Limit access to (certain) system properties through JMX

[Zoran Regvart <zo...@regvart.com>]

Hi Karafers,
I'm trying to build support for masked or encrypted system properties
for bundles running in Karaf. So for instance instead of specifying
-Djavax.net.ssl.trustStorePassword=my_secret_password you could
specify -Djavax.net.ssl.trustStorePassword=<something masked>.

And the only way to make this work for unmodified bundles is to
replace the <something masked> value with the clear text value. That
part I think i nicked.

Now I face another problem, if one connects via JMX the clear text
value is present there, and I would like it not to be present, by
either displaying it with original masked value or by eliminating it
from the list of system properties.

I've tried adding dynamic RBAC configuration that limits access to
java.lang:type=Runtime getSystemProperties -- but that removes all
system properties, bit of a overkill IMHO.

Can you think of another way to achieve this? Perhaps add another
layer to the RBAC mechanism, akin to @PostFilter in Spring Secuirty
but as a plugin interface contributing bundles can implement?

I also think it's a bit of an overkill to patch java.lang.System via
bootclasspath

zoran
-- 
Zoran Regvart

Re: Limit access to (certain) system properties through JMX

[Zoran Regvart <zo...@regvart.com>]

Hi Jean-Baptiste,

On Thu, Jan 5, 2017 at 12:39 PM, Jean-Baptiste Onofré <jb...@nanthrax.net> wrote:
> As a workaround, you can create your own MBean filtering the properties and
> then security as you want using the RBAC.

Yes! this has helped me, I unregistered the Runtime bean and
registered my proxy that filters clear text properties.

Now if only I could find out find out what is invoking this with this
very shallow stack trace (I guess from native):

    at java.lang.System.getProperties(System.java:628)
    at sun.misc.VMSupport.serializePropertiesToByteArray(VMSupport.java:75)

but that's for another mailing list, here presented only as a
curiosity (the first page of VisualVM is using this instead of Runtime
JMX bean to access system properties)

thank you :)

zoran
-- 
Zoran Regvart

Re: Limit access to (certain) system properties through JMX

[Jean-Baptiste Onofré <jb...@nanthrax.net>]

Hi Zoran,

the answer is probably the RBAC/ACL but it's all or nothing in term of 
granularity.

As a workaround, you can create your own MBean filtering the properties 
and then security as you want using the RBAC.

Regards
JB

On 01/05/2017 12:30 PM, Zoran Regvart wrote:
> Hi Karafers,
> I'm trying to build support for masked or encrypted system properties
> for bundles running in Karaf. So for instance instead of specifying
> -Djavax.net.ssl.trustStorePassword=my_secret_password you could
> specify -Djavax.net.ssl.trustStorePassword=<something masked>.
>
> And the only way to make this work for unmodified bundles is to
> replace the <something masked> value with the clear text value. That
> part I think i nicked.
>
> Now I face another problem, if one connects via JMX the clear text
> value is present there, and I would like it not to be present, by
> either displaying it with original masked value or by eliminating it
> from the list of system properties.
>
> I've tried adding dynamic RBAC configuration that limits access to
> java.lang:type=Runtime getSystemProperties -- but that removes all
> system properties, bit of a overkill IMHO.
>
> Can you think of another way to achieve this? Perhaps add another
> layer to the RBAC mechanism, akin to @PostFilter in Spring Secuirty
> but as a plugin interface contributing bundles can implement?
>
> I also think it's a bit of an overkill to patch java.lang.System via
> bootclasspath
>
> zoran
>

-- 
Jean-Baptiste Onofr�
jbonofre@apache.org
http://blog.nanthrax.net
Talend - http://www.talend.com