• 卓帕卡布拉动作/冒险Windows/Linux/Macintosh 2018-12-12
  • 使命召唤15:黑色行动4windows 2018-12-12
  • “地才”的他们崛起,证明努力绝对是件好事 2018-12-12
  • 扶贫领域腐败问题督查:乡干部成了“包工头”? 2018-12-12
  • #游戏江湖事#政确选黑,玩家选白,游戏公司应当站哪边?瓦克五1226 2018-12-12
  • 大神活动网易炉石大神计划启动 2018-12-12
  • 新游前瞻玩家的饕餮盛宴!2018年全平台必玩游戏推荐!(中) 2018-12-12
  • 林郑月娥:香港不会改变自由贸易的重要地位 2018-12-12
  • 兔子角斗士动作/冒险Windows 2018-12-12
  • 圣兽助战《梦幻西游》手游九黎之墟帮派守护兽解锁 2018-12-12
  • 中日交易所签署备忘录助推中日ETF实现互通 2018-12-12
  • 《七人传奇:英雄集结》公测卡 2018-12-12
  • 暗黑“3”分钟第一期:猎魔人天下第一火多重 2018-12-12
  • 感恩节马赛克拼图解谜Windows/Macintosh 2018-12-12
  • 使命召唤15:黑色行动4windows 2018-12-12
  • Security Manager HOW-TO

    Table of Contents

    Background

    新开户送体验金68 www.oneworldfilmnet.com The Java SecurityManager is what allows a web browser to run an applet in its own sandbox to prevent untrusted code from accessing files on the local file system, connecting to a host other than the one the applet was loaded from, and so on. In the same way the SecurityManager protects you from an untrusted applet running in your browser, use of a SecurityManager while running Tomcat can protect your server from trojan servlets, JSPs, JSP beans, and tag libraries. Or even inadvertent mistakes.

    Imagine if someone who is authorized to publish JSPs on your site inadvertently included the following in their JSP:

    <% System.exit(1); %>

    Every time this JSP was executed by Tomcat, Tomcat would exit. Using the Java SecurityManager is just one more line of defense a system administrator can use to keep the server secure and reliable.

    WARNING - A security audit have been conducted using the Tomcat codebase. Most of the critical package have been protected and a new security package protection mechanism has been implemented. Still, make sure that you are satisfied with your SecurityManager configuration before allowing untrusted users to publish web applications, JSPs, servlets, beans, or tag libraries. However, running with a SecurityManager is definitely better than running without one.

    Permissions

    Permission classes are used to define what Permissions a class loaded by Tomcat will have. There are a number of Permission classes that are a standard part of the JDK, and you can create your own Permission class for use in your own web applications. Both techniques are used in Tomcat.

    Standard Permissions

    This is just a short summary of the standard system SecurityManager Permission classes applicable to Tomcat. See http://docs.oracle.com/javase/7/docs/technotes/guides/security/ for more information.

    • java.util.PropertyPermission - Controls read/write access to JVM properties such as java.home.
    • java.lang.RuntimePermission - Controls use of some System/Runtime functions like exit() and exec(). Also control the package access/definition.
    • java.io.FilePermission - Controls read/write/execute access to files and directories.
    • java.net.SocketPermission - Controls use of network sockets.
    • java.net.NetPermission - Controls use of multicast network connections.
    • java.lang.reflect.ReflectPermission - Controls use of reflection to do class introspection.
    • java.security.SecurityPermission - Controls access to Security methods.
    • java.security.AllPermission - Allows access to all permissions, just as if you were running Tomcat without a SecurityManager.

    Configuring Tomcat With A SecurityManager

    Policy File Format

    The security policies implemented by the Java SecurityManager are configured in the $CATALINA_BASE/conf/catalina.policy file. This file completely replaces the java.policy file present in your JDK system directories. The catalina.policy file can be edited by hand, or you can use the policytool application that comes with Java 1.2 or later.

    Entries in the catalina.policy file use the standard java.policy file format, as follows:

    // Example policy file entry
    
    grant [signedBy <signer>,] [codeBase <code source>] {
      permission  <class>  [<name> [, <action list>]];
    };

    The signedBy and codeBase entries are optional when granting permissions. Comment lines begin with "http://" and end at the end of the current line. The codeBase is in the form of a URL, and for a file URL can use the ${java.home} and ${catalina.home} properties (which are expanded out to the directory paths defined for them by the JAVA_HOME, CATALINA_HOME and CATALINA_BASE environment variables).

    The Default Policy File

    The default $CATALINA_BASE/conf/catalina.policy file looks like this:

    // Licensed to the Apache Software Foundation (ASF) under one or more
    // contributor license agreements.  See the NOTICE file distributed with
    // this work for additional information regarding copyright ownership.
    // The ASF licenses this file to You under the Apache License, Version 2.0
    // (the "License"); you may not use this file except in compliance with
    // the License.  You may obtain a copy of the License at
    //
    //     http://www.apache.org/licenses/LICENSE-2.0
    //
    // Unless required by applicable law or agreed to in writing, software
    // distributed under the License is distributed on an "AS IS" BASIS,
    // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    // See the License for the specific language governing permissions and
    // limitations under the License.
    
    // ============================================================================
    // catalina.policy - Security Policy Permissions for Tomcat
    //
    // This file contains a default set of security policies to be enforced (by the
    // JVM) when Catalina is executed with the "-security" option.  In addition
    // to the permissions granted here, the following additional permissions are
    // granted to each web application:
    //
    // * Read access to the web application's document root directory
    // * Read, write and delete access to the web application's working directory
    // ============================================================================
    
    
    // ========== SYSTEM CODE PERMISSIONS =========================================
    
    
    // These permissions apply to javac
    grant codeBase "file:${java.home}/lib/-" {
            permission java.security.AllPermission;
    };
    
    // These permissions apply to all shared system extensions
    grant codeBase "file:${java.home}/jre/lib/ext/-" {
            permission java.security.AllPermission;
    };
    
    // These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
    grant codeBase "file:${java.home}/../lib/-" {
            permission java.security.AllPermission;
    };
    
    // These permissions apply to all shared system extensions when
    // ${java.home} points at $JAVA_HOME/jre
    grant codeBase "file:${java.home}/lib/ext/-" {
            permission java.security.AllPermission;
    };
    
    
    // ========== CATALINA CODE PERMISSIONS =======================================
    
    
    // These permissions apply to the daemon code
    grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
            permission java.security.AllPermission;
    };
    
    // These permissions apply to the logging API
    // Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
    // update this section accordingly.
    //  grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
    grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
            permission java.io.FilePermission
             "${java.home}${file.separator}lib${file.separator}logging.properties", "read";
    
            permission java.io.FilePermission
             "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
            permission java.io.FilePermission
             "${catalina.base}${file.separator}logs", "read, write";
            permission java.io.FilePermission
             "${catalina.base}${file.separator}logs${file.separator}*", "read, write, delete";
    
            permission java.lang.RuntimePermission "shutdownHooks";
            permission java.lang.RuntimePermission "getClassLoader";
            permission java.lang.RuntimePermission "setContextClassLoader";
    
            permission java.lang.management.ManagementPermission "monitor";
    
            permission java.util.logging.LoggingPermission "control";
    
            permission java.util.PropertyPermission "java.util.logging.config.class", "read";
            permission java.util.PropertyPermission "java.util.logging.config.file", "read";
            permission java.util.PropertyPermission "org.apache.juli.AsyncLoggerPollInterval", "read";
            permission java.util.PropertyPermission "org.apache.juli.AsyncMaxRecordCount", "read";
            permission java.util.PropertyPermission "org.apache.juli.AsyncOverflowDropType", "read";
            permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read";
            permission java.util.PropertyPermission "catalina.base", "read";
    
            // Note: To enable per context logging configuration, permit read access to
            // the appropriate file. Be sure that the logging configuration is
            // secure before enabling such access.
            // E.g. for the examples web application (uncomment and unwrap
            // the following to be on a single line):
            // permission java.io.FilePermission "${catalina.base}${file.separator}
            //  webapps${file.separator}examples${file.separator}WEB-INF
            //  ${file.separator}classes${file.separator}logging.properties", "read";
    };
    
    // These permissions apply to the server startup code
    grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
            permission java.security.AllPermission;
    };
    
    // These permissions apply to the servlet API classes
    // and those that are shared across all class loaders
    // located in the "lib" directory
    grant codeBase "file:${catalina.home}/lib/-" {
            permission java.security.AllPermission;
    };
    
    
    // If using a per instance lib directory, i.e. ${catalina.base}/lib,
    // then the following permission will need to be uncommented
    // grant codeBase "file:${catalina.base}/lib/-" {
    //         permission java.security.AllPermission;
    // };
    
    
    // ========== WEB APPLICATION PERMISSIONS =====================================
    
    
    // These permissions are granted by default to all web applications
    // In addition, a web application will be given a read FilePermission
    // for all files and directories in its document root.
    grant {
        // Required for JNDI lookup of named JDBC DataSource's and
        // javamail named MimePart DataSource used to send mail
        permission java.util.PropertyPermission "java.home", "read";
        permission java.util.PropertyPermission "java.naming.*", "read";
        permission java.util.PropertyPermission "javax.sql.*", "read";
    
        // OS Specific properties to allow read access
        permission java.util.PropertyPermission "os.name", "read";
        permission java.util.PropertyPermission "os.version", "read";
        permission java.util.PropertyPermission "os.arch", "read";
        permission java.util.PropertyPermission "file.separator", "read";
        permission java.util.PropertyPermission "path.separator", "read";
        permission java.util.PropertyPermission "line.separator", "read";
    
        // JVM properties to allow read access
        permission java.util.PropertyPermission "java.version", "read";
        permission java.util.PropertyPermission "java.vendor", "read";
        permission java.util.PropertyPermission "java.vendor.url", "read";
        permission java.util.PropertyPermission "java.class.version", "read";
        permission java.util.PropertyPermission "java.specification.version", "read";
        permission java.util.PropertyPermission "java.specification.vendor", "read";
        permission java.util.PropertyPermission "java.specification.name", "read";
    
        permission java.util.PropertyPermission "java.vm.specification.version", "read";
        permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
        permission java.util.PropertyPermission "java.vm.specification.name", "read";
        permission java.util.PropertyPermission "java.vm.version", "read";
        permission java.util.PropertyPermission "java.vm.vendor", "read";
        permission java.util.PropertyPermission "java.vm.name", "read";
    
        // Required for OpenJMX
        permission java.lang.RuntimePermission "getAttribute";
    
        // Allow read of JAXP compliant XML parser debug
        permission java.util.PropertyPermission "jaxp.debug", "read";
    
        // All JSPs need to be able to read this package
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat";
    
        // Precompiled JSPs need access to these packages.
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
        permission java.lang.RuntimePermission
         "accessClassInPackage.org.apache.jasper.runtime.*";
    
        // Precompiled JSPs need access to these system properties.
        permission java.util.PropertyPermission
         "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
        permission java.util.PropertyPermission
         "org.apache.el.parser.COERCE_TO_ZERO", "read";
    
        // The cookie code needs these.
        permission java.util.PropertyPermission
         "org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";
        permission java.util.PropertyPermission
         "org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read";
        permission java.util.PropertyPermission
         "org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read";
    
        // Applications using WebSocket need to be able to access these packages
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server";
    
        // Applications need to access these packages to use the Servlet 4.0 Preview
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.servlet4preview";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.servlet4preview.http";
    };
    
    
    // The Manager application needs access to the following packages to support the
    // session display functionality. It also requires the custom Tomcat
    // DeployXmlPermission to enable the use of META-INF/context.xml
    // These settings support the following configurations:
    // - default CATALINA_HOME == CATALINA_BASE
    // - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
    // - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
    grant codeBase "file:${catalina.base}/webapps/manager/-" {
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
        permission org.apache.catalina.security.DeployXmlPermission "manager";
    };
    grant codeBase "file:${catalina.home}/webapps/manager/-" {
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
        permission org.apache.catalina.security.DeployXmlPermission "manager";
    };
    
    // The Host Manager application needs the custom Tomcat DeployXmlPermission to
    // enable the use of META-INF/context.xml
    // These settings support the following configurations:
    // - default CATALINA_HOME == CATALINA_BASE
    // - CATALINA_HOME != CATALINA_BASE, per instance Host Manager in CATALINA_BASE
    // - CATALINA_HOME != CATALINA_BASE, shared Host Manager in CATALINA_HOME
    grant codeBase "file:${catalina.base}/webapps/host-manager/-" {
        permission org.apache.catalina.security.DeployXmlPermission "host-manager";
    };
    grant codeBase "file:${catalina.home}/webapps/host-manager/-" {
        permission org.apache.catalina.security.DeployXmlPermission "host-manager";
    };
    
    
    // You can assign additional permissions to particular web applications by
    // adding additional "grant" entries here, based on the code base for that
    // application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
    //
    // Different permissions can be granted to JSP pages, classes loaded from
    // the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
    // directory, or even to individual jar files in the /WEB-INF/lib/ directory.
    //
    // For instance, assume that the standard "examples" application
    // included a JDBC driver that needed to establish a network connection to the
    // corresponding database and used the scrape taglib to get the weather from
    // the NOAA web server.  You might create a "grant" entries like this:
    //
    // The permissions granted to the context root directory apply to JSP pages.
    // grant codeBase "file:${catalina.base}/webapps/examples/-" {
    //      permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
    //      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
    // };
    //
    // The permissions granted to the context WEB-INF/classes directory
    // grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" {
    // };
    //
    // The permission granted to your JDBC driver
    // grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
    //      permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
    // };
    // The permission granted to the scrape taglib
    // grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
    //      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
    // };
    
    // To grant permissions for web applications using packed WAR files, use the
    // Tomcat specific WAR url scheme.
    //
    // The permissions granted to the entire web application
    // grant codeBase "war:file:${catalina.base}/webapps/examples.war*/-" {
    // };
    //
    // The permissions granted to a specific JAR
    // grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {
    // };

    Starting Tomcat With A SecurityManager

    Once you have configured the catalina.policy file for use with a SecurityManager, Tomcat can be started with a SecurityManager in place by using the "-security" option:

    $CATALINA_HOME/bin/catalina.sh start -security    (Unix)
    %CATALINA_HOME%\bin\catalina start -security      (Windows)

    Permissions for packed WAR files

    When using packed WAR files, it is necessary to use Tomcat's custom war URL protocol to assign permissions to web application code.

    To assign permissions to the entire web application the entry in the policy file would look like this:

    // Example policy file entry
    grant codeBase "war:file:${catalina.base}/webapps/examples.war*/-" {
        ...
    };
    

    To assign permissions to a single JAR within the web application the entry in the policy file would look like this:

    // Example policy file entry
    grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {
        ...
    };
    

    Configuring Package Protection in Tomcat

    Starting with Tomcat 5, it is now possible to configure which Tomcat internal package are protected against package definition and access. See http://www.oracle.com/technetwork/java/seccodeguide-139067.html for more information.

    WARNING: Be aware that removing the default package protection could possibly open a security hole

    The Default Properties File

    The default $CATALINA_BASE/conf/catalina.properties file looks like this:

    #
    # List of comma-separated packages that start with or equal this string
    # will cause a security exception to be thrown when
    # passed to checkPackageAccess unless the
    # corresponding RuntimePermission ("accessClassInPackage."+package) has
    # been granted.
    package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,
    org.apache.jasper.
    #
    # List of comma-separated packages that start with or equal this string
    # will cause a security exception to be thrown when
    # passed to checkPackageDefinition unless the
    # corresponding RuntimePermission ("defineClassInPackage."+package) has
    # been granted.
    #
    # by default, no packages are restricted for definition, and none of
    # the class loaders supplied with the JDK call checkPackageDefinition.
    #
    package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,
    org.apache.tomcat.,org.apache.jasper.

    Once you have configured the catalina.properties file for use with a SecurityManager, remember to re-start Tomcat.

    Troubleshooting

    If your web application attempts to execute an operation that is prohibited by lack of a required Permission, it will throw an AccessControLException or a SecurityException when the SecurityManager detects the violation. Debugging the permission that is missing can be challenging, and one option is to turn on debug output of all security decisions that are made during execution. This is done by setting a system property before starting Tomcat. The easiest way to do this is via the CATALINA_OPTS environment variable. Execute this command:

    export CATALINA_OPTS=-Djava.security.debug=all    (Unix)
    set CATALINA_OPTS=-Djava.security.debug=all       (Windows)

    before starting Tomcat.

    WARNING - This will generate many megabytes of output! However, it can help you track down problems by searching for the word "FAILED" and determining which permission was being checked for. See the Java security documentation for more options that you can specify here as well.

    Comments

    Notice: This comments section collects your suggestions on improving documentation for Apache Tomcat.

    If you have trouble and need help, read Find Help page and ask your question on the tomcat-users 新开户送体验金68. Do not ask such questions here. This is not a Q&A section.

    The Apache Comments System is explained here. Comments may be removed by our moderators if they are either implemented or considered invalid/off-topic.

  • 新开户送体验金68
  • 投哪网如何使用现金券
  • 外汇平台开户送体验金
  • 乐虎国际手机平台 | 旋乐吧spin8 | 利来在线 | 利来app | 高博亚洲 |