oscerd opened a new pull request, #737:
URL: https://github.com/apache/camel-karaf/pull/737
Fixes #728
## What
The `camel-core` feature seeded `jmx.acl.org.apache.camel` with a single
`* = *` entry. Karaf resolves ACL PIDs most-specific-first, so this
domain-level
PID is consulted before the root `jmx.acl` PID and replaces Karaf's stock
per-operation mapping for every MBean in the `org.apache.camel` domain — so
read-only introspection and mutating operations are treated identically.
## How
Karaf falls through to the next-less-specific PID when **no rule in the
current
PID matches** the operation. That means the domain file only needs to list
the
operations that should *differ* from the stock `jmx.acl` defaults, exactly as
Karaf's own `jmx.acl.org.apache.karaf.bundle.cfg` does (it lists lifecycle
only
and lets `get*`/`list*` fall through).
So the entry becomes:
```
start* = manager
stop* = manager
suspend* = manager
resume* = manager
reset* = manager
```
which leaves:
- `get*` / `list*` / `is*` at the stock **viewer** mapping
- lifecycle at **manager**, matching how Karaf maps bundle lifecycle
- everything else — `sendBody*`, `requestBody*`, `createEndpoint`,
`removeEndpoints`, `addOrUpdateRoutes*`, and `dump*` (which resolves
property
placeholders) — at the stock **admin** mapping
## The comment that was removed was wrong
The entry carried `<!-- allow camel to access its own mbeans for karaf
commands
and other needs -->`. That justification does not hold:
- `KarafMBeanServerGuard` is installed as a `Proxy` around the `MBeanServer`
passed to `JMXConnectorServerFactory.newJMXConnectorServer(...)`
(`ConnectorServerFactory:293-295`), so it applies to **remote JMX
connections
only**.
- The `camel:*` commands read `CamelContext` straight from the OSGi service
registry (`CamelCommandSupport.getCamelContexts()`).
- The one command that does touch the MBeanServer, `ContextInflight`, gets it
from `agent.getMBeanServer()` in-VM — which bypasses the guard regardless
of
what any ACL says.
So this config never had any effect on the shell commands; it only ever
applied
to remote JMX principals.
## Verification
Rather than reasoning about the semantics, I ran the new mapping through
Karaf 4.4.8's own `ACLConfigurationParser`, driving it the way
`KarafMBeanServerGuard.getRequiredRoles` does (domain PID first, fall
through to
the stock root `jmx.acl` on `NO_MATCH`):
```
operation | OLD (* = *) | NEW
-----------------------------+------------------------+-----------------------
getCamelId | viewer ALLOWED [*] | viewer ALLOWED
[viewer]
listRoutes | viewer ALLOWED [*] | viewer ALLOWED
[viewer]
isStarted | viewer ALLOWED [*] | viewer ALLOWED
[viewer]
start | viewer ALLOWED [*] | viewer denied
[manager]
stop | viewer ALLOWED [*] | viewer denied
[manager]
suspend | viewer ALLOWED [*] | viewer denied
[manager]
resume | viewer ALLOWED [*] | viewer denied
[manager]
resetStatistics | viewer ALLOWED [*] | viewer denied
[manager]
sendBody | viewer ALLOWED [*] | viewer denied [admin]
sendStringBody | viewer ALLOWED [*] | viewer denied [admin]
requestBody | viewer ALLOWED [*] | viewer denied [admin]
createEndpoint | viewer ALLOWED [*] | viewer denied [admin]
removeEndpoints | viewer ALLOWED [*] | viewer denied [admin]
addOrUpdateRoutesFromXml | viewer ALLOWED [*] | viewer denied [admin]
dumpRoutesAsXml | viewer ALLOWED [*] | viewer denied [admin]
setStatisticsLevel | viewer ALLOWED [*] | viewer denied [admin]
RESULT: all expectations hold
```
(The `[*]` role in the OLD column is why every row reads ALLOWED: Karaf's
`JaasHelper.currentUserHasRole` treats a required role of `*` as satisfied
before it looks at any principal.)
`camel-features.xml` is still well-formed XML.
## Upgrade note
Karaf seeds a `<config>` only when the file does not already exist, so an
existing installation keeps its current
`etc/jmx.acl.org.apache.camel.cfg` on upgrade. Added an operator bullet to
the
security model telling operators to check that file.
## Open question for reviewers
The tiering above is a judgement call. The alternative is to drop the
`<config>` block entirely and let the whole domain fall through to Karaf's
defaults — simpler, but then route lifecycle needs `admin` over remote JMX,
which is inconsistent with Karaf treating bundle lifecycle as `manager`.
Happy
to switch if you prefer strict fall-through.
---
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
