Re: [Geoserver-users] Geoserver 2.21.4 not deploying with Security Manager on JBoss EAP 7.4.9 when upgrading from Java 8 to Java 11

Pham, Tung M via Geoserver-users Wed, 16 Aug 2023 07:47:09 -0700

Hi Jody,

Thanks for the quick response.


I’ve tried it on GeoServer 2.22.4 and 2.23.2 with similar failed results. See 
below.

We are currently running GeoServer 2.21.4 and planning to upgrade towards the 
end of the year.  We are doing one major component upgrade at a time.  Our 
first upgrade is going from Java 8 to Java 11.

Tung

GeoServer 2.22.4

"{\"WFLYCTL0080: Failed services\" => 
{\"jboss.deployment.unit.\\\"geoserver.war\\\".undertow-deployment\" => 
\"java.lang.RuntimeException: 
org.springframework.beans.factory.BeanCreationException: Error creating bean 
with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.22.4.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission \\\"(\\\"java.io.FilePermission\\\" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\" 
\\\"read\\\")\\\" in code source \\\"null\\\" of \\\"null\\\")
    Caused by: java.lang.RuntimeException: 
org.springframework.beans.factory.BeanCreationException: Error creating bean 
with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.22.4.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission \\\"(\\\"java.io.FilePermission\\\" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\" 
\\\"read\\\")\\\" in code source \\\"null\\\" of \\\"null\\\")
    Caused by: org.springframework.beans.factory.BeanCreationException: Error 
creating bean with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.22.4.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission \\\"(\\\"java.io.FilePermission\\\" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\" 
\\\"read\\\")\\\" in code source \\\"null\\\" of \\\"null\\\")
    Caused by: java.security.AccessControlException: WFSM000001: Permission 
check failed (permission \\\"(\\\"java.io.FilePermission\\\" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\" 
\\\"read\\\")\\\" in code source \\\"null\\\" of \\\"null\\\")\"}}"


GeoServer 2.23.2

"{\"WFLYCTL0080: Failed services\" => 
{\"jboss.deployment.unit.\\\"geoserver.war\\\".undertow-deployment\" => 
\"java.lang.RuntimeException: 
org.springframework.beans.factory.BeanCreationException: Error creating bean 
with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.23.2.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission \\\"(\\\"java.io.FilePermission\\\" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\" 
\\\"read\\\")\\\" in code source \\\"null\\\" of \\\"null\\\")
    Caused by: java.lang.RuntimeException: 
org.springframework.beans.factory.BeanCreationException: Error creating bean 
with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.23.2.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission \\\"(\\\"java.io.FilePermission\\\" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\" 
\\\"read\\\")\\\" in code source \\\"null\\\" of \\\"null\\\")
    Caused by: org.springframework.beans.factory.BeanCreationException: Error 
creating bean with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.23.2.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission \\\"(\\\"java.io.FilePermission\\\" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\" 
\\\"read\\\")\\\" in code source \\\"null\\\" of \\\"null\\\")
    Caused by: java.security.AccessControlException: WFSM000001: Permission 
check failed (permission \\\"(\\\"java.io.FilePermission\\\" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\" 
\\\"read\\\")\\\" in code source \\\"null\\\" of \\\"null\\\")\"}}"

From: Jody Garnett <jody.garn...@gmail.com>
Sent: Wednesday, August 16, 2023 7:23 AM
To: Pham, Tung M <tung.p...@gdit.com>
Cc: geoserver-users@lists.sourceforge.net
Subject: Re: [Geoserver-users] Geoserver 2.21.4 not deploying with Security 
Manager on JBoss EAP 7.4.9 when upgrading from Java 8 to Java 11

 [External: Use caution with links & attachments]
GeoServer 2.21 reached end of life earlier this year, you may wish to try an 
active version.

We did fix some windows + java p11 test failure with absolute paths. we do. it 
have any active developers in or community on windows so it is hard to assist.

Please try with a supported version.

Jody

On Wed, Aug 16, 2023 at 7:05 AM Pham, Tung M via Geoserver-users 
<geoserver-users@lists.sourceforge.net<mailto:geoserver-users@lists.sourceforge.net>>
 wrote:
I am trying to deploy GeoServer 2.21.4 in JBoss EAP 7.4.9 with Java 11.  The 
GeoServer application fails to deploy when Java Security Manager is turned on.

I have been using the same Geoserver/JBoss versions on Java 8 successfully with 
Java Security Manager turned on with the following environament:

Java 8 environament:
Oracle JRE 1.8.0_351
JBoss EAP 7.4.9
GeoServer 2.21.4
Windows 10

With Java Security Manager turned on. (set "SECMGR=true" in JBoss' 
standalone.conf.bat)
- GeoServer successfully deploys with the following configuration set in JBoss' 
standalone.xml file in the security-manager subsystem section.

        <subsystem xmlns="urn:jboss:domain:security-manager:1.0">
            <deployment-permissions>
              <minimum-set>
                            <permission class="java.security.AllPermission"/>
              </minimum-set>
                <maximum-set>
                    <permission class="java.security.AllPermission"/>
                </maximum-set>
            </deployment-permissions>
        </subsystem>



Java 11 environament:
Oracle JRE 11.0.20
JBoss EAP 7.4.9
GeoServer 2.21.4
Windows 10

With Java Security Manager turned on. (set "SECMGR=true" in JBoss' 
standalone.conf.bat)
- GeoServer failed to deploy with the following configuration set in JBoss' 
standalone.xml file in the security-manager subsystem section. (Same setting 
used with Java 8)

        <subsystem xmlns="urn:jboss:domain:security-manager:1.0">
            <deployment-permissions>
              <minimum-set>
                           <permission class="java.security.AllPermission"/>
              </minimum-set>
                <maximum-set>
                    <permission class="java.security.AllPermission"/>
                </maximum-set>
            </deployment-permissions>
        </subsystem>

Error Log:
"{\"WFLYCTL0080: Failed services\" => 
{\"jboss.deployment.unit.\\\"geoserver.war\\\".undertow-deployment\" => 
\"java.lang.RuntimeException: 
org.springframework.beans.factory.BeanCreationException: Error creating bean 
with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.21.4.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission 
\\\"(\\\"java.io.FilePermission\\\<file:///%22(/%22java.io.FilePermission/>" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\<file:///%22F:/NN/gis/geoserver/external/gwc-layers/>"
 \\\"read\\\")\\\<file:///%22read/%22)/>" in code source 
\\\"null\\\<file:///%22null/>" of \\\"null\\\<file:///%22null/>")
    Caused by: java.lang.RuntimeException: 
org.springframework.beans.factory.BeanCreationException: Error creating bean 
with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.21.4.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission 
\\\"(\\\"java.io.FilePermission\\\<file:///%22(/%22java.io.FilePermission/>" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\<file:///%22F:/NN/gis/geoserver/external/gwc-layers/>"
 \\\"read\\\")\\\<file:///%22read/%22)/>" in code source 
\\\"null\\\<file:///%22null/>" of \\\"null\\\<file:///%22null/>")
    Caused by: org.springframework.beans.factory.BeanCreationException: Error 
creating bean with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.21.4.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission 
\\\"(\\\"java.io.FilePermission\\\<file:///%22(/%22java.io.FilePermission/>" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\<file:///%22F:/NN/gis/geoserver/external/gwc-layers/>"
 \\\"read\\\")\\\<file:///%22read/%22)/>" in code source 
\\\"null\\\<file:///%22null/>" of \\\"null\\\<file:///%22null/>")
    Caused by: java.security.AccessControlException: WFSM000001: Permission 
check failed (permission 
\\\"(\\\"java.io.FilePermission\\\<file:///%22(/%22java.io.FilePermission/>" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\<file:///%22F:/NN/gis/geoserver/external/gwc-layers/>"
 \\\"read\\\")\\\<file:///%22read/%22)/>" in code source 
\\\"null\\\<file:///%22null/>" of 
\\\"null\\\")\"}<file:///%22null/%22)/%22%7d>}"




-Modified the standalone.xml to individual permissions for <minimum-set>

        <subsystem xmlns="urn:jboss:domain:security-manager:1.0">
            <deployment-permissions>
              <minimum-set>
                           <permission class="java.util.PropertyPermission" 
name="*" actions="read,write"/>
                           <permission class="java.lang.RuntimePermission" 
name="*"/>
                           <permission 
class="java.util.logging.LoggingPermission" name="control"/>
                           <permission 
class="org.jboss.vfs.VirtualFilePermission" name="&lt;&lt;ALL FILES&gt;&gt;" 
actions="*"/>
                           <permission 
class="java.lang.reflect.ReflectPermission" name="suppressAccessChecks"/>
                           <permission class="java.io.FilePermission" 
name="F:\\NN\\jboss\\standalone\\-" actions="read"/>
                           <permission class="java.io.FilePermission" 
name="F:\\NN\\gis\\geoserver\\-" actions="read,write"/>
                           <permission class="java.io.FilePermission" 
name="F:\\NN\\gis\\geoserver\\external\\-" actions="read"/>
                           <permission class="java.io.FilePermission" 
name="F:\\NN\\gis\\geoserver\\external\\gwc-layers\\-" actions="read"/>
              </minimum-set>
                <maximum-set>
                    <permission class="java.security.AllPermission"/>
                </maximum-set>
            </deployment-permissions>
        </subsystem>


Failed results are similar compared to the previous configuration using only 
<permission class="java.security.AllPermission"/> for <minimum-set>
Error Log:
"{\"WFLYCTL0080: Failed services\" => 
{\"jboss.deployment.unit.\\\"geoserver.war\\\".undertow-deployment\" => 
\"java.lang.RuntimeException: 
org.springframework.beans.factory.BeanCreationException: Error creating bean 
with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.21.4.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission 
\\\"(\\\"java.io.FilePermission\\\<file:///%22(/%22java.io.FilePermission/>" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\<file:///%22F:/NN/gis/geoserver/external/gwc-layers/>"
 \\\"read\\\")\\\<file:///%22read/%22)/>" in code source 
\\\"null\\\<file:///%22null/>" of \\\"null\\\<file:///%22null/>")
    Caused by: java.lang.RuntimeException: 
org.springframework.beans.factory.BeanCreationException: Error creating bean 
with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.21.4.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission 
\\\"(\\\"java.io.FilePermission\\\<file:///%22(/%22java.io.FilePermission/>" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\<file:///%22F:/NN/gis/geoserver/external/gwc-layers/>"
 \\\"read\\\")\\\<file:///%22read/%22)/>" in code source 
\\\"null\\\<file:///%22null/>" of \\\"null\\\<file:///%22null/>")
    Caused by: org.springframework.beans.factory.BeanCreationException: Error 
creating bean with name 'gwcCatalogConfiguration' defined in URL 
[vfs:/C:/Program%20Files/NN/jboss/bin/content/geoserver.war/WEB-INF/lib/gs-gwc-2.21.4.jar/geowebcache-geoserver-context.xml]:
 Invocation of init method failed; nested exception is 
java.security.AccessControlException: WFSM000001: Permission check failed 
(permission 
\\\"(\\\"java.io.FilePermission\\\<file:///%22(/%22java.io.FilePermission/>" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\<file:///%22F:/NN/gis/geoserver/external/gwc-layers/>"
 \\\"read\\\")\\\<file:///%22read/%22)/>" in code source 
\\\"null\\\<file:///%22null/>" of \\\"null\\\<file:///%22null/>")
    Caused by: java.security.AccessControlException: WFSM000001: Permission 
check failed (permission 
\\\"(\\\"java.io.FilePermission\\\<file:///%22(/%22java.io.FilePermission/>" 
\\\"F:\\\\NN\\\\gis\\\\geoserver\\\\external\\\\gwc-layers\\\<file:///%22F:/NN/gis/geoserver/external/gwc-layers/>"
 \\\"read\\\")\\\<file:///%22read/%22)/>" in code source 
\\\"null\\\<file:///%22null/>" of 
\\\"null\\\")\"}<file:///%22null/%22)/%22%7d>}"


Any help would be much appreciated.

Tung Pham

_______________________________________________
Geoserver-users mailing list

Please make sure you read the following two resources before posting to this 
list:
- Earning your support instead of buying it, but Ian Turton: 
http://www.ianturton.com/talks/foss4g.html#/<https://urldefense.us/v3/__http:/www.ianturton.com/talks/foss4g.html*/__;Iw!!JRQnnSFuzw7wjAKq6ti6!x6dU_BRgucns55RQEe1mmlGJKjtr9a77Xx94tfHlem858hOV1q3_28L7paxvxRIhBKOXB4hH2ivmUCHKKl6B$>
- The GeoServer user list posting guidelines: 
http://geoserver.org/comm/userlist-guidelines.html<https://urldefense.us/v3/__http:/geoserver.org/comm/userlist-guidelines.html__;!!JRQnnSFuzw7wjAKq6ti6!x6dU_BRgucns55RQEe1mmlGJKjtr9a77Xx94tfHlem858hOV1q3_28L7paxvxRIhBKOXB4hH2ivmULJpZi_z$>

If you want to request a feature or an improvement, also see this: 
https://github.com/geoserver/geoserver/wiki/Successfully-requesting-and-integrating-new-features-and-improvements-in-GeoServer<https://urldefense.us/v3/__https:/github.com/geoserver/geoserver/wiki/Successfully-requesting-and-integrating-new-features-and-improvements-in-GeoServer__;!!JRQnnSFuzw7wjAKq6ti6!x6dU_BRgucns55RQEe1mmlGJKjtr9a77Xx94tfHlem858hOV1q3_28L7paxvxRIhBKOXB4hH2ivmUOaXZU8x$>


Geoserver-users@lists.sourceforge.net<mailto:Geoserver-users@lists.sourceforge.net>
https://lists.sourceforge.net/lists/listinfo/geoserver-users<https://urldefense.us/v3/__https:/lists.sourceforge.net/lists/listinfo/geoserver-users__;!!JRQnnSFuzw7wjAKq6ti6!x6dU_BRgucns55RQEe1mmlGJKjtr9a77Xx94tfHlem858hOV1q3_28L7paxvxRIhBKOXB4hH2ivmUFliNefA$>
--
--
Jody Garnett

_______________________________________________
Geoserver-users mailing list

Please make sure you read the following two resources before posting to this 
list:
- Earning your support instead of buying it, but Ian Turton: 
http://www.ianturton.com/talks/foss4g.html#/
- The GeoServer user list posting guidelines: 
http://geoserver.org/comm/userlist-guidelines.html

If you want to request a feature or an improvement, also see this: 
https://github.com/geoserver/geoserver/wiki/Successfully-requesting-and-integrating-new-features-and-improvements-in-GeoServer


Geoserver-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-users

Re: [Geoserver-users] Geoserver 2.21.4 not deploying with Security Manager on JBoss EAP 7.4.9 when upgrading from Java 8 to Java 11

Reply via email to