Gitiles
Code Review Sign In
source.supwisdom.com / UniIdentify / tomcat / 6266f996613ae5631b7288523f895b36e30fe5af / . / tomcat-cas / webapps / docs / security-manager-howto.html
blob: 3d5c52727876ed8c27aa18ee61b8855a0450810f [file] [log] [blame]
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]1<html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 7 (7.0.77) - Security Manager HOW-TO</title><meta name="author" content="Glenn Nielsen"><meta name="author" content="Jean-Francois Arcand"><style type="text/css" media="print">
2 .noPrint {display: none;}
3 td#mainBody {width: 100%;}
4</style><style type="text/css">
5code {background-color:rgb(224,255,255);padding:0 0.1em;}
6code.attributeName, code.propertyName {background-color:transparent;}
7
8
9table {
10 border-collapse: collapse;
11 text-align: left;
12}
13table *:not(table) {
14 /* Prevent border-collapsing for table child elements like <div> */
15 border-collapse: separate;
16}
17
18th {
19 text-align: left;
20}
21
22
23div.codeBox pre code, code.attributeName, code.propertyName, code.noHighlight, .noHighlight code {
24 background-color: transparent;
25}
26div.codeBox {
27 overflow: auto;
28 margin: 1em 0;
29}
30div.codeBox pre {
31 margin: 0;
32 padding: 4px;
33 border: 1px solid #999;
34 border-radius: 5px;
35 background-color: #eff8ff;
36 display: table; /* To prevent <pre>s from taking the complete available width. */
37 /*
38 When it is officially supported, use the following CSS instead of display: table
39 to prevent big <pre>s from exceeding the browser window:
40 max-width: available;
41 width: min-content;
42 */
43}
44
45div.codeBox pre.wrap {
46 white-space: pre-wrap;
47}
48
49
50table.defaultTable tr, table.detail-table tr {
51 border: 1px solid #CCC;
52}
53
54table.defaultTable tr:nth-child(even), table.detail-table tr:nth-child(even) {
55 background-color: #FAFBFF;
56}
57
58table.defaultTable tr:nth-child(odd), table.detail-table tr:nth-child(odd) {
59 background-color: #EEEFFF;
60}
61
62table.defaultTable th, table.detail-table th {
63 background-color: #88b;
64 color: #fff;
65}
66
67table.defaultTable th, table.defaultTable td, table.detail-table th, table.detail-table td {
68 padding: 5px 8px;
69}
70
71
72p.notice {
73 border: 1px solid rgb(255, 0, 0);
74 background-color: rgb(238, 238, 238);
75 color: rgb(0, 51, 102);
76 padding: 0.5em;
77 margin: 1em 2em 1em 1em;
78}
79</style></head><body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76"><table border="0" width="100%" cellspacing="0"><!--PAGE HEADER--><tr><td><!--PROJECT LOGO--><a href="http://tomcat.apache.org/"><img src="./images/tomcat.gif" align="right" alt="
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]80 The Apache Tomcat Servlet/JSP Container
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]81 " border="0"></a></td><td><h1><font face="arial,helvetica,sanserif">Apache Tomcat 7</font></h1><font face="arial,helvetica,sanserif">Version 7.0.77, Mar 28 2017</font></td><td><!--APACHE LOGO--><a href="http://www.apache.org/"><img src="./images/asf-logo.svg" align="right" alt="Apache Logo" border="0" style="width: 266px;height: 83px;"></a></td></tr></table><table border="0" width="100%" cellspacing="4"><!--HEADER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><tr><!--LEFT SIDE NAVIGATION--><td width="20%" valign="top" nowrap class="noPrint"><p><strong>Links</strong></p><ul><li><a href="index.html">Docs Home</a></li><li><a href="http://wiki.apache.org/tomcat/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul><p><strong>User Guide</strong></p><ul><li><a href="introduction.html">1) Introduction</a></li><li><a href="setup.html">2) Setup</a></li><li><a href="appdev/index.html">3) First webapp</a></li><li><a href="deployer-howto.html">4) Deployer</a></li><li><a href="manager-howto.html">5) Manager</a></li><li><a href="realm-howto.html">6) Realms and AAA</a></li><li><a href="security-manager-howto.html">7) Security Manager</a></li><li><a href="jndi-resources-howto.html">8) JNDI Resources</a></li><li><a href="jndi-datasource-examples-howto.html">9) JDBC DataSources</a></li><li><a href="class-loader-howto.html">10) Classloading</a></li><li><a href="jasper-howto.html">11) JSPs</a></li><li><a href="ssl-howto.html">12) SSL/TLS</a></li><li><a href="ssi-howto.html">13) SSI</a></li><li><a href="cgi-howto.html">14) CGI</a></li><li><a href="proxy-howto.html">15) Proxy Support</a></li><li><a href="mbeans-descriptors-howto.html">16) MBeans Descriptors</a></li><li><a href="default-servlet.html">17) Default Servlet</a></li><li><a href="cluster-howto.html">18) Clustering</a></li><li><a href="balancer-howto.html">19) Load Balancer</a></li><li><a href="connectors.html">20) Connectors</a></li><li><a href="monitoring.html">21) Monitoring and Management</a></li><li><a href="logging.html">22) Logging</a></li><li><a href="apr.html">23) APR/Native</a></li><li><a href="virtual-hosting-howto.html">24) Virtual Hosting</a></li><li><a href="aio.html">25) Advanced IO</a></li><li><a href="extras.html">26) Additional Components</a></li><li><a href="maven-jars.html">27) Mavenized</a></li><li><a href="security-howto.html">28) Security Considerations</a></li><li><a href="windows-service-howto.html">29) Windows Service</a></li><li><a href="windows-auth-howto.html">30) Windows Authentication</a></li><li><a href="jdbc-pool.html">31) Tomcat's JDBC Pool</a></li><li><a href="web-socket-howto.html">32) WebSocket</a></li></ul><p><strong>Reference</strong></p><ul><li><a href="RELEASE-NOTES.txt">Release Notes</a></li><li><a href="config/index.html">Configuration</a></li><li><a href="api/index.html">Tomcat Javadocs</a></li><li><a href="servletapi/index.html">Servlet Javadocs</a></li><li><a href="jspapi/index.html">JSP 2.2 Javadocs</a></li><li><a href="elapi/index.html">EL 2.2 Javadocs</a></li><li><a href="websocketapi/index.html">WebSocket 1.1 Javadocs</a></li><li><a href="http://tomcat.apache.org/connectors-doc/">JK 1.2 Documentation</a></li></ul><p><strong>Apache Tomcat Development</strong></p><ul><li><a href="building.html">Building</a></li><li><a href="changelog.html">Changelog</a></li><li><a href="http://wiki.apache.org/tomcat/TomcatVersions">Status</a></li><li><a href="developers.html">Developers</a></li><li><a href="architecture/index.html">Architecture</a></li><li><a href="funcspecs/index.html">Functional Specs.</a></li><li><a href="tribes/introduction.html">Tribes</a></li></ul></td><!--RIGHT SIDE MAIN BODY--><td width="80%" valign="top" align="left" id="mainBody"><h1>Security Manager HOW-TO</h1><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Table of Contents"><!--()--></a><a name="Table_of_Contents"><strong>Table of Contents</strong></a></font></td></tr><tr><td><blockquote>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]82<ul><li><a href="#Background">Background</a></li><li><a href="#Permissions">Permissions</a><ol><li><a href="#Standard_Permissions">Standard Permissions</a></li><li><a href="#Tomcat_Custom_Permissions">Tomcat Custom Permissions</a></li></ol></li><li><a href="#Configuring_Tomcat_With_A_SecurityManager">Configuring Tomcat With A SecurityManager</a></li><li><a href="#Configuring_Package_Protection_in_Tomcat">Configuring Package Protection in Tomcat</a></li><li><a href="#Troubleshooting">Troubleshooting</a></li></ul>
83</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Background"><strong>Background</strong></a></font></td></tr><tr><td><blockquote>
84
85 <p>The Java <strong>SecurityManager</strong> is what allows a web browser
86 to run an applet in its own sandbox to prevent untrusted code from
87 accessing files on the local file system, connecting to a host other
88 than the one the applet was loaded from, and so on. In the same way
89 the SecurityManager protects you from an untrusted applet running in
90 your browser, use of a SecurityManager while running Tomcat can protect
91 your server from trojan servlets, JSPs, JSP beans, and tag libraries.
92 Or even inadvertent mistakes.</p>
93
94 <p>Imagine if someone who is authorized to publish JSPs on your site
95 inadvertently included the following in their JSP:</p>
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]96<div class="codeBox"><pre><code>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]97&lt;% System.exit(1); %&gt;
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]98</code></pre></div>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]99
100 <p>Every time this JSP was executed by Tomcat, Tomcat would exit.
101 Using the Java SecurityManager is just one more line of defense a
102 system administrator can use to keep the server secure and reliable.</p>
103
104 <p><strong>WARNING</strong> - A security audit
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]105 have been conducted using the Tomcat codebase. Most of the critical
106 package have been protected and a new security package protection mechanism
107 has been implemented. Still, make sure that you are satisfied with your SecurityManager
108 configuration before allowing untrusted users to publish web applications,
109 JSPs, servlets, beans, or tag libraries. <strong>However, running with a
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]110 SecurityManager is definitely better than running without one.</strong></p>
111
112</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Permissions"><strong>Permissions</strong></a></font></td></tr><tr><td><blockquote>
113
114 <p>Permission classes are used to define what Permissions a class loaded
115 by Tomcat will have. There are a number of Permission classes that are
116 a standard part of the JDK, and you can create your own Permission class
117 for use in your own web applications. Both techniques are used in
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]118 Tomcat.</p>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]119
120
121 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Standard Permissions"><!--()--></a><a name="Standard_Permissions"><strong>Standard Permissions</strong></a></font></td></tr><tr><td><blockquote>
122
123 <p>This is just a short summary of the standard system SecurityManager
124 Permission classes applicable to Tomcat. See
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]125 <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/">
126 http://docs.oracle.com/javase/7/docs/technotes/guides/security/</a>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]127 for more information.</p>
128
129 <ul>
130 <li><strong>java.util.PropertyPermission</strong> - Controls read/write
131 access to JVM properties such as <code>java.home</code>.</li>
132 <li><strong>java.lang.RuntimePermission</strong> - Controls use of
133 some System/Runtime functions like <code>exit()</code> and
134 <code>exec()</code>. Also control the package access/definition.</li>
135 <li><strong>java.io.FilePermission</strong> - Controls read/write/execute
136 access to files and directories.</li>
137 <li><strong>java.net.SocketPermission</strong> - Controls use of
138 network sockets.</li>
139 <li><strong>java.net.NetPermission</strong> - Controls use of
140 multicast network connections.</li>
141 <li><strong>java.lang.reflect.ReflectPermission</strong> - Controls
142 use of reflection to do class introspection.</li>
143 <li><strong>java.security.SecurityPermission</strong> - Controls access
144 to Security methods.</li>
145 <li><strong>java.security.AllPermission</strong> - Allows access to all
146 permissions, just as if you were running Tomcat without a
147 SecurityManager.</li>
148 </ul>
149
150 </blockquote></td></tr></table>
151
152
153 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Tomcat Custom Permissions"><!--()--></a><a name="Tomcat_Custom_Permissions"><strong>Tomcat Custom Permissions</strong></a></font></td></tr><tr><td><blockquote>
154
155 <p>Tomcat utilizes a custom permission class called
156 <strong>org.apache.naming.JndiPermission</strong>. This permission
157 controls read access to JNDI named file based resources. The permission
158 name is the JNDI name and there are no actions. A trailing "*" can be
159 used to do wild card matching for a JNDI named file resource when
160 granting permission. For example, you might include the following
161 in your policy file:</p>
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]162<div class="codeBox"><pre><code>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]163permission org.apache.naming.JndiPermission "jndi://localhost/examples/*";
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]164</code></pre></div>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]165
166 <p>A Permission entry like this is generated dynamically for each web
167 application that is deployed, to allow it to read its own static resources
168 but disallow it from using file access to read any other files (unless
169 permissions for those files are explicitly granted).</p>
170
171 <p>Also, Tomcat always dynamically creates the following file permissions:</p>
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]172<div class="codeBox"><pre><code>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]173permission java.io.FilePermission "** your application context**", "read";
174
175permission java.io.FilePermission
176 "** application working directory**", "read,write";
177permission java.io.FilePermission
178 "** application working directory**/-", "read,write,delete";
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]179</code></pre></div>
180 <p>Where **your application context** equals the folder (or WAR file) under which
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]181 your application has been deployed and **application working directory** is the
182 temporary directory provided to your application as required by the
183 Servlet Specification.</p>
184
185 </blockquote></td></tr></table>
186
187
188</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Configuring Tomcat With A SecurityManager"><!--()--></a><a name="Configuring_Tomcat_With_A_SecurityManager"><strong>Configuring Tomcat With A SecurityManager</strong></a></font></td></tr><tr><td><blockquote>
189
190 <h3>Policy File Format</h3>
191
192 <p>The security policies implemented by the Java SecurityManager are
193 configured in the <code>$CATALINA_BASE/conf/catalina.policy</code> file.
194 This file completely replaces the <code>java.policy</code> file present
195 in your JDK system directories. The <code>catalina.policy</code> file
196 can be edited by hand, or you can use the
197 <a href="http://docs.oracle.com/javase/6/docs/technotes/guides/security/PolicyGuide.html">policytool</a>
198 application that comes with Java 1.2 or later.</p>
199
200 <p>Entries in the <code>catalina.policy</code> file use the standard
201 <code>java.policy</code> file format, as follows:</p>
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]202<div class="codeBox"><pre><code>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]203// Example policy file entry
204
205grant [signedBy &lt;signer&gt;,] [codeBase &lt;code source&gt;] {
206 permission &lt;class&gt; [&lt;name&gt; [, &lt;action list&gt;]];
207};
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]208</code></pre></div>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]209
210 <p>The <strong>signedBy</strong> and <strong>codeBase</strong> entries are
211 optional when granting permissions. Comment lines begin with "//" and
212 end at the end of the current line. The <code>codeBase</code> is in the
213 form of a URL, and for a file URL can use the <code>${java.home}</code>
214 and <code>${catalina.home}</code> properties (which are expanded out to
215 the directory paths defined for them by the <code>JAVA_HOME</code>,
216 <code>CATALINA_HOME</code> and <code>CATALINA_BASE</code> environment
217 variables).</p>
218
219 <h3>The Default Policy File</h3>
220
221 <p>The default <code>$CATALINA_BASE/conf/catalina.policy</code> file
222 looks like this:</p>
223
224
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]225<div class="codeBox"><pre><code>// Licensed to the Apache Software Foundation (ASF) under one or more
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]226// contributor license agreements. See the NOTICE file distributed with
227// this work for additional information regarding copyright ownership.
228// The ASF licenses this file to You under the Apache License, Version 2.0
229// (the "License"); you may not use this file except in compliance with
230// the License. You may obtain a copy of the License at
231//
232// http://www.apache.org/licenses/LICENSE-2.0
233//
234// Unless required by applicable law or agreed to in writing, software
235// distributed under the License is distributed on an "AS IS" BASIS,
236// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
237// See the License for the specific language governing permissions and
238// limitations under the License.
239
240// ============================================================================
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]241// catalina.policy - Security Policy Permissions for Tomcat 7
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]242//
243// This file contains a default set of security policies to be enforced (by the
244// JVM) when Catalina is executed with the "-security" option. In addition
245// to the permissions granted here, the following additional permissions are
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]246// granted to each web application:
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]247//
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]248// * Read access to the web application's document root directory
249// * Read, write and delete access to the web application's working directory
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]250// ============================================================================
251
252
253// ========== SYSTEM CODE PERMISSIONS =========================================
254
255
256// These permissions apply to javac
257grant codeBase "file:${java.home}/lib/-" {
258 permission java.security.AllPermission;
259};
260
261// These permissions apply to all shared system extensions
262grant codeBase "file:${java.home}/jre/lib/ext/-" {
263 permission java.security.AllPermission;
264};
265
266// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
267grant codeBase "file:${java.home}/../lib/-" {
268 permission java.security.AllPermission;
269};
270
271// These permissions apply to all shared system extensions when
272// ${java.home} points at $JAVA_HOME/jre
273grant codeBase "file:${java.home}/lib/ext/-" {
274 permission java.security.AllPermission;
275};
276
277
278// ========== CATALINA CODE PERMISSIONS =======================================
279
280
281// These permissions apply to the daemon code
282grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
283 permission java.security.AllPermission;
284};
285
286// These permissions apply to the logging API
287// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
288// update this section accordingly.
289// grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
290grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
291 permission java.io.FilePermission
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]292 "${java.home}${file.separator}lib${file.separator}logging.properties", "read";
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]293
294 permission java.io.FilePermission
295 "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
296 permission java.io.FilePermission
297 "${catalina.base}${file.separator}logs", "read, write";
298 permission java.io.FilePermission
299 "${catalina.base}${file.separator}logs${file.separator}*", "read, write";
300
301 permission java.lang.RuntimePermission "shutdownHooks";
302 permission java.lang.RuntimePermission "getClassLoader";
303 permission java.lang.RuntimePermission "setContextClassLoader";
304
305 permission java.util.logging.LoggingPermission "control";
306
307 permission java.util.PropertyPermission "java.util.logging.config.class", "read";
308 permission java.util.PropertyPermission "java.util.logging.config.file", "read";
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]309 permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read";
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]310 permission java.util.PropertyPermission "catalina.base", "read";
311
312 // Note: To enable per context logging configuration, permit read access to
313 // the appropriate file. Be sure that the logging configuration is
314 // secure before enabling such access.
315 // E.g. for the examples web application (uncomment and unwrap
316 // the following to be on a single line):
317 // permission java.io.FilePermission "${catalina.base}${file.separator}
318 // webapps${file.separator}examples${file.separator}WEB-INF
319 // ${file.separator}classes${file.separator}logging.properties", "read";
320};
321
322// These permissions apply to the server startup code
323grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
324 permission java.security.AllPermission;
325};
326
327// These permissions apply to the servlet API classes
328// and those that are shared across all class loaders
329// located in the "lib" directory
330grant codeBase "file:${catalina.home}/lib/-" {
331 permission java.security.AllPermission;
332};
333
334
335// If using a per instance lib directory, i.e. ${catalina.base}/lib,
336// then the following permission will need to be uncommented
337// grant codeBase "file:${catalina.base}/lib/-" {
338// permission java.security.AllPermission;
339// };
340
341
342// ========== WEB APPLICATION PERMISSIONS =====================================
343
344
345// These permissions are granted by default to all web applications
346// In addition, a web application will be given a read FilePermission
347// and JndiPermission for all files and directories in its document root.
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]348grant {
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]349 // Required for JNDI lookup of named JDBC DataSource's and
350 // javamail named MimePart DataSource used to send mail
351 permission java.util.PropertyPermission "java.home", "read";
352 permission java.util.PropertyPermission "java.naming.*", "read";
353 permission java.util.PropertyPermission "javax.sql.*", "read";
354
355 // OS Specific properties to allow read access
356 permission java.util.PropertyPermission "os.name", "read";
357 permission java.util.PropertyPermission "os.version", "read";
358 permission java.util.PropertyPermission "os.arch", "read";
359 permission java.util.PropertyPermission "file.separator", "read";
360 permission java.util.PropertyPermission "path.separator", "read";
361 permission java.util.PropertyPermission "line.separator", "read";
362
363 // JVM properties to allow read access
364 permission java.util.PropertyPermission "java.version", "read";
365 permission java.util.PropertyPermission "java.vendor", "read";
366 permission java.util.PropertyPermission "java.vendor.url", "read";
367 permission java.util.PropertyPermission "java.class.version", "read";
368 permission java.util.PropertyPermission "java.specification.version", "read";
369 permission java.util.PropertyPermission "java.specification.vendor", "read";
370 permission java.util.PropertyPermission "java.specification.name", "read";
371
372 permission java.util.PropertyPermission "java.vm.specification.version", "read";
373 permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
374 permission java.util.PropertyPermission "java.vm.specification.name", "read";
375 permission java.util.PropertyPermission "java.vm.version", "read";
376 permission java.util.PropertyPermission "java.vm.vendor", "read";
377 permission java.util.PropertyPermission "java.vm.name", "read";
378
379 // Required for OpenJMX
380 permission java.lang.RuntimePermission "getAttribute";
381
382 // Allow read of JAXP compliant XML parser debug
383 permission java.util.PropertyPermission "jaxp.debug", "read";
384
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]385 // All JSPs need to be able to read this package
386 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat";
387
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]388 // Precompiled JSPs need access to these packages.
389 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
390 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]391 permission java.lang.RuntimePermission
392 "accessClassInPackage.org.apache.jasper.runtime.*";
393
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]394 // Precompiled JSPs need access to these system properties.
395 permission java.util.PropertyPermission
396 "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]397 permission java.util.PropertyPermission
398 "org.apache.el.parser.COERCE_TO_ZERO", "read";
399
400 // The cookie code needs these.
401 permission java.util.PropertyPermission
402 "org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";
403 permission java.util.PropertyPermission
404 "org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read";
405 permission java.util.PropertyPermission
406 "org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read";
407
408 // Applications using Comet need to be able to access this package
409 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.comet";
410
411 // Applications using the legacy WebSocket implementation need to be able to access this package
412 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.websocket";
413
414 // Applications using the JSR-356 WebSocket implementation need to be able to access these packages
415 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket";
416 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server";
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]417};
418
419
420// The Manager application needs access to the following packages to support the
421// session display functionality. These settings support the following
422// configurations:
423// - default CATALINA_HOME == CATALINA_BASE
424// - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
425// - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
426grant codeBase "file:${catalina.base}/webapps/manager/-" {
427 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]428 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]429 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
430 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]431 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]432};
433grant codeBase "file:${catalina.home}/webapps/manager/-" {
434 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]435 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]436 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
437 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]438 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]439};
440
441// You can assign additional permissions to particular web applications by
442// adding additional "grant" entries here, based on the code base for that
443// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
444//
445// Different permissions can be granted to JSP pages, classes loaded from
446// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
447// directory, or even to individual jar files in the /WEB-INF/lib/ directory.
448//
449// For instance, assume that the standard "examples" application
450// included a JDBC driver that needed to establish a network connection to the
451// corresponding database and used the scrape taglib to get the weather from
452// the NOAA web server. You might create a "grant" entries like this:
453//
454// The permissions granted to the context root directory apply to JSP pages.
455// grant codeBase "file:${catalina.base}/webapps/examples/-" {
456// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
457// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
458// };
459//
460// The permissions granted to the context WEB-INF/classes directory
461// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" {
462// };
463//
464// The permission granted to your JDBC driver
465// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
466// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
467// };
468// The permission granted to the scrape taglib
469// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
470// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
471// };
472
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]473</code></pre></div>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]474
475 <h3>Starting Tomcat With A SecurityManager</h3>
476
477 <p>Once you have configured the <code>catalina.policy</code> file for use
478 with a SecurityManager, Tomcat can be started with a SecurityManager in
479 place by using the "-security" option:</p>
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]480<div class="codeBox"><pre><code>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]481$CATALINA_HOME/bin/catalina.sh start -security (Unix)
482%CATALINA_HOME%\bin\catalina start -security (Windows)
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]483</code></pre></div>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]484
485</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Configuring Package Protection in Tomcat"><!--()--></a><a name="Configuring_Package_Protection_in_Tomcat"><strong>Configuring Package Protection in Tomcat</strong></a></font></td></tr><tr><td><blockquote>
486 <p>Starting with Tomcat 5, it is now possible to configure which Tomcat
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]487 internal package are protected against package definition and access. See
488 <a href="http://www.oracle.com/technetwork/java/seccodeguide-139067.html">
489 http://www.oracle.com/technetwork/java/seccodeguide-139067.html</a>
490 for more information.</p>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]491
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]492
493 <p><strong>WARNING</strong>: Be aware that removing the default package protection
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]494 could possibly open a security hole</p>
495
496 <h3>The Default Properties File</h3>
497
498 <p>The default <code>$CATALINA_BASE/conf/catalina.properties</code> file
499 looks like this:</p>
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]500<div class="codeBox"><pre><code>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]501#
502# List of comma-separated packages that start with or equal this string
503# will cause a security exception to be thrown when
504# passed to checkPackageAccess unless the
505# corresponding RuntimePermission ("accessClassInPackage."+package) has
506# been granted.
507package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,
508org.apache.jasper.
509#
510# List of comma-separated packages that start with or equal this string
511# will cause a security exception to be thrown when
512# passed to checkPackageDefinition unless the
513# corresponding RuntimePermission ("defineClassInPackage."+package) has
514# been granted.
515#
516# by default, no packages are restricted for definition, and none of
517# the class loaders supplied with the JDK call checkPackageDefinition.
518#
519package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,
520org.apache.tomcat.,org.apache.jasper.
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]521</code></pre></div>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]522 <p>Once you have configured the <code>catalina.properties</code> file for use
523 with a SecurityManager, remember to re-start Tomcat.</p>
524</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Troubleshooting"><strong>Troubleshooting</strong></a></font></td></tr><tr><td><blockquote>
525
526 <p>If your web application attempts to execute an operation that is
527 prohibited by lack of a required Permission, it will throw an
528 <code>AccessControLException</code> or a <code>SecurityException</code>
529 when the SecurityManager detects the violation. Debugging the permission
530 that is missing can be challenging, and one option is to turn on debug
531 output of all security decisions that are made during execution. This
532 is done by setting a system property before starting Tomcat. The easiest
533 way to do this is via the <code>CATALINA_OPTS</code> environment variable.
534 Execute this command:</p>
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]535<div class="codeBox"><pre><code>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]536export CATALINA_OPTS=-Djava.security.debug=all (Unix)
537set CATALINA_OPTS=-Djava.security.debug=all (Windows)
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]538</code></pre></div>
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]539
540 <p>before starting Tomcat.</p>
541
542 <p><strong>WARNING</strong> - This will generate <em>many megabytes</em>
543 of output! However, it can help you track down problems by searching
544 for the word "FAILED" and determining which permission was being checked
545 for. See the Java security documentation for more options that you can
546 specify here as well.</p>
547
刘洪青6266f992017-05-15 21:21:03 +0800[diff] [blame^]548</blockquote></td></tr></table></td></tr><tr class="noPrint"><td width="20%" valign="top" nowrap class="noPrint"></td><td width="80%" valign="top" align="left"><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="comments_section" id="comments_section"><strong>Comments</strong></a></font></td></tr><tr><td><blockquote><p class="notice"><strong>Notice: </strong>This comments section collects your suggestions
549 on improving documentation for Apache Tomcat.<br><br>
550 If you have trouble and need help, read
551 <a href="http://tomcat.apache.org/findhelp.html">Find Help</a> page
552 and ask your question on the tomcat-users
553 <a href="http://tomcat.apache.org/lists.html">mailing list</a>.
554 Do not ask such questions here. This is not a Q&amp;A section.<br><br>
555 The Apache Comments System is explained <a href="./comments.html">here</a>.
556 Comments may be removed by our moderators if they are either
557 implemented or considered invalid/off-topic.</p><script type="text/javascript"><!--//--><![CDATA[//><!--
558 var comments_shortname = 'tomcat';
559 var comments_identifier = 'http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html';
560 (function(w, d) {
561 if (w.location.hostname.toLowerCase() == "tomcat.apache.org") {
562 d.write('<div id="comments_thread"><\/div>');
563 var s = d.createElement('script');
564 s.type = 'text/javascript';
565 s.async = true;
566 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
567 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
568 }
569 else {
570 d.write('<div id="comments_thread"><strong>Comments are disabled for this page at the moment.<\/strong><\/div>');
571 }
572 })(window, document);
573 //--><!]]></script></blockquote></td></tr></table></td></tr><!--FOOTER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><!--PAGE FOOTER--><tr><td colspan="2"><div align="center"><font color="#525D76" size="-1"><em>
574 Copyright &copy; 1999-2017, Apache Software Foundation
Hongqing Liufd5ee812014-05-10 16:32:51 +0800[diff] [blame]575 </em></font></div></td></tr></table></body></html>