Hi there, I installed tomcat5 via Fink on Snow Leopard 10.6.1 kernel 64 bits:
amadeus[2249]:/sw/var/log/tomcat5% $CATALINA_HOME/bin/catalina.sh version Using CATALINA_BASE: /sw/var/tomcat5 Using CATALINA_HOME: /sw/var/tomcat5 Using CATALINA_TMPDIR: /sw/var/tomcat5/temp Using JRE_HOME: /Library/Java/Home Server version: Apache Tomcat/5.5.26 Server built: Jan 28 2008 01:35:23 Server number: 5.5.26.0 OS Name: Mac OS X OS Version: 10.6.1 Architecture: x86_64 JVM Version: 1.6.0_15-b03-219 JVM Vendor: Apple Inc. Tomcat's webapps examples works fine, but then I wanted to use security manager. I put that: export CATALINA_OPTS="-DTOMCAT5LAUNCH=true -Djava.security.manager -Djava.security.policy=$CATALINA_HOME/conf/catalina.policy" then it still works but I don't like what I see in log catalina.out: 2009-09-22 16:34:41.010 java[24510:1603] CFPreferences: user home directory at file://localhost/sw/var/empty/ is unavailable. User domains will be volatile. Could not load Logmanager "org.apache.juli.ClassLoaderLogManager" java.security.AccessControlException: access denied (java.lang.RuntimePermission setContextClassLoader) at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323) at java.security.AccessController.checkPermission(AccessController.java:546) [snip] at org.apache.catalina.startup.Bootstrap.<clinit>(Bootstrap.java:54) Can't load log handler "1catalina.org.apache.juli.FileHandler" java.lang.ClassNotFoundException: 1catalina.org.apache.juli.FileHandler java.lang.ClassNotFoundException: 1catalina.org.apache.juli.FileHandler at java.net.URLClassLoader$1.run(URLClassLoader.java:200) [snip] My catalina.policy is this (didn't touch it yet): // These permissions apply to javac grant codeBase "file:${java.home}/lib/-" { permission java.security.AllPermission; }; // These permissions apply to all shared system extensions grant codeBase "file:${java.home}/jre/lib/ext/-" { permission java.security.AllPermission; }; // These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre grant codeBase "file:${java.home}/../lib/-" { permission java.security.AllPermission; }; // These permissions apply to all shared system extensions when // ${java.home} points at $JAVA_HOME/jre grant codeBase "file:${java.home}/lib/ext/-" { permission java.security.AllPermission; }; // ========== CATALINA CODE PERMISSIONS ======================================= // These permissions apply to the launcher code grant codeBase "file:${catalina.home}/bin/commons-launcher.jar" { permission java.security.AllPermission; }; // These permissions apply to the daemon code grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { permission java.security.AllPermission; }; // These permissions apply to the commons-logging API grant codeBase "file:${catalina.home}/bin/commons-logging-api.jar" { permission java.security.AllPermission; }; // These permissions apply to the server startup code grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { permission java.security.AllPermission; }; // These permissions apply to the JMX server grant codeBase "file:${catalina.home}/bin/jmx.jar" { permission java.security.AllPermission; }; // These permissions apply to JULI grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { permission java.util.PropertyPermission "java.util.logging.config.class", "read"; permission java.util.PropertyPermission "java.util.logging.config.file", "read"; permission java.lang.RuntimePermission "shutdownHooks"; permission java.io.FilePermission "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read"; permission java.util.PropertyPermission "catalina.base", "read"; permission java.util.logging.LoggingPermission "control"; permission java.io.FilePermission "${catalina.base}${file.separator}logs", "read, write"; permission java.io.FilePermission "${catalina.base}${file.separator}logs${file.separator}*", "read, write"; permission java.lang.RuntimePermission "getClassLoader"; // To enable per context logging configuration, permit read access to the appropriate file. // Be sure that the logging configuration is secure before enabling such access // eg for the examples web application: // permission java.io.FilePermission "${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties", "read"; }; // These permissions apply to the servlet API classes // and those that are shared across all class loaders // located in the "common" directory grant codeBase "file:${catalina.home}/common/-" { permission java.security.AllPermission; }; // These permissions apply to the container's core code, plus any additional // libraries installed in the "server" directory grant codeBase "file:${catalina.home}/server/-" { permission java.security.AllPermission; }; // The permissions granted to the balancer WEB-INF/classes and WEB-INF/lib directory grant codeBase "file:${catalina.home}/webapps/balancer/-" { permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.util.digester"; permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.util.digester.*"; }; // ========== WEB APPLICATION PERMISSIONS ===================================== // These permissions are granted by default to all web applications // In addition, a web application will be given a read FilePermission // and JndiPermission for all files and directories in its document root. grant { // Required for JNDI lookup of named JDBC DataSource's and // javamail named MimePart DataSource used to send mail permission java.util.PropertyPermission "java.home", "read"; permission java.util.PropertyPermission "java.naming.*", "read"; permission java.util.PropertyPermission "javax.sql.*", "read"; // OS Specific properties to allow read access permission java.util.PropertyPermission "os.name", "read"; permission java.util.PropertyPermission "os.version", "read"; permission java.util.PropertyPermission "os.arch", "read"; permission java.util.PropertyPermission "file.separator", "read"; permission java.util.PropertyPermission "path.separator", "read"; permission java.util.PropertyPermission "line.separator", "read"; // JVM properties to allow read access permission java.util.PropertyPermission "java.version", "read"; permission java.util.PropertyPermission "java.vendor", "read"; permission java.util.PropertyPermission "java.vendor.url", "read"; permission java.util.PropertyPermission "java.class.version", "read"; permission java.util.PropertyPermission "java.specification.version", "read"; permission java.util.PropertyPermission "java.specification.vendor", "read"; permission java.util.PropertyPermission "java.specification.name", "read"; permission java.util.PropertyPermission "java.vm.specification.version", "read"; permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; permission java.util.PropertyPermission "java.vm.specification.name", "read"; permission java.util.PropertyPermission "java.vm.version", "read"; permission java.util.PropertyPermission "java.vm.vendor", "read"; permission java.util.PropertyPermission "java.vm.name", "read"; // Required for OpenJMX permission java.lang.RuntimePermission "getAttribute"; // Allow read of JAXP compliant XML parser debug permission java.util.PropertyPermission "jaxp.debug", "read"; // Precompiled JSPs need access to this package. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime"; permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*"; // Precompiled JSPs need access to this system property. permission java.util.PropertyPermission "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read"; }; Any help would be more than appreciated. Many thanks in advance, Alan --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org