; |
|---|
| 212 | permission java.util.PropertyPermission "javax.sql.*", "read"; |
|---|
| 213 | |
|---|
| 214 | // OS Specific properties to allow read access |
|---|
| 215 | permission java.util.PropertyPermission "os.name", "read"; |
|---|
| 216 | permission java.util.PropertyPermission "os.version", "read"; |
|---|
| 217 | permission java.util.PropertyPermission "os.arch", "read"; |
|---|
| 218 | permission java.util.PropertyPermission "file.separator", "read"; |
|---|
| 219 | permission java.util.PropertyPermission "path.separator", "read"; |
|---|
| 220 | permission java.util.PropertyPermission "line.separator", "read"; |
|---|
| 221 | |
|---|
| 222 | // JVM properties to allow read access |
|---|
| 223 | permission java.util.PropertyPermission "java.version", "read"; |
|---|
| 224 | permission java.util.PropertyPermission "java.vendor", "read"; |
|---|
| 225 | permission java.util.PropertyPermission "java.vendor.url", "read"; |
|---|
| 226 | permission java.util.PropertyPermission "java.class.version", "read"; |
|---|
| 227 | permission java.util.PropertyPermission "java.specification.version", "read"; |
|---|
| 228 | permission java.util.PropertyPermission "java.specification.vendor", "read"; |
|---|
| 229 | permission java.util.PropertyPermission "java.specification.name", "read"; |
|---|
| 230 | |
|---|
| 231 | permission java.util.PropertyPermission "java.vm.specification.version", "read"; |
|---|
| 232 | permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; |
|---|
| 233 | permission java.util.PropertyPermission "java.vm.specification.name", "read"; |
|---|
| 234 | permission java.util.PropertyPermission "java.vm.version", "read"; |
|---|
| 235 | permission java.util.PropertyPermission "java.vm.vendor", "read"; |
|---|
| 236 | permission java.util.PropertyPermission "java.vm.name", "read"; |
|---|
| 237 | |
|---|
| 238 | // Required for OpenJMX |
|---|
| 239 | permission java.lang.RuntimePermission "getAttribute"; |
|---|
| 240 | |
|---|
| 241 | // Allow read of JAXP compliant XML parser debug |
|---|
| 242 | permission java.util.PropertyPermission "jaxp.debug", "read"; |
|---|
| 243 | |
|---|
| 244 | // Precompiled JSPs need access to this package. |
|---|
| 245 | permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime"; |
|---|
| 246 | permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*"; |
|---|
| 247 | |
|---|
| 248 | }; |
|---|
| 249 | |
|---|
| 250 | |
|---|
| 251 | // You can assign additional permissions to particular web applications by |
|---|
| 252 | // adding additional "grant" entries here, based on the code base for that |
|---|
| 253 | // application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. |
|---|
| 254 | // |
|---|
| 255 | // Different permissions can be granted to JSP pages, classes loaded from |
|---|
| 256 | // the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/ |
|---|
| 257 | // directory, or even to individual jar files in the /WEB-INF/lib/ directory. |
|---|
| 258 | // |
|---|
| 259 | // For instance, assume that the standard "examples" application |
|---|
| 260 | // included a JDBC driver that needed to establish a network connection to the |
|---|
| 261 | // corresponding database and used the scrape taglib to get the weather from |
|---|
| 262 | // the NOAA web server. You might create a "grant" entries like this: |
|---|
| 263 | // |
|---|
| 264 | // The permissions granted to the context root directory apply to JSP pages. |
|---|
| 265 | // grant codeBase "file:${catalina.home}/webapps/examples/-" { |
|---|
| 266 | // permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; |
|---|
| 267 | // permission java.net.SocketPermission "*.noaa.gov:80", "connect"; |
|---|
| 268 | // }; |
|---|
| 269 | // |
|---|
| 270 | // The permissions granted to the context WEB-INF/classes directory |
|---|
| 271 | // grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/classes/-" { |
|---|
| 272 | // }; |
|---|
| 273 | // |
|---|
| 274 | // The permission granted to your JDBC driver |
|---|
| 275 | // grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/driver.jar!/-" { |
|---|
| 276 | // permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; |
|---|
| 277 | // }; |
|---|
| 278 | // The permission granted to the scrape taglib |
|---|
| 279 | // grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { |
|---|
| 280 | // permission java.net.SocketPermission "*.noaa.gov:80", "connect"; |
|---|
| 281 | // }; |
|---|
| 282 | </pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div> |
|---|
| 283 | |
|---|
| 284 | <h3>Starting Tomcat With A SecurityManager</h3> |
|---|
| 285 | |
|---|
| 286 | <p>Once you have configured the <code>catalina.policy</code> file for use |
|---|
| 287 | with a SecurityManager, Tomcat can be started with a SecurityManager in |
|---|
| 288 | place by using the "-security" option:</p> |
|---|
| 289 | <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre> |
|---|
| 290 | $CATALINA_HOME/bin/catalina.sh start -security (Unix) |
|---|
| 291 | %CATALINA_HOME%\bin\catalina start -security (Windows) |
|---|
| 292 | </pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div> |
|---|
| 293 | |
|---|
| 294 | </blockquote></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Configuring Package Protection in Tomcat"><strong>Configuring Package Protection in Tomcat</strong></a></font></td></tr><tr><td><blockquote> |
|---|
| 295 | <p>Starting with Tomcat 5, it is now possible to configure which Tomcat |
|---|
| 296 | internal package are protected againts package definition and access. See |
|---|
| 297 | <a href="http://java.sun.com/security/seccodeguide.html"> |
|---|
| 298 | http://java.sun.com/security/seccodeguide.html</a> |
|---|
| 299 | for more information.</p> |
|---|
| 300 | |
|---|
| 301 | |
|---|
| 302 | <p><strong>WARNING</strong>: Be aware that removing the default package protection |
|---|
| 303 | could possibly open a security hole</p> |
|---|
| 304 | |
|---|
| 305 | <h3>The Default Properties File</h3> |
|---|
| 306 | |
|---|
| 307 | <p>The default <code>$CATALINA_BASE/conf/catalina.properties</code> file |
|---|
| 308 | looks like this:</p> |
|---|
| 309 | <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre> |
|---|
| 310 | # |
|---|
| 311 | # List of comma-separated packages that start with or equal this string |
|---|
| 312 | # will cause a security exception to be thrown when |
|---|
| 313 | # passed to checkPackageAccess unless the |
|---|
| 314 | # corresponding RuntimePermission ("accessClassInPackage."+package) has |
|---|
| 315 | # been granted. |
|---|
| 316 | package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat., |
|---|
| 317 | org.apache.jasper. |
|---|
| 318 | # |
|---|
| 319 | # List of comma-separated packages that start with or equal this string |
|---|
| 320 | # will cause a security exception to be thrown when |
|---|
| 321 | # passed to checkPackageDefinition unless the |
|---|
| 322 | # corresponding RuntimePermission ("defineClassInPackage."+package) has |
|---|
| 323 | # been granted. |
|---|
| 324 | # |
|---|
| 325 | # by default, no packages are restricted for definition, and none of |
|---|
| 326 | # the class loaders supplied with the JDK call checkPackageDefinition. |
|---|
| 327 | # |
|---|
| 328 | package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote., |
|---|
| 329 | org.apache.tomcat.,org.apache.jasper. |
|---|
| 330 | </pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div> |
|---|
| 331 | <p>Once you have configured the <code>catalina.properties</code> file for use |
|---|
| 332 | with a SecurityManager, remember to re-start Tomcat.</p> |
|---|
| 333 | </blockquote></td></tr></table><table cellpadding="2" cellspacing="0" border="0"><tr><td bgcolor="#525D76"><font face="arial,helvetica.sanserif" color="#ffffff"><a name="Troubleshooting"><strong>Troubleshooting</strong></a></font></td></tr><tr><td><blockquote> |
|---|
| 334 | |
|---|
| 335 | <p>If your web application attempts to execute an operation that is |
|---|
| 336 | prohibited by lack of a required Permission, it will throw an |
|---|
| 337 | <code>AccessControLException</code> or a <code>SecurityException</code> |
|---|
| 338 | when the SecurityManager detects the violation. Debugging the permission |
|---|
| 339 | that is missing can be challenging, and one option is to turn on debug |
|---|
| 340 | output of all security decisions that are made during execution. This |
|---|
| 341 | is done by setting a system property before starting Tomcat. The easiest |
|---|
| 342 | way to do this is via the <code>CATALINA_OPTS</code> environment variable. |
|---|
| 343 | Execute this command:</p> |
|---|
| 344 | <div align="left"><table border="0" cellpadding="0" cellspacing="4"><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#ffffff"><pre> |
|---|
| 345 | export CATALINA_OPTS=-Djava.security.debug=all (Unix) |
|---|
| 346 | set CATALINA_OPTS=-Djava.security.debug=all (Windows) |
|---|
| 347 | </pre></td><td width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr><tr><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td><td height="1" width="1" bgcolor="#023264"><img border="0" hspace="0" vspace="0" height="1" width="1" src="./../images/void.gif"></td></tr></table></div> |
|---|
| 348 | |
|---|
| 349 | <p>before starting Tomcat.</p> |
|---|
| 350 | |
|---|
| 351 | <p><strong>WARNING</strong> - This will generate <em>many megabytes</em> |
|---|
| 352 | of output! However, it can help you track down problems by searching |
|---|
| 353 | for the word "FAILED" and determining which permission was being checked |
|---|
| 354 | for. See the Java security documentation for more options that you can |
|---|
| 355 | specify here as well.</p> |
|---|
| 356 | |
|---|
| 357 | </blockquote></td></tr></table></td></tr><!--FOOTER SEPARATOR--><tr><td colspan="2"><hr size="1" noshade></td></tr><!--PAGE FOOTER--><tr><td colspan="2"><div align="center"><font size="-1" color="#525D76"><em> |
|---|
| 358 | Copyright © 1999-2008, Apache Software Foundation |
|---|
| 359 | </em></font></div></td></tr></table></body></html> |
|---|
