|
| 1 | +// Licensed to the Apache Software Foundation (ASF) under one or more |
| 2 | +// contributor license agreements. See the NOTICE file distributed with |
| 3 | +// this work for additional information regarding copyright ownership. |
| 4 | +// The ASF licenses this file to You under the Apache License, Version 2.0 |
| 5 | +// (the "License"); you may not use this file except in compliance with |
| 6 | +// the License. You may obtain a copy of the License at |
| 7 | +// |
| 8 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +// |
| 10 | +// Unless required by applicable law or agreed to in writing, software |
| 11 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +// See the License for the specific language governing permissions and |
| 14 | +// limitations under the License. |
| 15 | + |
| 16 | +// ============================================================================ |
| 17 | +// catalina.policy - Security Policy Permissions for tc Server Runtime 8.0 |
| 18 | +// |
| 19 | +// This file contains a default set of security policies to be enforced (by the |
| 20 | +// JVM) when Catalina is executed with the "-security" option. In addition |
| 21 | +// to the permissions granted here, the following additional permissions are |
| 22 | +// granted to each web application: |
| 23 | +// |
| 24 | +// * Read access to its document root directory |
| 25 | +// * Read, write and delete access to its working directory |
| 26 | +// ============================================================================ |
| 27 | + |
| 28 | + |
| 29 | +// ========== SYSTEM CODE PERMISSIONS ========================================= |
| 30 | + |
| 31 | + |
| 32 | +// These permissions apply to javac |
| 33 | +grant codeBase "file:${java.home}/lib/-" { |
| 34 | + permission java.security.AllPermission; |
| 35 | +}; |
| 36 | + |
| 37 | +// These permissions apply to all shared system extensions |
| 38 | +grant codeBase "file:${java.home}/jre/lib/ext/-" { |
| 39 | + permission java.security.AllPermission; |
| 40 | +}; |
| 41 | + |
| 42 | +// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre |
| 43 | +grant codeBase "file:${java.home}/../lib/-" { |
| 44 | + permission java.security.AllPermission; |
| 45 | +}; |
| 46 | + |
| 47 | +// These permissions apply to all shared system extensions when |
| 48 | +// ${java.home} points at $JAVA_HOME/jre |
| 49 | +grant codeBase "file:${java.home}/lib/ext/-" { |
| 50 | + permission java.security.AllPermission; |
| 51 | +}; |
| 52 | + |
| 53 | +// ========== tc Server Service Wrapper Permissions =========================== |
| 54 | + |
| 55 | +grant codeBase "file:${catalina.base}/bin/winx86_64/-" { |
| 56 | + permission java.security.AllPermission; |
| 57 | +}; |
| 58 | +grant codeBase "file:${catalina.base}/bin/win32/-" { |
| 59 | + permission java.security.AllPermission; |
| 60 | +}; |
| 61 | + |
| 62 | +// ========== CATALINA CODE PERMISSIONS ======================================= |
| 63 | + |
| 64 | + |
| 65 | +// These permissions apply to the daemon code |
| 66 | +grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { |
| 67 | + permission java.security.AllPermission; |
| 68 | +}; |
| 69 | + |
| 70 | +// These permissions apply to the logging API |
| 71 | +// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home}, |
| 72 | +// update this section accordingly. |
| 73 | +// grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..} |
| 74 | +grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { |
| 75 | + permission java.io.FilePermission |
| 76 | + "${java.home}${file.separator}lib${file.separator}logging.properties", "read"; |
| 77 | + |
| 78 | + permission java.io.FilePermission |
| 79 | + "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read"; |
| 80 | + permission java.io.FilePermission |
| 81 | + "${catalina.base}${file.separator}logs", "read, write"; |
| 82 | + permission java.io.FilePermission |
| 83 | + "${catalina.base}${file.separator}logs${file.separator}*", "read, write"; |
| 84 | + |
| 85 | + permission java.lang.RuntimePermission "shutdownHooks"; |
| 86 | + permission java.lang.RuntimePermission "getClassLoader"; |
| 87 | + permission java.lang.RuntimePermission "setContextClassLoader"; |
| 88 | + |
| 89 | + permission java.lang.management.ManagementPermission "monitor"; |
| 90 | + |
| 91 | + permission java.util.logging.LoggingPermission "control"; |
| 92 | + |
| 93 | + permission java.util.PropertyPermission "java.util.logging.config.class", "read"; |
| 94 | + permission java.util.PropertyPermission "java.util.logging.config.file", "read"; |
| 95 | + permission java.util.PropertyPermission "org.apache.juli.AsyncLoggerPollInterval", "read"; |
| 96 | + permission java.util.PropertyPermission "org.apache.juli.AsyncMaxRecordCount", "read"; |
| 97 | + permission java.util.PropertyPermission "org.apache.juli.AsyncOverflowDropType", "read"; |
| 98 | + permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read"; |
| 99 | + permission java.util.PropertyPermission "catalina.base", "read"; |
| 100 | + |
| 101 | + // tc Server specific permissions |
| 102 | + permission java.util.PropertyPermission "com.springsource.tcserver.serviceability.logging.jmxdelay", "read"; |
| 103 | + permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; |
| 104 | + permission javax.management.MBeanServerPermission "createMBeanServer"; |
| 105 | + permission javax.management.MBeanPermission "com.springsource.tcserver.serviceability.logging.TcServerLogManager#-[tcServer:name=LoggingManager,type=Serviceability]", "registerMBean"; |
| 106 | + permission javax.management.MBeanTrustPermission "register"; |
| 107 | + |
| 108 | + // Note: To enable per context logging configuration, permit read access to |
| 109 | + // the appropriate file. Be sure that the logging configuration is |
| 110 | + // secure before enabling such access. |
| 111 | + // E.g. for the examples web application (uncomment and unwrap |
| 112 | + // the following to be on a single line): |
| 113 | + // permission java.io.FilePermission "${catalina.base}${file.separator} |
| 114 | + // webapps${file.separator}examples${file.separator}WEB-INF |
| 115 | + // ${file.separator}classes${file.separator}logging.properties", "read"; |
| 116 | +}; |
| 117 | + |
| 118 | +// These permissions apply to the server startup code |
| 119 | +grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { |
| 120 | + permission java.security.AllPermission; |
| 121 | +}; |
| 122 | + |
| 123 | +// These permissions apply to the servlet API classes |
| 124 | +// and those that are shared across all class loaders |
| 125 | +// located in the "lib" directory |
| 126 | +grant codeBase "file:${catalina.home}/lib/-" { |
| 127 | + permission java.security.AllPermission; |
| 128 | +}; |
| 129 | + |
| 130 | + |
| 131 | +// If using a per instance lib directory, i.e. ${catalina.base}/lib, |
| 132 | +// then the following permission will need to be uncommented |
| 133 | +// grant codeBase "file:${catalina.base}/lib/-" { |
| 134 | +// permission java.security.AllPermission; |
| 135 | +// }; |
| 136 | + |
| 137 | + |
| 138 | +// ========== WEB APPLICATION PERMISSIONS ===================================== |
| 139 | + |
| 140 | + |
| 141 | +// These permissions are granted by default to all web applications |
| 142 | +// In addition, a web application will be given a read FilePermission |
| 143 | +// for all files and directories in its document root. |
| 144 | +grant { |
| 145 | + // Required for JNDI lookup of named JDBC DataSource's and |
| 146 | + // javamail named MimePart DataSource used to send mail |
| 147 | + permission java.util.PropertyPermission "java.home", "read"; |
| 148 | + permission java.util.PropertyPermission "java.naming.*", "read"; |
| 149 | + permission java.util.PropertyPermission "javax.sql.*", "read"; |
| 150 | + |
| 151 | + // OS Specific properties to allow read access |
| 152 | + permission java.util.PropertyPermission "os.name", "read"; |
| 153 | + permission java.util.PropertyPermission "os.version", "read"; |
| 154 | + permission java.util.PropertyPermission "os.arch", "read"; |
| 155 | + permission java.util.PropertyPermission "file.separator", "read"; |
| 156 | + permission java.util.PropertyPermission "path.separator", "read"; |
| 157 | + permission java.util.PropertyPermission "line.separator", "read"; |
| 158 | + |
| 159 | + // JVM properties to allow read access |
| 160 | + permission java.util.PropertyPermission "java.version", "read"; |
| 161 | + permission java.util.PropertyPermission "java.vendor", "read"; |
| 162 | + permission java.util.PropertyPermission "java.vendor.url", "read"; |
| 163 | + permission java.util.PropertyPermission "java.class.version", "read"; |
| 164 | + permission java.util.PropertyPermission "java.specification.version", "read"; |
| 165 | + permission java.util.PropertyPermission "java.specification.vendor", "read"; |
| 166 | + permission java.util.PropertyPermission "java.specification.name", "read"; |
| 167 | + |
| 168 | + permission java.util.PropertyPermission "java.vm.specification.version", "read"; |
| 169 | + permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; |
| 170 | + permission java.util.PropertyPermission "java.vm.specification.name", "read"; |
| 171 | + permission java.util.PropertyPermission "java.vm.version", "read"; |
| 172 | + permission java.util.PropertyPermission "java.vm.vendor", "read"; |
| 173 | + permission java.util.PropertyPermission "java.vm.name", "read"; |
| 174 | + |
| 175 | + // Required for OpenJMX |
| 176 | + permission java.lang.RuntimePermission "getAttribute"; |
| 177 | + |
| 178 | + // Allow read of JAXP compliant XML parser debug |
| 179 | + permission java.util.PropertyPermission "jaxp.debug", "read"; |
| 180 | + |
| 181 | + // All JSPs need to be able to read this package |
| 182 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat"; |
| 183 | + |
| 184 | + // Precompiled JSPs need access to these packages. |
| 185 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el"; |
| 186 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime"; |
| 187 | + permission java.lang.RuntimePermission |
| 188 | + "accessClassInPackage.org.apache.jasper.runtime.*"; |
| 189 | + |
| 190 | + // Precompiled JSPs need access to these system properties. |
| 191 | + permission java.util.PropertyPermission |
| 192 | + "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read"; |
| 193 | + permission java.util.PropertyPermission |
| 194 | + "org.apache.el.parser.COERCE_TO_ZERO", "read"; |
| 195 | + |
| 196 | + // The cookie code needs these. |
| 197 | + permission java.util.PropertyPermission |
| 198 | + "org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read"; |
| 199 | + permission java.util.PropertyPermission |
| 200 | + "org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read"; |
| 201 | + permission java.util.PropertyPermission |
| 202 | + "org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read"; |
| 203 | + |
| 204 | + // Applications using Comet need to be able to access this package |
| 205 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.comet"; |
| 206 | + |
| 207 | + // Applications using WebSocket need to be able to access these packages |
| 208 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket"; |
| 209 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server"; |
| 210 | +}; |
| 211 | + |
| 212 | + |
| 213 | +// The Manager application needs access to the following packages to support the |
| 214 | +// session display functionality |
| 215 | +// Note: If the manager web application used by this instance is located outside |
| 216 | +// of the webapps directory then the codeBase in the grant below will need |
| 217 | +// to be updated accordingly |
| 218 | +grant codeBase "file:${catalina.base}/webapps/manager/-" { |
| 219 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina"; |
| 220 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session"; |
| 221 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager"; |
| 222 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util"; |
| 223 | + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util"; |
| 224 | +}; |
| 225 | + |
| 226 | +// You can assign additional permissions to particular web applications by |
| 227 | +// adding additional "grant" entries here, based on the code base for that |
| 228 | +// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. |
| 229 | +// |
| 230 | +// Different permissions can be granted to JSP pages, classes loaded from |
| 231 | +// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/ |
| 232 | +// directory, or even to individual jar files in the /WEB-INF/lib/ directory. |
| 233 | +// |
| 234 | +// For instance, assume that the standard "examples" application |
| 235 | +// included a JDBC driver that needed to establish a network connection to the |
| 236 | +// corresponding database and used the scrape taglib to get the weather from |
| 237 | +// the NOAA web server. You might create a "grant" entries like this: |
| 238 | +// |
| 239 | +// The permissions granted to the context root directory apply to JSP pages. |
| 240 | +// grant codeBase "file:${catalina.base}/webapps/examples/-" { |
| 241 | +// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; |
| 242 | +// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; |
| 243 | +// }; |
| 244 | +// |
| 245 | +// The permissions granted to the context WEB-INF/classes directory |
| 246 | +// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" { |
| 247 | +// }; |
| 248 | +// |
| 249 | +// The permission granted to your JDBC driver |
| 250 | +// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" { |
| 251 | +// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; |
| 252 | +// }; |
| 253 | +// The permission granted to the scrape taglib |
| 254 | +// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { |
| 255 | +// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; |
| 256 | +// }; |
| 257 | + |
0 commit comments