[
https://issues.apache.org/jira/browse/LOG4J2-348?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Gary Gregory updated LOG4J2-348:
--------------------------------
Fix Version/s: (was: 2.2)
2.2.1
> Java2 Security for OSGi Bundles
> -------------------------------
>
> Key: LOG4J2-348
> URL: https://issues.apache.org/jira/browse/LOG4J2-348
> Project: Log4j 2
> Issue Type: Improvement
> Components: API, Appenders, Core, JCL Bridge, log4j 1.2 emulation
> Affects Versions: 2.0
> Environment: OSGi / Apache Felix 4.x
> Reporter: Roland Weiglhofer
> Assignee: Matt Sicker
> Priority: Minor
> Labels: OSGi, Security
> Fix For: 2.2.1
>
>
> OSGi defines permissions for bundles. Bundles should have only those
> permissions that they need to function. This is very easy to implement. Just
> add a directory OSGI-INF in the jar and include the file permissions.perm.
> Here are some examples
> (org.osgi.framework.PackagePermission "package name" "import")
> (org.osgi.framework.PackagePermission "package name" "export")
> (org.osgi.framework.BundlePermission "groupID.artifactID of Host" "host");
> (org.osgi.framework.ServicePermission "class name" "get")
> (org.osgi.framework.ServicePermission "class name" "register")
> (org.osgi.framework.ConfigurationPermission * "configure")
> (org.osgi.framework.AdminPermission * "metadata")
> pom
> ...
> <build>
> <resources>
> <resource>
> <directory>OSGI-INF/</directory>
> <filtering>true</filtering>
> <includes>
> <include>permissions.perm</include>
> </includes>
> </resource>
> </resources>
> <plugins>
> <plugin>
> <groupId>org.apache.felix</groupId>
> <artifactId>maven-bundle-plugin</artifactId>
> ...
> <configuration>
> ...
> <instructions>
> ...
> <Include-Resource>
> {maven-resources},
> OSGI-INF/=OSGI-INF/
> </Include-Resource>
> ...
> </instructions>
> ...
> </configuration>
> ...
> </plugin>
> ...
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: log4j-dev-unsubscr...@logging.apache.org
For additional commands, e-mail: log4j-dev-h...@logging.apache.org
