You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es> on 2013/10/22 14:48:52 UTC
Restrict the use of JDK classes Tomcat 7 or 6
Hello,
I would like to know if is it possible to restrict the use of JDK classes
in Tomcat according to a list given in another file. ¿Is it possible by
creating a new Add-on? If it is possible, where can I find documentation
about creating Add-ons? I have looked up and I haven't found any
information about it (I only have found AddOns in Tomcat 3.3 but there is
nothing about creating new ones).
Another idea to do that is by modifying the source code. Could anybody tell
me where I should search to do that?
Thank you very much.
Analía de Pedro
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by Isuru Perera <is...@wso2.com>.
Hi,
On Tue, Oct 22, 2013 at 11:11 PM, ANALIA DE PEDRO SANTAMARIA <
100074002@alumnos.uc3m.es> wrote:
> I'm sorry about the misunderstanding. My question isn't a homework
> question. I'm working in my Final Project and I have some doubts about
> Tomcat, that I need to solve in order to develop it properly. I had
> searched a lot before I wrote to the mailing list. I'm sorry if you have
> understood that I'm a lazy person who wants you to solve my work.
>
I think it's okay to ask questions on the mailing lists and you already got
an answer in less than 15 mins! :)
>
> However, my work is related to the university (the reason why I have wrote
> with my student account), so I understand it if you can't answer my
> questions.
>
> Thank you.
>
>
> 2013/10/22 André Warnier <aw...@ice-sa.com>
>
> > Caldarale, Charles R wrote:
> >
> >> From: cjderham@gmail.com [mailto:cjderham@gmail.com]
> >>> On Behalf Of chris derham
> >>> Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
> >>>
> >>
> >> Do the mailing list rules state home work questions are in or out of
> >>> scope?
> >>>
> >>
> >> To quote from "How To Ask Questions The Smart Way" (
> >> http://www.catb.org/~esr/**faqs/smart-questions.html<
> http://www.catb.org/~esr/faqs/smart-questions.html>),
> >> which is linked to from the Tomcat mailing lists page:
> >>
> >> Don't post homework questions
> >>
> >>
> >> Now come on guys. UCM3 is the Universidad Carlos III of Madrid, Spain.
> > So we have an OP here who attends a Spanish university, is learning Java,
> > has a genuine Spanish name, yet phrases questions correctly and politely
> in
> > English, on a forum which the OP found and which is at least related to
> the
> > subject.
> > You do not have to solve her homework. But a bit of slack, a pointer or
> > two from real Java experts ?
> > And the fact that I am currently in Valencia, a mere 3 hours from Madrid,
> > has absolutely nothing to do with any of this.
> >
> >
> >
> > ------------------------------**------------------------------**---------
> > To unsubscribe, e-mail: users-unsubscribe@tomcat.**apache.org<
> users-unsubscribe@tomcat.apache.org>
> > For additional commands, e-mail: users-help@tomcat.apache.org
> >
> >
>
--
Isuru Perera
Senior Software Engineer | WSO2, Inc. | http://wso2.com/
Lean . Enterprise . Middleware
about.me/chrishantha
RE: Restrict the use of JDK classes Tomcat 7 or 6
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: ANALIA DE PEDRO SANTAMARIA [mailto:100074002@alumnos.uc3m.es]
> Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
> I understand it if you can't answer my questions.
Your question was already answered by Aurélien: use a SecurityManager.
http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Analia,
On 11/11/13, 10:25 AM, ANALIA DE PEDRO SANTAMARIA wrote:
> I have been working with the Security Manager and I think it is a
> good aproximation of what I need, thank you very much for the
> advice. I have read that it is possible to create your own
> Permission class, but I haven't found any documentation or example.
> Could anybody tell me where I can find information about create a
> Permission class?
Try searching for "java custom SecurityManager" instead.
Writing your own Permission isn't going to help unless the
SecurityManager already knows how to check for that kind of
permission, and the code attempting to run under the SM understands
that it needs to request a privileged action.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJSgPiHAAoJEBzwKT+lPKRYlmYQAMNG0tbc5EzKjcm1Eqp12JdK
jD1l9CxtWe4cWIaLtzeRypb3SgP+HgrFkfk5p4wtjQb4WnWItLBq9JTIj23c1gvZ
ePHgySzchxWL8UPMRbiDDBnoLPn25Vk6Cy9wnanL7AMy/gBn9DggtY9PrJJEXEVm
EZ6HY1tQrmgW1C4U3621Rlw5HYEP3u9t2zhXCYe5m27jm4DtcBSyq+eedlI5fxKI
iFF4zEh+vdpE/+Xi3PDi8Ksg6iDoOANx09S1x5dUgdi/v8Agl1Cf7jUmOc75Vk+b
TpDvDb/et+fltfbzN7XGVK9cqzp5ZaDgtJ+tw2EBY5/FVl/QEr1utIjc5K8gdN1J
KYamOpp/qhfUIQGWN1sO2Pzzd+dmDlyqp5pRd2pxyZcwZhqpd4Gki+JcIpN4yaKu
R/dV92GU3SzyTRCFxZ8DZdCcck6CU/XQrvzL2horjtRoguMsGiU3KnE+AtnvS/CJ
X6D2FMPltk2o4NPM5mn8anDyLCNUOf3Z+8x5I4nA6nVYJXgSgr6XUNZUiinXjyJx
CWmJTMwaPqFiNvTNOuw3q3p7KCFppznzmHashbOrB3qgbf44evEcsVO5kanOgwGw
qMGT+YqCIjRUoaLsJxruzMd/JgmkiEYCf+2+BWruLhp/qa9Sh7MTOFHC/KnW+oUc
779tOTmWizs7tqxKXWR7
=ohPG
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>.
Thank you very much. Your answer has helped me a lot.
2013/11/20 Aurélien Terrestris <at...@gmail.com>
> From what I understand in this doc, there is no specific resource
> management code anywhere and you must ensure that your application
> will call permission checking every time you are going to access the
> protected resource. Even for a web application, it must be considered
> as any other application, and it's in your own code to call such
> checking.
>
> The doc says : "Second, include these new classes with the application
> package." so include your class in your jar or war file.
>
> Yes, Tomcat is supposed to behave such any other JVM. However, you
> need to update the catalina.policy file for your own permission, and
> don't forget to call the security manager from the startup script (
> http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html )
>
> 2013/11/17 ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>:
> > Thank you very much. I have been working in creating my own permission
> and
> > I have some questions:
> >
> > - In the Java documentation says it is necessary to add a checkPermission
> > in the application's resource management code. My question is, when we
> are
> > working with web applications, which is the application's resource
> > management code? And where is it?
> >
> > - When I create my own permission class, where do I have to store it? In
> > order to the Security manager can find it.
> >
> > - I have read that it is not necessary to modify the Security Manager,
> when
> > we are creating a new permission for secure the JVM. When we are working
> > with Tomcat, and not with the JVM directly, is it the same? Or is it
> > necessary to modify the Tomcat's Security Manager?
> >
> > Thank you very much.
> >
> >
> >
> > 2013/11/12 Aurélien Terrestris <at...@gmail.com>
> >
> >> Hello Analia
> >>
> >> I'm glad that you could play successfully with the Security Manager as
> >> I advised first :D
> >>
> >>
> >> About permissions, here you have a doc :
> >>
> >>
> >>
> http://docs.oracle.com/javase/6/docs/technotes/guides/security/spec/security-spec.doc3.html#20211
> >>
> >> best regards
> >>
> >> 2013/11/11 ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>:
> >> > Hello,
> >> >
> >> > I have been working with the Security Manager and I think it is a good
> >> > aproximation of what I need, thank you very much for the advice. I
> have
> >> > read that it is possible to create your own Permission class, but I
> >> haven't
> >> > found any documentation or example. Could anybody tell me where I can
> >> find
> >> > information about create a Permission class?
> >> >
> >> > Thank you very much.
> >> >
> >> >
> >> > 2013/10/23 Caldarale, Charles R <Ch...@unisys.com>
> >> >
> >> >> > From: Christopher Schultz [mailto:chris@christopherschultz.net]
> >> >> > Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
> >> >>
> >> >> > When you say "Java classes", are you talking about re-defining
> >> >> > something like java.lang.String? If so, then the servlet spec (3.0:
> >> >> > 10.7.2) prohibits web applications from loading classes from any of
> >> >> > these packages from a web application class loader.
> >> >> > java.*
> >> >> > javax.*
> >> >> > Looking at current trunk, Tomcat appears to take a lazy view and
> just
> >> >> > look for these two classes:
> >> >> > javax.servlet.Servlet
> >> >> > javax.el.Expression
> >> >> > So it looks like you might be able to redefine java.lang.String if
> you
> >> >> > want.
> >> >>
> >> >> As I recall, the JVM itself prevents loading of java.* classes from
> >> >> anywhere other than the registered JRE jar locations. Not sure about
> >> >> javax.* classes.
> >> >>
> >> >> - Chuck
> >> >>
> >> >>
> >> >> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE
> PROPRIETARY
> >> >> MATERIAL and is thus for use only by the intended recipient. If you
> >> >> received this in error, please contact the sender and delete the
> e-mail
> >> and
> >> >> its attachments from all computers.
> >> >>
> >> >>
> >> >> ---------------------------------------------------------------------
> >> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >> >>
> >> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >>
> >>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by Aurélien Terrestris <at...@gmail.com>.
>From what I understand in this doc, there is no specific resource
management code anywhere and you must ensure that your application
will call permission checking every time you are going to access the
protected resource. Even for a web application, it must be considered
as any other application, and it's in your own code to call such
checking.
The doc says : "Second, include these new classes with the application
package." so include your class in your jar or war file.
Yes, Tomcat is supposed to behave such any other JVM. However, you
need to update the catalina.policy file for your own permission, and
don't forget to call the security manager from the startup script (
http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html )
2013/11/17 ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>:
> Thank you very much. I have been working in creating my own permission and
> I have some questions:
>
> - In the Java documentation says it is necessary to add a checkPermission
> in the application's resource management code. My question is, when we are
> working with web applications, which is the application's resource
> management code? And where is it?
>
> - When I create my own permission class, where do I have to store it? In
> order to the Security manager can find it.
>
> - I have read that it is not necessary to modify the Security Manager, when
> we are creating a new permission for secure the JVM. When we are working
> with Tomcat, and not with the JVM directly, is it the same? Or is it
> necessary to modify the Tomcat's Security Manager?
>
> Thank you very much.
>
>
>
> 2013/11/12 Aurélien Terrestris <at...@gmail.com>
>
>> Hello Analia
>>
>> I'm glad that you could play successfully with the Security Manager as
>> I advised first :D
>>
>>
>> About permissions, here you have a doc :
>>
>>
>> http://docs.oracle.com/javase/6/docs/technotes/guides/security/spec/security-spec.doc3.html#20211
>>
>> best regards
>>
>> 2013/11/11 ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>:
>> > Hello,
>> >
>> > I have been working with the Security Manager and I think it is a good
>> > aproximation of what I need, thank you very much for the advice. I have
>> > read that it is possible to create your own Permission class, but I
>> haven't
>> > found any documentation or example. Could anybody tell me where I can
>> find
>> > information about create a Permission class?
>> >
>> > Thank you very much.
>> >
>> >
>> > 2013/10/23 Caldarale, Charles R <Ch...@unisys.com>
>> >
>> >> > From: Christopher Schultz [mailto:chris@christopherschultz.net]
>> >> > Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
>> >>
>> >> > When you say "Java classes", are you talking about re-defining
>> >> > something like java.lang.String? If so, then the servlet spec (3.0:
>> >> > 10.7.2) prohibits web applications from loading classes from any of
>> >> > these packages from a web application class loader.
>> >> > java.*
>> >> > javax.*
>> >> > Looking at current trunk, Tomcat appears to take a lazy view and just
>> >> > look for these two classes:
>> >> > javax.servlet.Servlet
>> >> > javax.el.Expression
>> >> > So it looks like you might be able to redefine java.lang.String if you
>> >> > want.
>> >>
>> >> As I recall, the JVM itself prevents loading of java.* classes from
>> >> anywhere other than the registered JRE jar locations. Not sure about
>> >> javax.* classes.
>> >>
>> >> - Chuck
>> >>
>> >>
>> >> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
>> >> MATERIAL and is thus for use only by the intended recipient. If you
>> >> received this in error, please contact the sender and delete the e-mail
>> and
>> >> its attachments from all computers.
>> >>
>> >>
>> >> ---------------------------------------------------------------------
>> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> >> For additional commands, e-mail: users-help@tomcat.apache.org
>> >>
>> >>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>.
Thank you very much. I have been working in creating my own permission and
I have some questions:
- In the Java documentation says it is necessary to add a checkPermission
in the application's resource management code. My question is, when we are
working with web applications, which is the application's resource
management code? And where is it?
- When I create my own permission class, where do I have to store it? In
order to the Security manager can find it.
- I have read that it is not necessary to modify the Security Manager, when
we are creating a new permission for secure the JVM. When we are working
with Tomcat, and not with the JVM directly, is it the same? Or is it
necessary to modify the Tomcat's Security Manager?
Thank you very much.
2013/11/12 Aurélien Terrestris <at...@gmail.com>
> Hello Analia
>
> I'm glad that you could play successfully with the Security Manager as
> I advised first :D
>
>
> About permissions, here you have a doc :
>
>
> http://docs.oracle.com/javase/6/docs/technotes/guides/security/spec/security-spec.doc3.html#20211
>
> best regards
>
> 2013/11/11 ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>:
> > Hello,
> >
> > I have been working with the Security Manager and I think it is a good
> > aproximation of what I need, thank you very much for the advice. I have
> > read that it is possible to create your own Permission class, but I
> haven't
> > found any documentation or example. Could anybody tell me where I can
> find
> > information about create a Permission class?
> >
> > Thank you very much.
> >
> >
> > 2013/10/23 Caldarale, Charles R <Ch...@unisys.com>
> >
> >> > From: Christopher Schultz [mailto:chris@christopherschultz.net]
> >> > Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
> >>
> >> > When you say "Java classes", are you talking about re-defining
> >> > something like java.lang.String? If so, then the servlet spec (3.0:
> >> > 10.7.2) prohibits web applications from loading classes from any of
> >> > these packages from a web application class loader.
> >> > java.*
> >> > javax.*
> >> > Looking at current trunk, Tomcat appears to take a lazy view and just
> >> > look for these two classes:
> >> > javax.servlet.Servlet
> >> > javax.el.Expression
> >> > So it looks like you might be able to redefine java.lang.String if you
> >> > want.
> >>
> >> As I recall, the JVM itself prevents loading of java.* classes from
> >> anywhere other than the registered JRE jar locations. Not sure about
> >> javax.* classes.
> >>
> >> - Chuck
> >>
> >>
> >> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> >> MATERIAL and is thus for use only by the intended recipient. If you
> >> received this in error, please contact the sender and delete the e-mail
> and
> >> its attachments from all computers.
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >>
> >>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Fwd: Restrict the use of JDK classes Tomcat 7 or 6
Posted by Aurélien Terrestris <at...@gmail.com>.
Hello Analia
I'm glad that you could play successfully with the Security Manager as
I advised first :D
About permissions, here you have a doc :
http://docs.oracle.com/javase/6/docs/technotes/guides/security/spec/security-spec.doc3.html#20211
best regards
2013/11/11 ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>:
> Hello,
>
> I have been working with the Security Manager and I think it is a good
> aproximation of what I need, thank you very much for the advice. I have
> read that it is possible to create your own Permission class, but I haven't
> found any documentation or example. Could anybody tell me where I can find
> information about create a Permission class?
>
> Thank you very much.
>
>
> 2013/10/23 Caldarale, Charles R <Ch...@unisys.com>
>
>> > From: Christopher Schultz [mailto:chris@christopherschultz.net]
>> > Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
>>
>> > When you say "Java classes", are you talking about re-defining
>> > something like java.lang.String? If so, then the servlet spec (3.0:
>> > 10.7.2) prohibits web applications from loading classes from any of
>> > these packages from a web application class loader.
>> > java.*
>> > javax.*
>> > Looking at current trunk, Tomcat appears to take a lazy view and just
>> > look for these two classes:
>> > javax.servlet.Servlet
>> > javax.el.Expression
>> > So it looks like you might be able to redefine java.lang.String if you
>> > want.
>>
>> As I recall, the JVM itself prevents loading of java.* classes from
>> anywhere other than the registered JRE jar locations. Not sure about
>> javax.* classes.
>>
>> - Chuck
>>
>>
>> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
>> MATERIAL and is thus for use only by the intended recipient. If you
>> received this in error, please contact the sender and delete the e-mail and
>> its attachments from all computers.
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by Aurélien Terrestris <at...@gmail.com>.
Hello Analia
I'm glad that you could play successfully with the Security Manager as
I advised first :D
About permissions, here you have a doc :
http://docs.oracle.com/javase/6/docs/technotes/guides/security/spec/security-spec.doc3.html#20211
best regards
2013/11/11 ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>:
> Hello,
>
> I have been working with the Security Manager and I think it is a good
> aproximation of what I need, thank you very much for the advice. I have
> read that it is possible to create your own Permission class, but I haven't
> found any documentation or example. Could anybody tell me where I can find
> information about create a Permission class?
>
> Thank you very much.
>
>
> 2013/10/23 Caldarale, Charles R <Ch...@unisys.com>
>
>> > From: Christopher Schultz [mailto:chris@christopherschultz.net]
>> > Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
>>
>> > When you say "Java classes", are you talking about re-defining
>> > something like java.lang.String? If so, then the servlet spec (3.0:
>> > 10.7.2) prohibits web applications from loading classes from any of
>> > these packages from a web application class loader.
>> > java.*
>> > javax.*
>> > Looking at current trunk, Tomcat appears to take a lazy view and just
>> > look for these two classes:
>> > javax.servlet.Servlet
>> > javax.el.Expression
>> > So it looks like you might be able to redefine java.lang.String if you
>> > want.
>>
>> As I recall, the JVM itself prevents loading of java.* classes from
>> anywhere other than the registered JRE jar locations. Not sure about
>> javax.* classes.
>>
>> - Chuck
>>
>>
>> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
>> MATERIAL and is thus for use only by the intended recipient. If you
>> received this in error, please contact the sender and delete the e-mail and
>> its attachments from all computers.
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>.
Hello,
I have been working with the Security Manager and I think it is a good
aproximation of what I need, thank you very much for the advice. I have
read that it is possible to create your own Permission class, but I haven't
found any documentation or example. Could anybody tell me where I can find
information about create a Permission class?
Thank you very much.
2013/10/23 Caldarale, Charles R <Ch...@unisys.com>
> > From: Christopher Schultz [mailto:chris@christopherschultz.net]
> > Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
>
> > When you say "Java classes", are you talking about re-defining
> > something like java.lang.String? If so, then the servlet spec (3.0:
> > 10.7.2) prohibits web applications from loading classes from any of
> > these packages from a web application class loader.
> > java.*
> > javax.*
> > Looking at current trunk, Tomcat appears to take a lazy view and just
> > look for these two classes:
> > javax.servlet.Servlet
> > javax.el.Expression
> > So it looks like you might be able to redefine java.lang.String if you
> > want.
>
> As I recall, the JVM itself prevents loading of java.* classes from
> anywhere other than the registered JRE jar locations. Not sure about
> javax.* classes.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you
> received this in error, please contact the sender and delete the e-mail and
> its attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
RE: Restrict the use of JDK classes Tomcat 7 or 6
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Christopher Schultz [mailto:chris@christopherschultz.net]
> Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
> When you say "Java classes", are you talking about re-defining
> something like java.lang.String? If so, then the servlet spec (3.0:
> 10.7.2) prohibits web applications from loading classes from any of
> these packages from a web application class loader.
> java.*
> javax.*
> Looking at current trunk, Tomcat appears to take a lazy view and just
> look for these two classes:
> javax.servlet.Servlet
> javax.el.Expression
> So it looks like you might be able to redefine java.lang.String if you
> want.
As I recall, the JVM itself prevents loading of java.* classes from anywhere other than the registered JRE jar locations. Not sure about javax.* classes.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Analia,
On 10/23/13 4:29 AM, ANALIA DE PEDRO SANTAMARIA wrote:
> Thank you very much for the answers. What I'm trying to do is block
> the execution of certain privileges in certain web applications
> (I'm working in a security model). One way of approaching this is
> to avoid loading certain Java libraries. So what I want to do is
> set up Tomcat (or the Security Manager) so that I can restrict what
> Java classes one web application can use.
When you say "Java classes", are you talking about re-defining
something like java.lang.String? If so, then the servlet spec (3.0:
10.7.2) prohibits web applications from loading classes from any of
these packages from a web application class loader.
java.*
javax.*
Looking at current trunk, Tomcat appears to take a lazy view and just
look for these two classes:
javax.servlet.Servlet
javax.el.Expression
So it looks like you might be able to redefine java.lang.String if you
want. My analysis may be wrong -- there is a lot of code in there, but
from what I see in WebappClassLoader, I think there might be a spec
violation there.
> And I have to set up this in each application, because not all the
> web applications have the same permissions.
AFAIK, you can't enable per-application security permissions without
writing your own SecurityManager. Had Sun decided that SecurityManager
instances could be tied to ClassLoaders and manage the classes loaded
by them, I think things would have been much better all around.
Anyhow, what kinds of permissions do you want to grant to (or revoke
from) your web applications?
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJSZ+p1AAoJEBzwKT+lPKRY2c4QAKZ6T6LRKKF7PHD1s+l9+d+z
hrYabTmH0/xdma/j0iwgYYhnpaTb9nMMPBWQW0HriPAhj5ZiuhXpCE3vjTIduCO6
YPPYXukZM74bGFrwZL3BDZczRlpxWIDRHILIMGgs6vje4197zJClAjkxynDlpXHW
YdMzE/4dhdFij5WbI3jntjxzpgSsRmyj03l7dyKG50UzVwMRyJk+G0aXm9Xx4mOk
CGDbo9AwJN/EmI9AJi0yMSbcskFYKHr+wTlJBfv30uEDE9v9v9qD+7hXKMBFCmjy
QrYyOXowGRUbXcaQcHMWt6oYrw6iSvdH0V0ou4nIO4NJGLuuatNVoNbvbqbHmoUk
3VebP98o1xKX9z1qUDQgXTbS1uQDyJEWbCPptrKdPSIc0dNLMkS3UqhqmAWhy+8t
TlIvRpIDIGQ2GQlEkCuoMIqRPCyOVpFMZmeUfEI1GXOOt3lfTl+MLv9o6pPYVama
nlK7Rfs5GHuzOWK5SqcxQ/kEKu71V+D77cG56ran5YknRWzMFhJzxdG3yw/UAnMO
lj7wSJBHeouiZljTnSKbSDEp55WCeGbHsJh6TFE7SmYYOSSmFAcmVjDOKDXI8gRE
I665is4eJFUrbYWxv3OzDHwRVZi7hbHMhV+SdiEA+CL/AjfNNPfMzm8ndyEViyPY
lqau1ihPd2jgh0cBEOq5
=WVb9
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>.
Thank you very much for the answers. What I'm trying to do is block the
execution of certain privileges in certain web applications (I'm working in
a security model). One way of approaching this is to avoid loading certain
Java libraries. So what I want to do is set up Tomcat (or the Security
Manager) so that I can restrict what Java classes one web application can
use. And I have to set up this in each application, because not all the web
applications have the same permissions.
Analia
2013/10/23 Christopher Schultz <ch...@christopherschultz.net>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Analia,
>
> On 10/22/13 1:41 PM, ANALIA DE PEDRO SANTAMARIA wrote:
> > I'm sorry about the misunderstanding. My question isn't a homework
> > question. I'm working in my Final Project and I have some doubts
> > about Tomcat, that I need to solve in order to develop it
> > properly.
>
> Perhaps I didn't understand the original question: what are you trying
> to avoid? Do you want to prevent a web application from loading a
> different version of java.lang.String, or are you trying to protect
> something else?
>
> I think the initial resistance to answering your original question was
> because it was so open-ended. Perhaps if you add some more details
> (e.g. what is happening, why it is unexpected, what you want to happen
> instead) we might be able to help.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.14 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJSZwFxAAoJEBzwKT+lPKRYeFYP/2/k5A3OB8CbbHHivXh/HvR5
> KQUvE8Ez9dqACKSnTs94k0lYY7x+1EwVtUuyi5huTfh7Yo3vV54qOCpLzdmGDGSP
> NZABnifDcjSB5HxdiadNoAN36cSsE08Poc7sh3m9Mg752mfDRaYtLS4JSWydhXGC
> MI/Th2Hc4/1jJo418hm7YH6RiWvUX8EKWG/e4UE0HhHzN1V9Q2kq2j1TQ7ixBFgN
> MJBGHFWOewTEd+9/iPkycF5hkPR7by7RjJBWx3eY3IXD+RTmt/7cn4gRxZoQtUa+
> +/nPMGdDNfX+LN5zd/qQo7qjJv7TVdnhJVyh2FwWbZYt6fJowj9xaApAvT2qFLCb
> ZJ+UrD2zhDao5J3blM/KsEklWdk72ShpiIBjBM9PC5og/obGTEfzOfbm5NSpw+8p
> s//UKZ+xOyqmiKTKN5rXxBByPDJiR0ZWHIxBbkFwX20jzpFm3acu4m11dva8F9Zh
> vRZ62JSRVrFckRS+286FU6TMPp2WBk3sjbMsI3EFpYtiAvg+TehPjEUkOmuz5dxR
> J77s6vfFus4salL2OcFNNZ9SQsHEgCmqJhXwMS0OQdV2XWRuQMrEI5ruiSYnzQT2
> CNmihUVeEiDJKk1g4umwhU8Gq5dq/QHk3vv/C1bq8uQ/Y3e5BnGOy+C8zeusltji
> ip2Ps0GVfiViTLavhPQ+
> =Vv6G
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Analia,
On 10/22/13 1:41 PM, ANALIA DE PEDRO SANTAMARIA wrote:
> I'm sorry about the misunderstanding. My question isn't a homework
> question. I'm working in my Final Project and I have some doubts
> about Tomcat, that I need to solve in order to develop it
> properly.
Perhaps I didn't understand the original question: what are you trying
to avoid? Do you want to prevent a web application from loading a
different version of java.lang.String, or are you trying to protect
something else?
I think the initial resistance to answering your original question was
because it was so open-ended. Perhaps if you add some more details
(e.g. what is happening, why it is unexpected, what you want to happen
instead) we might be able to help.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJSZwFxAAoJEBzwKT+lPKRYeFYP/2/k5A3OB8CbbHHivXh/HvR5
KQUvE8Ez9dqACKSnTs94k0lYY7x+1EwVtUuyi5huTfh7Yo3vV54qOCpLzdmGDGSP
NZABnifDcjSB5HxdiadNoAN36cSsE08Poc7sh3m9Mg752mfDRaYtLS4JSWydhXGC
MI/Th2Hc4/1jJo418hm7YH6RiWvUX8EKWG/e4UE0HhHzN1V9Q2kq2j1TQ7ixBFgN
MJBGHFWOewTEd+9/iPkycF5hkPR7by7RjJBWx3eY3IXD+RTmt/7cn4gRxZoQtUa+
+/nPMGdDNfX+LN5zd/qQo7qjJv7TVdnhJVyh2FwWbZYt6fJowj9xaApAvT2qFLCb
ZJ+UrD2zhDao5J3blM/KsEklWdk72ShpiIBjBM9PC5og/obGTEfzOfbm5NSpw+8p
s//UKZ+xOyqmiKTKN5rXxBByPDJiR0ZWHIxBbkFwX20jzpFm3acu4m11dva8F9Zh
vRZ62JSRVrFckRS+286FU6TMPp2WBk3sjbMsI3EFpYtiAvg+TehPjEUkOmuz5dxR
J77s6vfFus4salL2OcFNNZ9SQsHEgCmqJhXwMS0OQdV2XWRuQMrEI5ruiSYnzQT2
CNmihUVeEiDJKk1g4umwhU8Gq5dq/QHk3vv/C1bq8uQ/Y3e5BnGOy+C8zeusltji
ip2Ps0GVfiViTLavhPQ+
=Vv6G
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>.
I'm sorry about the misunderstanding. My question isn't a homework
question. I'm working in my Final Project and I have some doubts about
Tomcat, that I need to solve in order to develop it properly. I had
searched a lot before I wrote to the mailing list. I'm sorry if you have
understood that I'm a lazy person who wants you to solve my work.
However, my work is related to the university (the reason why I have wrote
with my student account), so I understand it if you can't answer my
questions.
Thank you.
2013/10/22 André Warnier <aw...@ice-sa.com>
> Caldarale, Charles R wrote:
>
>> From: cjderham@gmail.com [mailto:cjderham@gmail.com]
>>> On Behalf Of chris derham
>>> Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
>>>
>>
>> Do the mailing list rules state home work questions are in or out of
>>> scope?
>>>
>>
>> To quote from "How To Ask Questions The Smart Way" (
>> http://www.catb.org/~esr/**faqs/smart-questions.html<http://www.catb.org/~esr/faqs/smart-questions.html>),
>> which is linked to from the Tomcat mailing lists page:
>>
>> Don't post homework questions
>>
>>
>> Now come on guys. UCM3 is the Universidad Carlos III of Madrid, Spain.
> So we have an OP here who attends a Spanish university, is learning Java,
> has a genuine Spanish name, yet phrases questions correctly and politely in
> English, on a forum which the OP found and which is at least related to the
> subject.
> You do not have to solve her homework. But a bit of slack, a pointer or
> two from real Java experts ?
> And the fact that I am currently in Valencia, a mere 3 hours from Madrid,
> has absolutely nothing to do with any of this.
>
>
>
> ------------------------------**------------------------------**---------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.**apache.org<us...@tomcat.apache.org>
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by André Warnier <aw...@ice-sa.com>.
Caldarale, Charles R wrote:
>> From: cjderham@gmail.com [mailto:cjderham@gmail.com]
>> On Behalf Of chris derham
>> Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
>
>> Do the mailing list rules state home work questions are in or out of scope?
>
> To quote from "How To Ask Questions The Smart Way" (http://www.catb.org/~esr/faqs/smart-questions.html), which is linked to from the Tomcat mailing lists page:
>
> Don't post homework questions
>
>
Now come on guys. UCM3 is the Universidad Carlos III of Madrid, Spain.
So we have an OP here who attends a Spanish university, is learning Java, has a genuine
Spanish name, yet phrases questions correctly and politely in English, on a forum which
the OP found and which is at least related to the subject.
You do not have to solve her homework. But a bit of slack, a pointer or two from real
Java experts ?
And the fact that I am currently in Valencia, a mere 3 hours from Madrid, has absolutely
nothing to do with any of this.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Restrict the use of JDK classes Tomcat 7 or 6
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: cjderham@gmail.com [mailto:cjderham@gmail.com]
> On Behalf Of chris derham
> Subject: Re: Restrict the use of JDK classes Tomcat 7 or 6
> Do the mailing list rules state home work questions are in or out of scope?
To quote from "How To Ask Questions The Smart Way" (http://www.catb.org/~esr/faqs/smart-questions.html), which is linked to from the Tomcat mailing lists page:
Don't post homework questions
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by chris derham <ch...@derham.me.uk>.
> 2013/10/22 ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>:
>> Hello,
>>
>> I would like to know if is it possible to restrict the use of JDK classes
>> in Tomcat according to a list given in another file. ¿Is it possible by
>> creating a new Add-on? If it is possible, where can I find documentation
>> about creating Add-ons? I have looked up and I haven't found any
>> information about it (I only have found AddOns in Tomcat 3.3 but there is
>> nothing about creating new ones).
This sounds like a home work question. My spanish is bad, but alumnos
is surely student in spanish. Hence the OP has had the cheek to send
from the student account of his university. Do the mailing list rules
state home work questions are in or out of scope?
Chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Restrict the use of JDK classes Tomcat 7 or 6
Posted by Aurélien Terrestris <at...@gmail.com>.
You can run Tomcat with its Security Manager, then you can setup which
jar has which rights
have a look here :
http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html
2013/10/22 ANALIA DE PEDRO SANTAMARIA <10...@alumnos.uc3m.es>:
> Hello,
>
> I would like to know if is it possible to restrict the use of JDK classes
> in Tomcat according to a list given in another file. ¿Is it possible by
> creating a new Add-on? If it is possible, where can I find documentation
> about creating Add-ons? I have looked up and I haven't found any
> information about it (I only have found AddOns in Tomcat 3.3 but there is
> nothing about creating new ones).
>
> Another idea to do that is by modifying the source code. Could anybody tell
> me where I should search to do that?
>
> Thank you very much.
>
> Analía de Pedro
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org