Author: kkolinko
Date: Sun Jun 6 16:20:50 2010
New Revision: 951887
URL: http://svn.apache.org/viewvc?rev=951887&view=rev
Log:
Document default working directory permissions
Update in-document copy of the default catalina.policy file
Modified:
tomcat/tc6.0.x/trunk/webapps/docs/security-manager-howto.xml
Modified: tomcat/tc6.0.x/trunk/webapps/docs/security-manager-howto.xml
URL:
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/webapps/docs/security-manager-howto.xml?rev=951887&r1=951886&r2=951887&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/webapps/docs/security-manager-howto.xml (original)
+++ tomcat/tc6.0.x/trunk/webapps/docs/security-manager-howto.xml Sun Jun 6
16:20:50 2010
@@ -124,12 +124,19 @@ permission org.apache.naming.JndiPermis
but disallow it from using file access to read any other files (unless
permissions for those files are explicitly granted).</p>
- <p>Also, Tomcat always dynamically creates the following file
permission:</p>
-<source>
+ <p>Also, Tomcat always dynamically creates the following file
permissions:</p>
+<source>
permission java.io.FilePermission "** your application context**", "read";
-</source>
- <p>Where **your application context** equals the folder(or WAR file) under
which
- your application has been deployed. </p>
+
+permission java.io.FilePermission
+ "** application working directory**", "read,write";
+permission java.io.FilePermission
+ "** application working directory**/-", "read,write,delete";
+</source>
+ <p>Where **your application context** equals the folder (or WAR file)
under which
+ your application has been deployed and **application working directory**
is the
+ temporary directory provided to your application as required by the
+ Servlet Specification.</p>
</subsection>
@@ -174,14 +181,15 @@ grant [signedBy <signer>,] [codeBa
looks like this:</p>
<source>
// ============================================================================
-// catalina.corepolicy - Security Policy Permissions for Tomcat 6
+// catalina.policy - Security Policy Permissions for Tomcat 6
//
// This file contains a default set of security policies to be enforced (by the
// JVM) when Catalina is executed with the "-security" option. In addition
// to the permissions granted here, the following additional permissions are
// granted to the codebase specific to each web application:
//
-// * Read access to the document root directory
+// * Read access to its document root directory
+// * Read, write and delete access to its working directory
//
// ============================================================================
@@ -220,8 +228,37 @@ grant codeBase "file:${catalina.home}/bi
};
// These permissions apply to the logging API
+// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
+// update this section accordingly.
+// grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
- permission java.security.AllPermission;
+ permission java.io.FilePermission
+
"${java.home}${file.separator}lib${file.separator}logging.properties", "read";
+
+ permission java.io.FilePermission
+
"${catalina.base}${file.separator}conf${file.separator}logging.properties",
"read";
+ permission java.io.FilePermission
+ "${catalina.base}${file.separator}logs", "read, write";
+ permission java.io.FilePermission
+ "${catalina.base}${file.separator}logs${file.separator}*", "read,
write";
+
+ permission java.lang.RuntimePermission "shutdownHooks";
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission java.lang.RuntimePermission "setContextClassLoader";
+
+ permission java.util.logging.LoggingPermission "control";
+
+ permission java.util.PropertyPermission
"java.util.logging.config.class", "read";
+ permission java.util.PropertyPermission
"java.util.logging.config.file", "read";
+ permission java.util.PropertyPermission "catalina.base", "read";
+
+ // Note: To enable per context logging configuration, permit read
access to
+ // the appropriate file. Be sure that the logging configuration is
+ // secure before enabling such access.
+ // E.g. for the examples web application, all in one line:
+ // permission java.io.FilePermission "${catalina.base}${file.separator}
+ // webapps${file.separator}examples${file.separator}WEB-INF
+ // ${file.separator}classes${file.separator}logging.properties",
"read";
};
// These permissions apply to the server startup code
@@ -237,6 +274,13 @@ grant codeBase "file:${catalina.home}/li
};
+// If using a per instance lib directory, i.e. ${catalina.base}/lib,
+// then the following permission will need to be uncommented
+// grant codeBase "file:${catalina.base}/lib/-" {
+// permission java.security.AllPermission;
+// };
+
+
// ========== WEB APPLICATION PERMISSIONS =====================================
@@ -263,27 +307,32 @@ grant {
permission java.util.PropertyPermission "java.vendor", "read";
permission java.util.PropertyPermission "java.vendor.url", "read";
permission java.util.PropertyPermission "java.class.version", "read";
- permission java.util.PropertyPermission "java.specification.version",
"read";
- permission java.util.PropertyPermission "java.specification.vendor",
"read";
- permission java.util.PropertyPermission "java.specification.name",
"read";
-
- permission java.util.PropertyPermission
"java.vm.specification.version", "read";
- permission java.util.PropertyPermission "java.vm.specification.vendor",
"read";
- permission java.util.PropertyPermission "java.vm.specification.name",
"read";
- permission java.util.PropertyPermission "java.vm.version", "read";
- permission java.util.PropertyPermission "java.vm.vendor", "read";
- permission java.util.PropertyPermission "java.vm.name", "read";
+ permission java.util.PropertyPermission "java.specification.version",
"read";
+ permission java.util.PropertyPermission "java.specification.vendor",
"read";
+ permission java.util.PropertyPermission "java.specification.name", "read";
+
+ permission java.util.PropertyPermission "java.vm.specification.version",
"read";
+ permission java.util.PropertyPermission "java.vm.specification.vendor",
"read";
+ permission java.util.PropertyPermission "java.vm.specification.name",
"read";
+ permission java.util.PropertyPermission "java.vm.version", "read";
+ permission java.util.PropertyPermission "java.vm.vendor", "read";
+ permission java.util.PropertyPermission "java.vm.name", "read";
// Required for OpenJMX
permission java.lang.RuntimePermission "getAttribute";
- // Allow read of JAXP compliant XML parser debug
- permission java.util.PropertyPermission "jaxp.debug", "read";
+ // Allow read of JAXP compliant XML parser debug
+ permission java.util.PropertyPermission "jaxp.debug", "read";
- // Precompiled JSPs need access to this package.
+ // Precompiled JSPs need access to these packages.
+ permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.jasper.el";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.jasper.runtime";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.jasper.runtime.*";
+ // Precompiled JSPs need access to these system properties.
+ permission java.util.PropertyPermission
+ "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
+ permission java.util.PropertyPermission
"org.apache.el.parser.COERCE_TO_ZERO", "read";
};
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
