You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Hugues Ferland <hu...@yahoo.com> on 2007/02/06 23:30:08 UTC
Tomcat policy file, advice and clarification please
Hi,
I have a Tomcat 5.5 installation on Debian Linux with Java 1.6.
I have a web application that create its own connection to an Oracle database. The ojdbc14.jar is included in the WEB-INF/lib directory of the web application.
Now with the default configuration with security enabled, a SecurityException "java.lang.RuntimePermission getClassLoader" is thrown.
I tried to apply a security policy to ojdbc14.jar with grant AllPermission, but without success. This is what I added to /etc/tomcat5.5/policy.d/50user.policy:
grant codeBase "file:/<the path to the web application>/WEB-INF/lib/ojdbc.jar" {
permission java.security.AllPermission;
}
This did not work. One particularity of the web application is that I do not deploy it with a war file. I created it using a context xml file in ${catalina.home}/conf/Catalina/localhost/<context name>.xml.
Also the docBase point outside the ${catalina.home}.
Of course, I'd like to know what I'm doing wrong... I looked on google, tomcat-docs, and other places without any luck... Maybe somebody could point me in the right direction? Or better yet tell me what is wrong :)
Thanks,
Hugues
---------------------------------
All new Yahoo! Mail
---------------------------------
Get news delivered. Enjoy RSS feeds right on your Mail page.
RE: Tomcat policy file, advice and clarification please
Posted by Larry Isaacs <La...@sas.com>.
Hi Huges,
The standard Tomcat 5.5 policy file includes:
grant codeBase "file:${catalina.home}/common/-" {
permission java.security.AllPermission;
};
which grants permission to the common/endorsed jars.
It is possible for code to programmatically grant itself some
extra permissions, such as permission to use "getClassLoader",
an not impose this permission on any of the classes involved
in the calling of this code. In the absence of this programmatic
handling of permissions, all callers must have the permission,
i.e. all classes in the stack above where the permission check
occurs must have the permission. It is likely that you have a
servlet, filter, listener, or some other class in your webapp
that is involved in calling ojdbc.jar. Since it wasn't
being granted the getClassLoader permission, it was causing
the exception once permission was granted to ojdbc.jar.
Cheers,
Larry
> -----Original Message-----
> From: Hugues Ferland [mailto:huguesf@yahoo.com]
> Sent: Wednesday, February 07, 2007 3:30 PM
> To: Tomcat Users List
> Subject: RE: Tomcat policy file, advice and clarification please
>
> Hi Larry,
>
> Thank you very much!
>
> That was it. I'm not sure I understand well what the context
> of a checkPermission is made of... hum... Is it that it
> uses the context from the web apps to "checkPermission"...?
> But then why is checkPermission for my jar in common/endorsed
> succeed for "getClassLoader" but fail for SocketPermission? I
> did not find anything for that in Tomcat's policies files.
>
> Thanks again for your help!
>
> Hugues
>
>
> Larry Isaacs <La...@sas.com> wrote: It is likely that
> some other class in your webapp is on the stack when the
> permission check occurs and it causing the check to fail.
> You could try ".../WEB-INF/-" to expand the grant to the
> entire webapp and see what happens.
>
> To diagnose this kind of exception, you can add the following
> system property to your Tomcat startup:
>
> -Djava.security.debug=access,failure
>
> In the volumes of log output created, search for "access
> denied". A little beyond where you find this, look for
> "domain that failed". That will tell you what is missing the
> required permission. Note that some permission failures are
> normal and won't cause a problem.
>
> Cheers,
> Larry
>
> > -----Original Message-----
> > From: Hugues Ferland [mailto:huguesf@yahoo.com]
> > Sent: Tuesday, February 06, 2007 5:30 PM
> > To: users@tomcat.apache.org
> > Subject: Tomcat policy file, advice and clarification please
> >
> > Hi,
> >
> > I have a Tomcat 5.5 installation on Debian Linux with Java 1.6.
> >
> > I have a web application that create its own connection to
> an Oracle
> > database. The ojdbc14.jar is included in the WEB-INF/lib
> directory of
> > the web application.
> >
> > Now with the default configuration with security enabled, a
> > SecurityException "java.lang.RuntimePermission getClassLoader" is
> > thrown.
> >
> > I tried to apply a security policy to ojdbc14.jar with grant
> > AllPermission, but without success. This is what I added to
> > /etc/tomcat5.5/policy.d/50user.policy:
> >
> > grant codeBase "file:/
> > application>/WEB-INF/lib/ojdbc.jar" {
> > permission java.security.AllPermission; }
> >
> > This did not work. One particularity of the web application
> is that I
> > do not deploy it with a war file. I created it using a context xml
> > file in ${catalina.home}/conf/Catalina/localhost/.xml.
> >
> > Also the docBase point outside the ${catalina.home}.
> >
> > Of course, I'd like to know what I'm doing wrong... I looked on
> > google, tomcat-docs, and other places without any luck...
> > Maybe somebody could point me in the right direction? Or better yet
> > tell me what is wrong :)
> >
> > Thanks,
> >
> > Hugues
> >
> >
> > ---------------------------------
> > All new Yahoo! Mail
> > ---------------------------------
> > Get news delivered. Enjoy RSS feeds right on your Mail page.
> >
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org To
> unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
>
>
> ---------------------------------
> All new Yahoo! Mail
> ---------------------------------
> Get news delivered. Enjoy RSS feeds right on your Mail page.
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Tomcat policy file, advice and clarification please
Posted by Hugues Ferland <hu...@yahoo.com>.
Hi Larry,
Thank you very much!
That was it. I'm not sure I understand well what the context of a checkPermission is made of... hum... Is it that it uses the context from the web apps to "checkPermission"...? But then why is checkPermission for my jar in common/endorsed succeed for "getClassLoader" but fail for SocketPermission? I did not find anything for that in Tomcat's policies files.
Thanks again for your help!
Hugues
Larry Isaacs <La...@sas.com> wrote: It is likely that some other class in your webapp is on the
stack when the permission check occurs and it causing the
check to fail. You could try ".../WEB-INF/-" to expand
the grant to the entire webapp and see what happens.
To diagnose this kind of exception, you can add the following
system property to your Tomcat startup:
-Djava.security.debug=access,failure
In the volumes of log output created, search for "access
denied". A little beyond where you find this, look for
"domain that failed". That will tell you what is missing
the required permission. Note that some permission failures
are normal and won't cause a problem.
Cheers,
Larry
> -----Original Message-----
> From: Hugues Ferland [mailto:huguesf@yahoo.com]
> Sent: Tuesday, February 06, 2007 5:30 PM
> To: users@tomcat.apache.org
> Subject: Tomcat policy file, advice and clarification please
>
> Hi,
>
> I have a Tomcat 5.5 installation on Debian Linux with Java 1.6.
>
> I have a web application that create its own connection to an
> Oracle database. The ojdbc14.jar is included in the
> WEB-INF/lib directory of the web application.
>
> Now with the default configuration with security enabled, a
> SecurityException "java.lang.RuntimePermission
> getClassLoader" is thrown.
>
> I tried to apply a security policy to ojdbc14.jar with grant
> AllPermission, but without success. This is what I added to
> /etc/tomcat5.5/policy.d/50user.policy:
>
> grant codeBase "file:/
> application>/WEB-INF/lib/ojdbc.jar" {
> permission java.security.AllPermission; }
>
> This did not work. One particularity of the web application
> is that I do not deploy it with a war file. I created it
> using a context xml file in
> ${catalina.home}/conf/Catalina/localhost/.xml.
>
> Also the docBase point outside the ${catalina.home}.
>
> Of course, I'd like to know what I'm doing wrong... I looked
> on google, tomcat-docs, and other places without any luck...
> Maybe somebody could point me in the right direction? Or
> better yet tell me what is wrong :)
>
> Thanks,
>
> Hugues
>
>
> ---------------------------------
> All new Yahoo! Mail
> ---------------------------------
> Get news delivered. Enjoy RSS feeds right on your Mail page.
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------
All new Yahoo! Mail
---------------------------------
Get news delivered. Enjoy RSS feeds right on your Mail page.
RE: Tomcat policy file, advice and clarification please
Posted by Larry Isaacs <La...@sas.com>.
It is likely that some other class in your webapp is on the
stack when the permission check occurs and it causing the
check to fail. You could try ".../WEB-INF/-" to expand
the grant to the entire webapp and see what happens.
To diagnose this kind of exception, you can add the following
system property to your Tomcat startup:
-Djava.security.debug=access,failure
In the volumes of log output created, search for "access
denied". A little beyond where you find this, look for
"domain that failed". That will tell you what is missing
the required permission. Note that some permission failures
are normal and won't cause a problem.
Cheers,
Larry
> -----Original Message-----
> From: Hugues Ferland [mailto:huguesf@yahoo.com]
> Sent: Tuesday, February 06, 2007 5:30 PM
> To: users@tomcat.apache.org
> Subject: Tomcat policy file, advice and clarification please
>
> Hi,
>
> I have a Tomcat 5.5 installation on Debian Linux with Java 1.6.
>
> I have a web application that create its own connection to an
> Oracle database. The ojdbc14.jar is included in the
> WEB-INF/lib directory of the web application.
>
> Now with the default configuration with security enabled, a
> SecurityException "java.lang.RuntimePermission
> getClassLoader" is thrown.
>
> I tried to apply a security policy to ojdbc14.jar with grant
> AllPermission, but without success. This is what I added to
> /etc/tomcat5.5/policy.d/50user.policy:
>
> grant codeBase "file:/<the path to the web
> application>/WEB-INF/lib/ojdbc.jar" {
> permission java.security.AllPermission; }
>
> This did not work. One particularity of the web application
> is that I do not deploy it with a war file. I created it
> using a context xml file in
> ${catalina.home}/conf/Catalina/localhost/<context name>.xml.
>
> Also the docBase point outside the ${catalina.home}.
>
> Of course, I'd like to know what I'm doing wrong... I looked
> on google, tomcat-docs, and other places without any luck...
> Maybe somebody could point me in the right direction? Or
> better yet tell me what is wrong :)
>
> Thanks,
>
> Hugues
>
>
> ---------------------------------
> All new Yahoo! Mail
> ---------------------------------
> Get news delivered. Enjoy RSS feeds right on your Mail page.
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org