Gitiles
Code Review Sign In
source.supwisdom.com / portal_platform / tomcat-cms / 07b3087b89f4c23810bb2a7902fe5a06f392b984 / . / webapps / docs / security-manager-howto.html
blob: 2172e68ab111edbdff5023acc0f35ca412a8d188 [file] [log] [blame]
Cheng Tang07b30872014-04-27 16:37:18 +0800[diff] [blame^]1<html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 7 (7.0.42) - Security Manager HOW-TO</title><meta name="author" content="Glenn Nielsen"><meta name="author" content="Jean-Francois Arcand"><style type="text/css" media="print">
2 .noPrint {display: none;}
3 td#mainBody {width: 100%;}
4 </style><style type="text/css">
5 code {background-color:rgb(224,255,255);padding:0 0.1em;}
6 code.attributeName, code.propertyName {background-color:transparent;}
7 </style><style type="text/css">
8 .wrapped-source code { display: block; background-color: transparent; }
9 .wrapped-source div { margin: 0 0 0 1.25em; }
10 .wrapped-source p { margin: 0 0 0 1.25em; text-indent: -1.25em; }
11 </style><style type="text/css">
12 p.notice {
13 border: 1px solid rgb(255, 0, 0);
14 background-color: rgb(238, 238, 238);
15 color: rgb(0, 51, 102);
16 padding: 0.5em;
17 margin: 1em 2em 1em 1em;
18 }
19 </style></head><body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76"><table border="0" width="100%" cellspacing="0"><!--PAGE HEADER--><tr><td><!--PROJECT LOGO--><a href="http://tomcat.apache.org/"><img src="./images/tomcat.gif" align="right" alt="
20 The Apache Tomcat Servlet/JSP Container
21 " border="0"></a></td><td><h1><font face="arial,helvetica,sanserif">Apache Tomcat 7</font></h1><font face="arial,helvetica,sanserif">Version 7.0.42, Jul 2 2013</font></td><td><!--APACHE LOGO--><a href="http://www.apache.org/"><img src="./images/asf-logo.gif" align="right" alt="Apache Logo" border="0"></a></td></tr></table><table border="0" width="100%" cellspacing="4"><!--HEADER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><tr><!--LEFT SIDE NAVIGATION--><td width="20%" valign="top" nowrap class="noPrint"><p><strong>Links</strong></p><ul><li><a href="index.html">Docs Home</a></li><li><a href="http://wiki.apache.org/tomcat/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul><p><strong>User Guide</strong></p><ul><li><a href="introduction.html">1) Introduction</a></li><li><a href="setup.html">2) Setup</a></li><li><a href="appdev/index.html">3) First webapp</a></li><li><a href="deployer-howto.html">4) Deployer</a></li><li><a href="manager-howto.html">5) Manager</a></li><li><a href="realm-howto.html">6) Realms and AAA</a></li><li><a href="security-manager-howto.html">7) Security Manager</a></li><li><a href="jndi-resources-howto.html">8) JNDI Resources</a></li><li><a href="jndi-datasource-examples-howto.html">9) JDBC DataSources</a></li><li><a href="class-loader-howto.html">10) Classloading</a></li><li><a href="jasper-howto.html">11) JSPs</a></li><li><a href="ssl-howto.html">12) SSL</a></li><li><a href="ssi-howto.html">13) SSI</a></li><li><a href="cgi-howto.html">14) CGI</a></li><li><a href="proxy-howto.html">15) Proxy Support</a></li><li><a href="mbeans-descriptor-howto.html">16) MBean Descriptor</a></li><li><a href="default-servlet.html">17) Default Servlet</a></li><li><a href="cluster-howto.html">18) Clustering</a></li><li><a href="balancer-howto.html">19) Load Balancer</a></li><li><a href="connectors.html">20) Connectors</a></li><li><a href="monitoring.html">21) Monitoring and Management</a></li><li><a href="logging.html">22) Logging</a></li><li><a href="apr.html">23) APR/Native</a></li><li><a href="virtual-hosting-howto.html">24) Virtual Hosting</a></li><li><a href="aio.html">25) Advanced IO</a></li><li><a href="extras.html">26) Additional Components</a></li><li><a href="maven-jars.html">27) Mavenized</a></li><li><a href="security-howto.html">28) Security Considerations</a></li><li><a href="windows-service-howto.html">29) Windows Service</a></li><li><a href="windows-auth-howto.html">30) Windows Authentication</a></li><li><a href="jdbc-pool.html">31) Tomcat's JDBC Pool</a></li><li><a href="web-socket-howto.html">32) WebSocket</a></li></ul><p><strong>Reference</strong></p><ul><li><a href="RELEASE-NOTES.txt">Release Notes</a></li><li><a href="config/index.html">Configuration</a></li><li><a href="api/index.html">Tomcat Javadocs</a></li><li><a href="servletapi/index.html">Servlet Javadocs</a></li><li><a href="jspapi/index.html">JSP 2.2 Javadocs</a></li><li><a href="elapi/index.html">EL 2.2 Javadocs</a></li><li><a href="http://tomcat.apache.org/connectors-doc/">JK 1.2 Documentation</a></li></ul><p><strong>Apache Tomcat Development</strong></p><ul><li><a href="building.html">Building</a></li><li><a href="changelog.html">Changelog</a></li><li><a href="http://wiki.apache.org/tomcat/TomcatVersions">Status</a></li><li><a href="developers.html">Developers</a></li><li><a href="architecture/index.html">Architecture</a></li><li><a href="funcspecs/index.html">Functional Specs.</a></li><li><a href="tribes/introduction.html">Tribes</a></li></ul></td><!--RIGHT SIDE MAIN BODY--><td width="80%" valign="top" align="left" id="mainBody"><h1>Security Manager HOW-TO</h1><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Table of Contents"><!--()--></a><a name="Table_of_Contents"><strong>Table of Contents</strong></a></font></td></tr><tr><td><blockquote>
22<ul><li><a href="#Background">Background</a></li><li><a href="#Permissions">Permissions</a><ol><li><a href="#Standard_Permissions">Standard Permissions</a></li><li><a href="#Tomcat_Custom_Permissions">Tomcat Custom Permissions</a></li></ol></li><li><a href="#Configuring_Tomcat_With_A_SecurityManager">Configuring Tomcat With A SecurityManager</a></li><li><a href="#Configuring_Package_Protection_in_Tomcat">Configuring Package Protection in Tomcat</a></li><li><a href="#Troubleshooting">Troubleshooting</a></li></ul>
23</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Background"><strong>Background</strong></a></font></td></tr><tr><td><blockquote>
24
25 <p>The Java <strong>SecurityManager</strong> is what allows a web browser
26 to run an applet in its own sandbox to prevent untrusted code from
27 accessing files on the local file system, connecting to a host other
28 than the one the applet was loaded from, and so on. In the same way
29 the SecurityManager protects you from an untrusted applet running in
30 your browser, use of a SecurityManager while running Tomcat can protect
31 your server from trojan servlets, JSPs, JSP beans, and tag libraries.
32 Or even inadvertent mistakes.</p>
33
34 <p>Imagine if someone who is authorized to publish JSPs on your site
35 inadvertently included the following in their JSP:</p>
36<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>
37&lt;% System.exit(1); %&gt;
38</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
39
40 <p>Every time this JSP was executed by Tomcat, Tomcat would exit.
41 Using the Java SecurityManager is just one more line of defense a
42 system administrator can use to keep the server secure and reliable.</p>
43
44 <p><strong>WARNING</strong> - A security audit
45 have been conducted using the Tomcat codebase. Most of the critical
46 package have been protected and a new security package protection mechanism
47 has been implemented. Still, make sure that you are satisfied with your SecurityManager
48 configuration before allowing untrusted users to publish web applications,
49 JSPs, servlets, beans, or tag libraries. <strong>However, running with a
50 SecurityManager is definitely better than running without one.</strong></p>
51
52</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Permissions"><strong>Permissions</strong></a></font></td></tr><tr><td><blockquote>
53
54 <p>Permission classes are used to define what Permissions a class loaded
55 by Tomcat will have. There are a number of Permission classes that are
56 a standard part of the JDK, and you can create your own Permission class
57 for use in your own web applications. Both techniques are used in
58 Tomcat.</p>
59
60
61 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Standard Permissions"><!--()--></a><a name="Standard_Permissions"><strong>Standard Permissions</strong></a></font></td></tr><tr><td><blockquote>
62
63 <p>This is just a short summary of the standard system SecurityManager
64 Permission classes applicable to Tomcat. See
65 <a href="http://java.sun.com/security/">http://java.sun.com/security/</a>
66 for more information.</p>
67
68 <ul>
69 <li><strong>java.util.PropertyPermission</strong> - Controls read/write
70 access to JVM properties such as <code>java.home</code>.</li>
71 <li><strong>java.lang.RuntimePermission</strong> - Controls use of
72 some System/Runtime functions like <code>exit()</code> and
73 <code>exec()</code>. Also control the package access/definition.</li>
74 <li><strong>java.io.FilePermission</strong> - Controls read/write/execute
75 access to files and directories.</li>
76 <li><strong>java.net.SocketPermission</strong> - Controls use of
77 network sockets.</li>
78 <li><strong>java.net.NetPermission</strong> - Controls use of
79 multicast network connections.</li>
80 <li><strong>java.lang.reflect.ReflectPermission</strong> - Controls
81 use of reflection to do class introspection.</li>
82 <li><strong>java.security.SecurityPermission</strong> - Controls access
83 to Security methods.</li>
84 <li><strong>java.security.AllPermission</strong> - Allows access to all
85 permissions, just as if you were running Tomcat without a
86 SecurityManager.</li>
87 </ul>
88
89 </blockquote></td></tr></table>
90
91
92 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Tomcat Custom Permissions"><!--()--></a><a name="Tomcat_Custom_Permissions"><strong>Tomcat Custom Permissions</strong></a></font></td></tr><tr><td><blockquote>
93
94 <p>Tomcat utilizes a custom permission class called
95 <strong>org.apache.naming.JndiPermission</strong>. This permission
96 controls read access to JNDI named file based resources. The permission
97 name is the JNDI name and there are no actions. A trailing "*" can be
98 used to do wild card matching for a JNDI named file resource when
99 granting permission. For example, you might include the following
100 in your policy file:</p>
101<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>
102permission org.apache.naming.JndiPermission "jndi://localhost/examples/*";
103</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
104
105 <p>A Permission entry like this is generated dynamically for each web
106 application that is deployed, to allow it to read its own static resources
107 but disallow it from using file access to read any other files (unless
108 permissions for those files are explicitly granted).</p>
109
110 <p>Also, Tomcat always dynamically creates the following file permissions:</p>
111<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>
112permission java.io.FilePermission "** your application context**", "read";
113
114permission java.io.FilePermission
115 "** application working directory**", "read,write";
116permission java.io.FilePermission
117 "** application working directory**/-", "read,write,delete";
118</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
119 <p>Where **your application context** equals the folder (or WAR file) under which
120 your application has been deployed and **application working directory** is the
121 temporary directory provided to your application as required by the
122 Servlet Specification.</p>
123
124 </blockquote></td></tr></table>
125
126
127</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Configuring Tomcat With A SecurityManager"><!--()--></a><a name="Configuring_Tomcat_With_A_SecurityManager"><strong>Configuring Tomcat With A SecurityManager</strong></a></font></td></tr><tr><td><blockquote>
128
129 <h3>Policy File Format</h3>
130
131 <p>The security policies implemented by the Java SecurityManager are
132 configured in the <code>$CATALINA_BASE/conf/catalina.policy</code> file.
133 This file completely replaces the <code>java.policy</code> file present
134 in your JDK system directories. The <code>catalina.policy</code> file
135 can be edited by hand, or you can use the
136 <a href="http://docs.oracle.com/javase/6/docs/technotes/guides/security/PolicyGuide.html">policytool</a>
137 application that comes with Java 1.2 or later.</p>
138
139 <p>Entries in the <code>catalina.policy</code> file use the standard
140 <code>java.policy</code> file format, as follows:</p>
141<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>
142// Example policy file entry
143
144grant [signedBy &lt;signer&gt;,] [codeBase &lt;code source&gt;] {
145 permission &lt;class&gt; [&lt;name&gt; [, &lt;action list&gt;]];
146};
147</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
148
149 <p>The <strong>signedBy</strong> and <strong>codeBase</strong> entries are
150 optional when granting permissions. Comment lines begin with "//" and
151 end at the end of the current line. The <code>codeBase</code> is in the
152 form of a URL, and for a file URL can use the <code>${java.home}</code>
153 and <code>${catalina.home}</code> properties (which are expanded out to
154 the directory paths defined for them by the <code>JAVA_HOME</code>,
155 <code>CATALINA_HOME</code> and <code>CATALINA_BASE</code> environment
156 variables).</p>
157
158 <h3>The Default Policy File</h3>
159
160 <p>The default <code>$CATALINA_BASE/conf/catalina.policy</code> file
161 looks like this:</p>
162
163
164<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>// Licensed to the Apache Software Foundation (ASF) under one or more
165// contributor license agreements. See the NOTICE file distributed with
166// this work for additional information regarding copyright ownership.
167// The ASF licenses this file to You under the Apache License, Version 2.0
168// (the "License"); you may not use this file except in compliance with
169// the License. You may obtain a copy of the License at
170//
171// http://www.apache.org/licenses/LICENSE-2.0
172//
173// Unless required by applicable law or agreed to in writing, software
174// distributed under the License is distributed on an "AS IS" BASIS,
175// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
176// See the License for the specific language governing permissions and
177// limitations under the License.
178
179// ============================================================================
180// catalina.policy - Security Policy Permissions for Tomcat 7
181//
182// This file contains a default set of security policies to be enforced (by the
183// JVM) when Catalina is executed with the "-security" option. In addition
184// to the permissions granted here, the following additional permissions are
185// granted to each web application:
186//
187// * Read access to the web application's document root directory
188// * Read, write and delete access to the web application's working directory
189//
190// $Id: catalina.policy 1460221 2013-03-23 20:17:29Z kkolinko $
191// ============================================================================
192
193
194// ========== SYSTEM CODE PERMISSIONS =========================================
195
196
197// These permissions apply to javac
198grant codeBase "file:${java.home}/lib/-" {
199 permission java.security.AllPermission;
200};
201
202// These permissions apply to all shared system extensions
203grant codeBase "file:${java.home}/jre/lib/ext/-" {
204 permission java.security.AllPermission;
205};
206
207// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
208grant codeBase "file:${java.home}/../lib/-" {
209 permission java.security.AllPermission;
210};
211
212// These permissions apply to all shared system extensions when
213// ${java.home} points at $JAVA_HOME/jre
214grant codeBase "file:${java.home}/lib/ext/-" {
215 permission java.security.AllPermission;
216};
217
218
219// ========== CATALINA CODE PERMISSIONS =======================================
220
221
222// These permissions apply to the daemon code
223grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
224 permission java.security.AllPermission;
225};
226
227// These permissions apply to the logging API
228// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
229// update this section accordingly.
230// grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
231grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
232 permission java.io.FilePermission
233 "${java.home}${file.separator}lib${file.separator}logging.properties", "read";
234
235 permission java.io.FilePermission
236 "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
237 permission java.io.FilePermission
238 "${catalina.base}${file.separator}logs", "read, write";
239 permission java.io.FilePermission
240 "${catalina.base}${file.separator}logs${file.separator}*", "read, write";
241
242 permission java.lang.RuntimePermission "shutdownHooks";
243 permission java.lang.RuntimePermission "getClassLoader";
244 permission java.lang.RuntimePermission "setContextClassLoader";
245
246 permission java.util.logging.LoggingPermission "control";
247
248 permission java.util.PropertyPermission "java.util.logging.config.class", "read";
249 permission java.util.PropertyPermission "java.util.logging.config.file", "read";
250 permission java.util.PropertyPermission "catalina.base", "read";
251
252 // Note: To enable per context logging configuration, permit read access to
253 // the appropriate file. Be sure that the logging configuration is
254 // secure before enabling such access.
255 // E.g. for the examples web application (uncomment and unwrap
256 // the following to be on a single line):
257 // permission java.io.FilePermission "${catalina.base}${file.separator}
258 // webapps${file.separator}examples${file.separator}WEB-INF
259 // ${file.separator}classes${file.separator}logging.properties", "read";
260};
261
262// These permissions apply to the server startup code
263grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
264 permission java.security.AllPermission;
265};
266
267// These permissions apply to the servlet API classes
268// and those that are shared across all class loaders
269// located in the "lib" directory
270grant codeBase "file:${catalina.home}/lib/-" {
271 permission java.security.AllPermission;
272};
273
274
275// If using a per instance lib directory, i.e. ${catalina.base}/lib,
276// then the following permission will need to be uncommented
277// grant codeBase "file:${catalina.base}/lib/-" {
278// permission java.security.AllPermission;
279// };
280
281
282// ========== WEB APPLICATION PERMISSIONS =====================================
283
284
285// These permissions are granted by default to all web applications
286// In addition, a web application will be given a read FilePermission
287// and JndiPermission for all files and directories in its document root.
288grant {
289 // Required for JNDI lookup of named JDBC DataSource's and
290 // javamail named MimePart DataSource used to send mail
291 permission java.util.PropertyPermission "java.home", "read";
292 permission java.util.PropertyPermission "java.naming.*", "read";
293 permission java.util.PropertyPermission "javax.sql.*", "read";
294
295 // OS Specific properties to allow read access
296 permission java.util.PropertyPermission "os.name", "read";
297 permission java.util.PropertyPermission "os.version", "read";
298 permission java.util.PropertyPermission "os.arch", "read";
299 permission java.util.PropertyPermission "file.separator", "read";
300 permission java.util.PropertyPermission "path.separator", "read";
301 permission java.util.PropertyPermission "line.separator", "read";
302
303 // JVM properties to allow read access
304 permission java.util.PropertyPermission "java.version", "read";
305 permission java.util.PropertyPermission "java.vendor", "read";
306 permission java.util.PropertyPermission "java.vendor.url", "read";
307 permission java.util.PropertyPermission "java.class.version", "read";
308 permission java.util.PropertyPermission "java.specification.version", "read";
309 permission java.util.PropertyPermission "java.specification.vendor", "read";
310 permission java.util.PropertyPermission "java.specification.name", "read";
311
312 permission java.util.PropertyPermission "java.vm.specification.version", "read";
313 permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
314 permission java.util.PropertyPermission "java.vm.specification.name", "read";
315 permission java.util.PropertyPermission "java.vm.version", "read";
316 permission java.util.PropertyPermission "java.vm.vendor", "read";
317 permission java.util.PropertyPermission "java.vm.name", "read";
318
319 // Required for OpenJMX
320 permission java.lang.RuntimePermission "getAttribute";
321
322 // Allow read of JAXP compliant XML parser debug
323 permission java.util.PropertyPermission "jaxp.debug", "read";
324
325 // All JSPs need to be able to read this package
326 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat";
327
328 // Precompiled JSPs need access to these packages.
329 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
330 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
331 permission java.lang.RuntimePermission
332 "accessClassInPackage.org.apache.jasper.runtime.*";
333
334 // Precompiled JSPs need access to these system properties.
335 permission java.util.PropertyPermission
336 "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
337 permission java.util.PropertyPermission
338 "org.apache.el.parser.COERCE_TO_ZERO", "read";
339
340 // The cookie code needs these.
341 permission java.util.PropertyPermission
342 "org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";
343 permission java.util.PropertyPermission
344 "org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read";
345 permission java.util.PropertyPermission
346 "org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read";
347
348 // Applications using Comet need to be able to access this package
349 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.comet";
350
351 // Applications using WebSocket need to be able to access this package
352 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.websocket";
353};
354
355
356// The Manager application needs access to the following packages to support the
357// session display functionality. These settings support the following
358// configurations:
359// - default CATALINA_HOME == CATALINA_BASE
360// - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
361// - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
362grant codeBase "file:${catalina.base}/webapps/manager/-" {
363 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
364 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
365 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
366 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
367 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
368};
369grant codeBase "file:${catalina.home}/webapps/manager/-" {
370 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
371 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
372 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
373 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
374 permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
375};
376
377// You can assign additional permissions to particular web applications by
378// adding additional "grant" entries here, based on the code base for that
379// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
380//
381// Different permissions can be granted to JSP pages, classes loaded from
382// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
383// directory, or even to individual jar files in the /WEB-INF/lib/ directory.
384//
385// For instance, assume that the standard "examples" application
386// included a JDBC driver that needed to establish a network connection to the
387// corresponding database and used the scrape taglib to get the weather from
388// the NOAA web server. You might create a "grant" entries like this:
389//
390// The permissions granted to the context root directory apply to JSP pages.
391// grant codeBase "file:${catalina.base}/webapps/examples/-" {
392// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
393// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
394// };
395//
396// The permissions granted to the context WEB-INF/classes directory
397// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" {
398// };
399//
400// The permission granted to your JDBC driver
401// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
402// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
403// };
404// The permission granted to the scrape taglib
405// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
406// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
407// };
408
409</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
410
411 <h3>Starting Tomcat With A SecurityManager</h3>
412
413 <p>Once you have configured the <code>catalina.policy</code> file for use
414 with a SecurityManager, Tomcat can be started with a SecurityManager in
415 place by using the "-security" option:</p>
416<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>
417$CATALINA_HOME/bin/catalina.sh start -security (Unix)
418%CATALINA_HOME%\bin\catalina start -security (Windows)
419</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
420
421</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Configuring Package Protection in Tomcat"><!--()--></a><a name="Configuring_Package_Protection_in_Tomcat"><strong>Configuring Package Protection in Tomcat</strong></a></font></td></tr><tr><td><blockquote>
422 <p>Starting with Tomcat 5, it is now possible to configure which Tomcat
423 internal package are protected againts package definition and access. See
424 <a href="http://java.sun.com/security/seccodeguide.html">
425 http://java.sun.com/security/seccodeguide.html</a>
426 for more information.</p>
427
428
429 <p><strong>WARNING</strong>: Be aware that removing the default package protection
430 could possibly open a security hole</p>
431
432 <h3>The Default Properties File</h3>
433
434 <p>The default <code>$CATALINA_BASE/conf/catalina.properties</code> file
435 looks like this:</p>
436<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>
437#
438# List of comma-separated packages that start with or equal this string
439# will cause a security exception to be thrown when
440# passed to checkPackageAccess unless the
441# corresponding RuntimePermission ("accessClassInPackage."+package) has
442# been granted.
443package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,
444org.apache.jasper.
445#
446# List of comma-separated packages that start with or equal this string
447# will cause a security exception to be thrown when
448# passed to checkPackageDefinition unless the
449# corresponding RuntimePermission ("defineClassInPackage."+package) has
450# been granted.
451#
452# by default, no packages are restricted for definition, and none of
453# the class loaders supplied with the JDK call checkPackageDefinition.
454#
455package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,
456org.apache.tomcat.,org.apache.jasper.
457</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
458 <p>Once you have configured the <code>catalina.properties</code> file for use
459 with a SecurityManager, remember to re-start Tomcat.</p>
460</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Troubleshooting"><strong>Troubleshooting</strong></a></font></td></tr><tr><td><blockquote>
461
462 <p>If your web application attempts to execute an operation that is
463 prohibited by lack of a required Permission, it will throw an
464 <code>AccessControLException</code> or a <code>SecurityException</code>
465 when the SecurityManager detects the violation. Debugging the permission
466 that is missing can be challenging, and one option is to turn on debug
467 output of all security decisions that are made during execution. This
468 is done by setting a system property before starting Tomcat. The easiest
469 way to do this is via the <code>CATALINA_OPTS</code> environment variable.
470 Execute this command:</p>
471<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>
472export CATALINA_OPTS=-Djava.security.debug=all (Unix)
473set CATALINA_OPTS=-Djava.security.debug=all (Windows)
474</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
475
476 <p>before starting Tomcat.</p>
477
478 <p><strong>WARNING</strong> - This will generate <em>many megabytes</em>
479 of output! However, it can help you track down problems by searching
480 for the word "FAILED" and determining which permission was being checked
481 for. See the Java security documentation for more options that you can
482 specify here as well.</p>
483
484</blockquote></td></tr></table></td></tr><tr class="noPrint"><td width="20%" valign="top" nowrap class="noPrint"></td><td width="80%" valign="top" align="left"><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="comments_section" id="comments_section"><strong>Comments</strong></a></font></td></tr><tr><td><blockquote><p class="notice"><strong>Notice: </strong>This comments section collects your suggestions
485 on improving documentation for Apache Tomcat.<br><br>
486 If you have trouble and need help, read
487 <a href="http://tomcat.apache.org/findhelp.html">Find Help</a> page
488 and ask your question on the tomcat-users
489 <a href="http://tomcat.apache.org/lists.html">mailing list</a>.
490 Do not ask such questions here. This is not a Q&amp;A section.<br><br>
491 The Apache Comments System is explained <a href="/tomcat-7.0-doc/comments.html">here</a>.
492 Comments may be removed by our moderators if they are either
493 implemented or considered invalid/off-topic.</p><script type="text/javascript"><!--//--><![CDATA[//><!--
494 var comments_shortname = 'tomcat';
495 var comments_identifier = 'http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html';
496 (function(w, d) {
497 if (w.location.hostname.toLowerCase() == "tomcat.apache.org") {
498 d.write('<div id="comments_thread"><\/div>');
499 var s = d.createElement('script');
500 s.type = 'text/javascript';
501 s.async = true;
502 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
503 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
504 }
505 else {
506 d.write('<div id="comments_thread"><strong>Comments are disabled for this page at the moment.<\/strong><\/div>');
507 }
508 })(window, document);
509 //--><!]]></script></blockquote></td></tr></table></td></tr><!--FOOTER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><!--PAGE FOOTER--><tr><td colspan="2"><div align="center"><font color="#525D76" size="-1"><em>
510 Copyright &copy; 1999-2013, Apache Software Foundation
511 </em></font></div></td></tr></table></body></html>