Re: DO NOT REPLY [Bug 13907] - security manager does not give read permission on a context by default

[Aditya]

Glenn,

On Fri, Oct 25, 2002 at 08:40:28AM -0500, Glenn Nielsen wrote:
> I suspect that for some reason the Context does not have a context 
> directory.  Add

FWIW, I'm not running the context from a WAR file -- it's just the examples
context that comes with the default install.

> String docBase = context.getRealPath("/"); to your test jsp and see if it 
> returns null.

could you fully qualify the "context" Class -- if it's the same as:

  pageContext.getServletContext().getRealPath("/");

then docBase returns /usr/local/tomcat/webapps/examples/ correctly. ie. if I
have just the following in the JSP:

  String fullPath = pageContext.getServletContext().getRealPath("/test2.new");
  out.println("fullPath: " + fullPath);

  String docBase = pageContext.getServletContext().getRealPath("/");
  out.println("docBase: " + docBase);

I correctly get:

  fullPath: /usr/local/tomcat/webapps/examples/test2.new
  docBase: /usr/local/tomcat/webapps/examples/

however when I add:

  java.io.File foo = new java.io.File(fullPath);
  if (foo.exists())
out.println("Exists: " + fullPath);
else {
out.println("does not exist");
}

to the JSP I get the old:

  java.io.FilePermission /usr/local/tomcat/webapps/examples/test2.new read

the debug output is appended below (let me know if you want more) -- I set all
the debug flats in server.xml to 9.

> Also try setting the debug attributes in your server.xml to 9 and capture 
> the debug output.

from localhost_examples_log:

2002-10-25 14:25:19 Authenticator[/examples]: Security checking request GET
/examples/jsp/test.jsp
2002-10-25 14:25:19 Authenticator[/examples]:  Checking constraint
'SecurityConstraint[Protected Area]' against GET /jsp/test.jsp --> false
2002-10-25 14:25:19 Authenticator[/examples]:  No applicable constraint
located
2002-10-25 14:25:19 Authenticator[/examples]:  Not subject to any constraint
2002-10-25 14:25:19 StandardContext[/examples]: Mapping
contextPath='/examples' with requestURI='/examples/jsp/test.jsp' and
relativeURI='/jsp/test.jsp'
2002-10-25 14:25:19 StandardContext[/examples]:   Trying exact match
2002-10-25 14:25:19 StandardContext[/examples]:   Trying prefix match
2002-10-25 14:25:19 StandardContext[/examples]:   Trying extension match
2002-10-25 14:25:19 StandardContext[/examples]:  Mapped to servlet 'jsp' with
servlet path '/jsp/test.jsp' and path info 'null' and update=true
2002-10-25 14:25:27 StandardWrapperValve[jsp]: Servlet.service() for servlet
jsp threw exception
org.apache.jasper.JasperException: access denied (java.io.FilePermission
/usr/local/tomcat/webapps/examples/test2.new read)
at
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:248)
at
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:289)
at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:240)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:247)
at
org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:98)
at
org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:176)
at java.security.AccessController.doPrivileged(Native Method)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:172)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:260)
at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at
org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at
org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:471)
at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
at
org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at
org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at
org.apache.catalina.core.StandardContext.invoke(StandardContext.java:2396)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:180)
at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at
org.apache.catalina.valves.ErrorDispatcherValve.invoke(ErrorDispatcherValve.java:170)
at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
at
org.apache.catalina.valves.ErrorReportValve.i

Re: DO NOT REPLY [Bug 13907] - security manager does not give read permission on a context by default

[Aditya]

Glenn,

On Thu, Oct 24, 2002 at 10:03:47AM -, [EMAIL PROTECTED] wrote:
> This must be a problem in your local system configuration.
> Check the unix file ownerhsip and permissions for test2.new.

I've done that and the fact is that it works fine without the security manager
so it's not a unix file ownership and permissions problem.

> Also try running Tomcat with java property -Djava.security.debug=access,failure
> defined and then check the security manager debug output.

yup, done that and the output has nothing more than the failure of read
permissions.

> I just tested the jsp you posted with a fresh build of Tomcat 4.1 from
> the CVS head (What will be Tomcat 4.1.13) and Jasper 2.  The FilePermission
> read for the context directory is being granted automatically and the JSP works.

I just read the 4.1.13 announcement from Remy and it has the following note:

 IMPORTANT NOTE: Security manager functionality is broken in this
 milestone. This will be fixed in the next milestone. This milestone will
 not be proposed for official release, and should be used for testing
 purposes only.

so before I checkout a fresh copy from CVS, need I be worried about this?

Thanks,
Adi

--
To unsubscribe, e-mail:   
For additional commands, e-mail: 

DO NOT REPLY [Bug 13907] - security manager does not give read permission on a context by default

[bugzilla]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=13907

security manager does not give read permission on a context by default

[EMAIL PROTECTED] changed:

   What|Removed |Added

 Status|REOPENED|RESOLVED
 Resolution||WORKSFORME



--- Additional Comments From [EMAIL PROTECTED]  2002-10-24 10:03 ---
I just tested the jsp you posted with a fresh build of Tomcat 4.1 from
the CVS head (What will be Tomcat 4.1.13) and Jasper 2.  The FilePermission
read for the context directory is being granted automatically and the JSP works.

This must be a problem in your local system configuration.
Check the unix file ownerhsip and permissions for test2.new.
Also try running Tomcat with java property -Djava.security.debug=access,failure
defined and then check the security manager debug output.

One final note, I would not grant the permission
java.io.FilePermission "<>, "read";
to a web application, I would consider that a security risk.

--
To unsubscribe, e-mail:   
For additional commands, e-mail: 

DO NOT REPLY [Bug 13907] - security manager does not give read permission on a context by default

[bugzilla]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=13907

security manager does not give read permission on a context by default





--- Additional Comments From [EMAIL PROTECTED]  2002-10-23 21:43 ---
You are correct.  The behavior should be for the container to programmatically 
grant a file read permission for a context's codebase in the context's docBase 
directory (and all subdirectories).  You do not need to explicitly grant the 
each app a file read permission explicitly, unless you need to read outside of 
the docBase directory.  I can confirm that Tomcat 4.0.2b1 - 4.0.5 behaves this 
way, and I believe 4.1.x is supposed to.  If not, it's a bug.

--
To unsubscribe, e-mail:   
For additional commands, e-mail: 

DO NOT REPLY [Bug 13907] - security manager does not give read permission on a context by default

[bugzilla]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=13907

security manager does not give read permission on a context by default

[EMAIL PROTECTED] changed:

   What|Removed |Added

 Status|RESOLVED|REOPENED
 Resolution|INVALID |



--- Additional Comments From [EMAIL PROTECTED]  2002-10-23 21:31 ---
uh, according to the comments in catalina.policy (in two different places) and the 
behaviour in 4.0.3 (and I see no change in either the comments or the release notes 
about this changing in 4.1.12) the security manager is supposed to give read 
permissions on the webapp to each context. So is there documentation missing or is 
it a bug?:

// == WEB APPLICATION PERMISSIONS 
=


// These permissions are granted by default to all web applications
// In addition, a web application will be given a read FilePermission
// and JndiPermission for all files and directories in its document root.


// This file contains a default set of security policies to be enforced (by the
// JVM) when Catalina is executed with the "-security" option.  In addition
// to the permissions granted here, the following additional permissions are
// granted to the codebase specific to each web application:
//
// * Read access to the document root directory

--
To unsubscribe, e-mail:   
For additional commands, e-mail: 

DO NOT REPLY [Bug 13907] - security manager does not give read permission on a context by default

[bugzilla]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=13907

security manager does not give read permission on a context by default

[EMAIL PROTECTED] changed:

   What|Removed |Added

 Status|NEW |RESOLVED
 Resolution||INVALID



--- Additional Comments From [EMAIL PROTECTED]  2002-10-23 21:20 ---
That's the proper behaviour. You need to grant your app in catalina.policy file:


// The permissions granted to the context WEB-INF/classes directory
 grant codeBase "file:${catalina.home}/webapps/examples/-" {
  permission java.io.FilePermission "<>, "read";
 };

Look at your catalina.policy file :-)

-- Jeanfrancois

--
To unsubscribe, e-mail:   
For additional commands, e-mail: