You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Christian Beikov <ch...@gmail.com> on 2013/04/24 08:29:27 UTC
Policy files
Hello there!
I am using tomcat as an embedded container for a while now, it is really
amazing, but now I got stuck on a topic.
I am implementing a testsuite for automatic testing of uploaded
solutions by students. The deployment works like a charm, I also found
your StuckThreadDetectionValve very useful to kill threads of the
students applications.
The next assignment will involve some areas where I would like to
specify a policy file so that the students can't do anything they aren't
supposed to. Now to my problem.
One thing is that I want a policy file to be in the students projects,
so that they actually get the exceptions when they are doing something
wrong. What do I have to configure in these student web projects so that
they can e.g. deploy the project directly from netbeans to tomcat and
have the policy applied?
The other thing is that I want the policy file to be in my testsuite
project and configure it on demand when deploying the student solutions.
Currently I create an instance of StandardContext for each student web
application, then I configure the context and finally add it to the host
of the server. What do I need to configure, to apply the policy in this
case?
I hope someone can help me with that, thanks in advance!
--
Mit freundlichen Grüßen,
------------------------------------------------------------------------
*Christian Beikov*
Re: Policy files
Posted by Shanti Suresh <sh...@umich.edu>.
Hi Christian,
On Wed, Apr 24, 2013 at 11:25 PM, Christian Beikov <
christian.beikov@gmail.com> wrote:
>
>
> I just don't want to have these applications running on my computer not
> knowing what they actually do. To be honest I couldn't think of any
> permission I would give a student application. The libraries that can be
> used are predefined, so I give these jar files the permissions for
> reflection or whatever they need to work properly.
>
> Am I simplifying the whole thing and is what I want much harder to achive
> than I think?
>
>
>
> Have you considered running Tomcat in a chroot jail?
http://oreilly.com/catalog/tomcat/chapter/ch06.pdf -> Security Manager +
Chroot combination
A more dated link -
http://radioae6rt.wordpress.com/2006/04/22/chrooting-tomcat/
Thanks.
-Shanti
Re: Policy files
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Christian,
On 4/24/13 11:25 PM, Christian Beikov wrote:
> Well I understand that there is only one SecurityManager per JVM,
> but as you mentioned I can restrict actions for specific CodeBases.
> This is what I am actually trying to do. I want the student web
> applications to have only a hand full of permissions defined in a
> policy file.
I'm curious as to what permissions you want them to have while
restricting others. Can you give some examples?
> I think I explained my self wrong earlier. The policy file I am
> speaking of, the one I want to apply to student projects, is more
> like a set of permissions that I want to give the web applications.
> I mainly want my testsuite and everything packaged with it to have
> all permissions. Generally the student projects should have no
> permissions. I want to give these applications only a minimal set
> of permissions, only the ones they actually would need to fullfil
> their tasks.
I understand what you are saying, but examples would certainly help.
> The WebappClassLoader supports the method
> addPermission(Permission) which is nice somehow, but I don't want
> to hard code the permissions but rather have them in a policy file
> or so.
I actually had no idea that WebappClassLoader had a set of
"addPermission" methods. I'll have to read more about those.... they
seem to give access to the parent classes (URLClassLoader,
SecureClassLoader)'s permissions lists. Cool if it works.
I honestly had no idea that some ClassLoaders maintain their own
permissions lists.
> The reason for having the permissions in a policy file is mainly
> because I thought I can configure something in context.xml so that
> the policy file gets picked up by tomcat.
If you want this, then you'll have to do a couple of things:
1. Make sure the context.xml always has the stuff you want (and isn't
under control of the student, for instance -- otherwise they can just
give themselves whatever permissions they want)
2. Create a ServletContextListener that runs on startup
3. Your listener needs to parse your policy and apply it to the
WebappClassLoader. I wouldn't be surprised if the webapp itself is not
permitted to add permissions to the WebappClassLoader. You might have
to put your ServletContextListener higher-up in the ClassLoader
hierarchy in order to be allowed to call that method.
4. Figure out how to parse a policy file.
Note that #4 just means /your/ policy file. It doesn't have to be a
classic "Java Policy File". You could have a simple policy file like this:
java.io.File.read=/path/to/some/data
java.io.File.write=/dev/null
Then you can parse it any way you like. Use XML if it's more convenient.
> I just don't want to have these applications running on my computer
> not knowing what they actually do. To be honest I couldn't think of
> any permission I would give a student application. The libraries
> that can be used are predefined, so I give these jar files the
> permissions for reflection or whatever they need to work properly.
If you don't know what permissions they would need, maybe you should
wait until you actually need to give those permissions before you
spend a lot of time building infrastructure to support granting them.
> Am I simplifying the whole thing and is what I want much harder to
> achive than I think?
If it were me, I'd look at a particular project and imagine any
privileges you'd need to give to a webapp in order for it to function.
For instance, if you have a webapp that is just a "Hello World" then
you don't need any permissions.
If you need to access a database, then you'll need to give them access
to that, too. If everyone needs access to the same database, maybe
just make it a top-level permission that all code can access
localhost:1234 or whatever in order to contact the database.
I think you'll find that lots of what you want can be configured at
the global level without worrying too much about assigning permissions
to individual webapps. Instead, all webapps will likely need the same
permissions (e.g. reflection) and you can simply give *all* code in
the JVM permissions to do that.
Then you have much less code to write.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJReWOHAAoJEBzwKT+lPKRYDjIP+wY5GP++U4B9sTRbQLCjpOKZ
wCkg4QnaKP6/eWikJa2HpuQ0re2428utIxv+nXSRdACWXgIx/lQbD2oTF8OfNC86
1ltP8kDXA5kUDT5y4nbpGeWzl0wUuEM4Ce/wmq8mkyKTqvLj2vMDiXrUNSjfgrBS
UVUm/P3kn0E0oJubyRZ19IJITC8Iv7rnnppOSEPOz+hj1/zVbblkHK91UEqmLy4+
6kcdZ8Xxvq33vHWfCjsmosJuvIljh5SYl8CLTtEDv+gr/x/YweJoVA9m1tNXp97u
QgZrzrCBz5L+RBnplz1vZFae/eqhm2FPjVZL9p3Kw8utqZa03rj/ugwBZO1/WP7L
zv46CQaN0cRuM6RMik9rkwKjIIz8VPgr62zvfApkDamYpej07/HIG0lIVpSc6fa4
O9U4KjRTfCOCG2zZyE1eQq+Qzxg/MMlrik4uNQV/KNMM7WASFjOv1+c/Q7M9oeJm
c5dgInU3mTU6o+LW/b1By3sRxkadR5/Vhx3X+7aFGya+VBonkQrpFB9qV494bzvi
1+srWZzKWs//ayNilIuYS4SVRdTGgTvAl36DZAxAZ0KsGOQr8EwNCzId5l5lgyuR
HPGaTUtzzI3HTt52a0fKz+ZMlZsj1skXl11Gz+X2KsG7Yt1vuIaEppQjyFfTfyvR
IUWrlt3E/50rs2I14BZz
=HPn0
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Policy files
Posted by Christian Beikov <ch...@gmail.com>.
Well I understand that there is only one SecurityManager per JVM, but as
you mentioned I can restrict actions for specific CodeBases. This is
what I am actually trying to do. I want the student web applications to
have only a hand full of permissions defined in a policy file. I think I
explained my self wrong earlier. The policy file I am speaking of, the
one I want to apply to student projects, is more like a set of
permissions that I want to give the web applications. I mainly want my
testsuite and everything packaged with it to have all permissions.
Generally the student projects should have no permissions. I want to
give these applications only a minimal set of permissions, only the ones
they actually would need to fullfil their tasks.
The WebappClassLoader supports the method addPermission(Permission)
which is nice somehow, but I don't want to hard code the permissions but
rather have them in a policy file or so. The reason for having the
permissions in a policy file is mainly because I thought I can configure
something in context.xml so that the policy file gets picked up by tomcat.
I just don't want to have these applications running on my computer not
knowing what they actually do. To be honest I couldn't think of any
permission I would give a student application. The libraries that can be
used are predefined, so I give these jar files the permissions for
reflection or whatever they need to work properly.
Am I simplifying the whole thing and is what I want much harder to
achive than I think?
Am 24.04.2013 22:20, schrieb Christopher Schultz:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Christian,
>
> On 4/24/13 1:51 PM, Christian Beikov wrote:
>> Yes we are talking about security manager policies.
> Good :)
>
> There's a lot about Spring that I don't know about, so I was just
> checking that you weren't talking about some crazy IoC thing or
> annotation-driven magic that no mere mortal can follow.
>
>> So there is no possibility to just push the policy file to the
>> WebappClassLoader?
> Nope: the SecurityManager applies to the whole JVM. But, the policy
> can bless certain JARs, etc. as being privileged. So, you make Tomcat
> and whatever code you wrote privileged and then leave all the student
> code to run under the heavy-handed security policy.
>
>> As stated in the reply to Matrin Gainty there do exist methods to
>> restrict the webapp, but unfortunately no method for supplying a
>> policy file.
> Right: you can control the deployment descriptor(s) but not really
> much else.
>
>> So this means I have to parse the policy file myself and add the
>> permissions manually to the classloader?
> Uh... I don't think that's possible. I must admit I'm no ClassLoader
> ninja, but I don't think there's a way to tell a ClassLoader anything
> about security policies.
>
> What kinds of operations are you trying to restrict?
>
>> Are there any options in the context.xml I could set for specifying
>> a webapp local policy so that I don't have to fiddle around with
>> how tomcat is called? I know how to apply a policy at runtime, but
>> don't know how this affects tomcat when I apply it e.g. in a
>> ServletContextListener.
> I think I'd have to understand more about what you are trying to do in
> order to be helpful. The SecurityManager applies its policies globally
> and you can't customize anything on a per-ClassLoader basis. You can
> do it on a per-codebase basis, but you have to know the URL(s) of the
> codebase(s) in advance.
>
>> Would be cool if there was an option to do that kind of stuff.
> Yes, I rather think it would be cool to specify a security policy on a
> per-ClassLoader basis, but there are definitely some thorny issues
> there otherwise I think Sun/Oracle would have implemented that
> capability by now.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJReD6oAAoJEBzwKT+lPKRYDGAP/R9SjzcX0ENxQ5A7/N+S26M8
> Jd5sNOisQ9mdVowygJAwppYDqtUalmMZ5qZTtsyYZYWKn3QpiML10Qr36elFZsA5
> zoCA1JRB+hwC/vhNgJGdhhNxDOEQo66mfiJlfQ0rHpOGwVrGppAuSV4kVfX5aZCQ
> 9Ssq2HZvfLE7tL0pg+qnBT1AA9/HU+hAmk4GkCETSMR16jB8NrwI10ejU7gt1F4F
> BaUCULZvYtLRelbsAQTfz4ZOQL0FZq2zD85BeZ+hey0koinpr+nY1aRGy4ASbmrM
> Eke8ruYKW5xbVmSyQ0A4JmaYmMrYFfc7SgdR7UOkD21wbHA87fSHF9oNhhom2Tqd
> Qsdn89swuBwp6XkS1akbfRc6RJ4WPCxNfxBWceGWlJewtgY8XRD8lPYOsHCSiVN/
> SOSVnmCaa8Fs6ygk75wo6IKI+VlLRJqFSK5pr1iGK9hVC+xgBGB5APrhMhvSCUmO
> SuP6IxFMSRDhghlxUbDhd7hW7KZnpXGQCJZjSoEsW/ysjhwy0hfhLbkEGTyYV8Az
> wCap5r3eHc5KsHP0FK9F283DbiUhV8oHoLK0ddzKd9KrHbxap4Vekk2tqbUA52Vn
> gpcRk5vodI88w0mvtdc9b57luHPedmY87bqmayjqzh6VHixlT/O8+CQhmJLRrln3
> Wf6YgQg1Li6p//YLwHpo
> =TJPJ
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
Mit freundlichen Grüßen,
------------------------------------------------------------------------
*Christian Beikov*
Re: Policy files
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Christian,
On 4/24/13 1:51 PM, Christian Beikov wrote:
> Yes we are talking about security manager policies.
Good :)
There's a lot about Spring that I don't know about, so I was just
checking that you weren't talking about some crazy IoC thing or
annotation-driven magic that no mere mortal can follow.
> So there is no possibility to just push the policy file to the
> WebappClassLoader?
Nope: the SecurityManager applies to the whole JVM. But, the policy
can bless certain JARs, etc. as being privileged. So, you make Tomcat
and whatever code you wrote privileged and then leave all the student
code to run under the heavy-handed security policy.
> As stated in the reply to Matrin Gainty there do exist methods to
> restrict the webapp, but unfortunately no method for supplying a
> policy file.
Right: you can control the deployment descriptor(s) but not really
much else.
> So this means I have to parse the policy file myself and add the
> permissions manually to the classloader?
Uh... I don't think that's possible. I must admit I'm no ClassLoader
ninja, but I don't think there's a way to tell a ClassLoader anything
about security policies.
What kinds of operations are you trying to restrict?
> Are there any options in the context.xml I could set for specifying
> a webapp local policy so that I don't have to fiddle around with
> how tomcat is called? I know how to apply a policy at runtime, but
> don't know how this affects tomcat when I apply it e.g. in a
> ServletContextListener.
I think I'd have to understand more about what you are trying to do in
order to be helpful. The SecurityManager applies its policies globally
and you can't customize anything on a per-ClassLoader basis. You can
do it on a per-codebase basis, but you have to know the URL(s) of the
codebase(s) in advance.
> Would be cool if there was an option to do that kind of stuff.
Yes, I rather think it would be cool to specify a security policy on a
per-ClassLoader basis, but there are definitely some thorny issues
there otherwise I think Sun/Oracle would have implemented that
capability by now.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJReD6oAAoJEBzwKT+lPKRYDGAP/R9SjzcX0ENxQ5A7/N+S26M8
Jd5sNOisQ9mdVowygJAwppYDqtUalmMZ5qZTtsyYZYWKn3QpiML10Qr36elFZsA5
zoCA1JRB+hwC/vhNgJGdhhNxDOEQo66mfiJlfQ0rHpOGwVrGppAuSV4kVfX5aZCQ
9Ssq2HZvfLE7tL0pg+qnBT1AA9/HU+hAmk4GkCETSMR16jB8NrwI10ejU7gt1F4F
BaUCULZvYtLRelbsAQTfz4ZOQL0FZq2zD85BeZ+hey0koinpr+nY1aRGy4ASbmrM
Eke8ruYKW5xbVmSyQ0A4JmaYmMrYFfc7SgdR7UOkD21wbHA87fSHF9oNhhom2Tqd
Qsdn89swuBwp6XkS1akbfRc6RJ4WPCxNfxBWceGWlJewtgY8XRD8lPYOsHCSiVN/
SOSVnmCaa8Fs6ygk75wo6IKI+VlLRJqFSK5pr1iGK9hVC+xgBGB5APrhMhvSCUmO
SuP6IxFMSRDhghlxUbDhd7hW7KZnpXGQCJZjSoEsW/ysjhwy0hfhLbkEGTyYV8Az
wCap5r3eHc5KsHP0FK9F283DbiUhV8oHoLK0ddzKd9KrHbxap4Vekk2tqbUA52Vn
gpcRk5vodI88w0mvtdc9b57luHPedmY87bqmayjqzh6VHixlT/O8+CQhmJLRrln3
Wf6YgQg1Li6p//YLwHpo
=TJPJ
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Policy files
Posted by Christian Beikov <ch...@gmail.com>.
Yes we are talking about security manager policies.
So there is no possibility to just push the policy file to the
WebappClassLoader? As stated in the reply to Matrin Gainty there do
exist methods to restrict the webapp, but unfortunately no method for
supplying a policy file.
So this means I have to parse the policy file myself and add the
permissions manually to the classloader?
Are there any options in the context.xml I could set for specifying a
webapp local policy so that I don't have to fiddle around with how
tomcat is called? I know how to apply a policy at runtime, but don't
know how this affects tomcat when I apply it e.g. in a
ServletContextListener. Would be cool if there was an option to do that
kind of stuff.
Mit freundlichen Grüßen,
------------------------------------------------------------------------
*Christian Beikov*
Am 24.04.2013 19:13, schrieb Christopher Schultz:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Christian,
>
> On 4/24/13 2:29 AM, Christian Beikov wrote:
>> I am using tomcat as an embedded container for a while now, it is
>> really amazing, but now I got stuck on a topic. I am implementing a
>> testsuite for automatic testing of uploaded solutions by students.
>> The deployment works like a charm, I also found your
>> StuckThreadDetectionValve very useful to kill threads of the
>> students applications. The next assignment will involve some areas
>> where I would like to specify a policy file so that the students
>> can't do anything they aren't supposed to. Now to my problem.
> Cool.
>
>> One thing is that I want a policy file to be in the students
>> projects, so that they actually get the exceptions when they are
>> doing something wrong. What do I have to configure in these student
>> web projects so that they can e.g. deploy the project directly from
>> netbeans to tomcat and have the policy applied?
> I assume you are talking about SecurityManager policies.
>
> Unfortunately, the SecurityManager applies to the entire JVM, so you
> can't do something cool like allow one ClassLoader to run amok while
> classes loaded from another one are constrained. Instead, you can
> place limits on the entire JVM (e.g. no System.exit) and then poke
> holes in those protections for trusted content -- usually a specific
> JAR file, etc.
>
> If you are going to do that, you need to attempt privileged "actions"
> everywhere your driver code is going to do something that requires
> such privileges. If the student code tries to do something forbidden
> (e.g. System.exit), they'll get a SecurityException. If you try to do
> it without a privileged action, you'll also get an exception.
>
>> The other thing is that I want the policy file to be in my
>> testsuite project and configure it on demand when deploying the
>> student solutions. Currently I create an instance of
>> StandardContext for each student web application, then I configure
>> the context and finally add it to the host of the server. What do I
>> need to configure, to apply the policy in this case?
> You have to apply the policy when you launch the JVM via system
> properties on the command-line. Fortunately, all of your privileged
> code should be known in advance, so you shouldn't have to adjust
> anything for student-submitted code: all their stuff is limited by
> your policy.
>
> Remember that you have to give Tomcat all the privileges *it* needs as
> well as your own code. Check the catalina.policy file to see what
> privileges are necessary to properly run Tomcat under a SecurityManager.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJReBLUAAoJEBzwKT+lPKRYzOAP/iEB1IPyKjSSY/74IjYqR31G
> wzF6/HuEzwauYgdCxugxFhiogskUsHGnbgKtd4I0hGRtXwfLQf02c5foR6pV04F3
> dy4ViYvXTvTLgM6YqcqDEClFigfJdRZdqb26bRUvbrSacTAgp6ifm2Tc7yBpkcR2
> rWo0/zdCQTATHlryKnAtfpx0jngoXmyMxrNVH1efw36zN/C50zq26ri9VMG9vEcE
> TOy8w8lscj8PaCKj5e0skgvwKWjGrH4gplLOW07STK0Mtpb4rfSL5iua73CoaPsD
> PvnzlfgJsYWhlzWF6mExKlTDP+9UmC1195VSfVb3yPdSREf+Lk+PcpAIRnqj4Zma
> ZAQys1LcM5CUPzq4y6T4dokGDIXpwsBaphN7S4MKDp+vgb2W0Z6UbidjkUHiZ25r
> 1dPbt67f3Ro6gYRO/ggorc9y5/0yYs6xjaA9SuM7xvm4uGG4lEn092f6FBnd0+OZ
> 7t/6IylDSP5+CxCmXrPBu9TeJppq42biVz8VJaM+BJjlDKU6BIn+P2qPR/N1C2QK
> wR8aSbcxzKWekSkLv5VCnErCDbx+YekMWVfVfuQobQkMIha977cBHlqc+jhioG2g
> QIHaMAPA6JQMEQdSHrob98QirBI9FfZSDDdWQ/w9BuaAT3+bXXPKvUvgbLz14vN+
> CLya7aynTMumUFHBnnv2
> =MeqU
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
Re: Policy files
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Christian,
On 4/24/13 2:29 AM, Christian Beikov wrote:
> I am using tomcat as an embedded container for a while now, it is
> really amazing, but now I got stuck on a topic. I am implementing a
> testsuite for automatic testing of uploaded solutions by students.
> The deployment works like a charm, I also found your
> StuckThreadDetectionValve very useful to kill threads of the
> students applications. The next assignment will involve some areas
> where I would like to specify a policy file so that the students
> can't do anything they aren't supposed to. Now to my problem.
Cool.
> One thing is that I want a policy file to be in the students
> projects, so that they actually get the exceptions when they are
> doing something wrong. What do I have to configure in these student
> web projects so that they can e.g. deploy the project directly from
> netbeans to tomcat and have the policy applied?
I assume you are talking about SecurityManager policies.
Unfortunately, the SecurityManager applies to the entire JVM, so you
can't do something cool like allow one ClassLoader to run amok while
classes loaded from another one are constrained. Instead, you can
place limits on the entire JVM (e.g. no System.exit) and then poke
holes in those protections for trusted content -- usually a specific
JAR file, etc.
If you are going to do that, you need to attempt privileged "actions"
everywhere your driver code is going to do something that requires
such privileges. If the student code tries to do something forbidden
(e.g. System.exit), they'll get a SecurityException. If you try to do
it without a privileged action, you'll also get an exception.
> The other thing is that I want the policy file to be in my
> testsuite project and configure it on demand when deploying the
> student solutions. Currently I create an instance of
> StandardContext for each student web application, then I configure
> the context and finally add it to the host of the server. What do I
> need to configure, to apply the policy in this case?
You have to apply the policy when you launch the JVM via system
properties on the command-line. Fortunately, all of your privileged
code should be known in advance, so you shouldn't have to adjust
anything for student-submitted code: all their stuff is limited by
your policy.
Remember that you have to give Tomcat all the privileges *it* needs as
well as your own code. Check the catalina.policy file to see what
privileges are necessary to properly run Tomcat under a SecurityManager.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJReBLUAAoJEBzwKT+lPKRYzOAP/iEB1IPyKjSSY/74IjYqR31G
wzF6/HuEzwauYgdCxugxFhiogskUsHGnbgKtd4I0hGRtXwfLQf02c5foR6pV04F3
dy4ViYvXTvTLgM6YqcqDEClFigfJdRZdqb26bRUvbrSacTAgp6ifm2Tc7yBpkcR2
rWo0/zdCQTATHlryKnAtfpx0jngoXmyMxrNVH1efw36zN/C50zq26ri9VMG9vEcE
TOy8w8lscj8PaCKj5e0skgvwKWjGrH4gplLOW07STK0Mtpb4rfSL5iua73CoaPsD
PvnzlfgJsYWhlzWF6mExKlTDP+9UmC1195VSfVb3yPdSREf+Lk+PcpAIRnqj4Zma
ZAQys1LcM5CUPzq4y6T4dokGDIXpwsBaphN7S4MKDp+vgb2W0Z6UbidjkUHiZ25r
1dPbt67f3Ro6gYRO/ggorc9y5/0yYs6xjaA9SuM7xvm4uGG4lEn092f6FBnd0+OZ
7t/6IylDSP5+CxCmXrPBu9TeJppq42biVz8VJaM+BJjlDKU6BIn+P2qPR/N1C2QK
wR8aSbcxzKWekSkLv5VCnErCDbx+YekMWVfVfuQobQkMIha977cBHlqc+jhioG2g
QIHaMAPA6JQMEQdSHrob98QirBI9FfZSDDdWQ/w9BuaAT3+bXXPKvUvgbLz14vN+
CLya7aynTMumUFHBnnv2
=MeqU
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Fwd: Re: Policy files
Posted by Christian Beikov <ch...@gmail.com>.
Accidently mailed on tomee-list before ><
Thanks for the quick answer but it seems I didn't explain my situation
completely.
We use Maven for all assignments, I can control what base project they
have to use for a specific assignment. Also in my testsuite I
automatically build these projects and deploy the artifacts to my
embedded tomcat.
The problem is when it comes to the policy files. Where do I need to add
the path to the policy file for the base maven projects of the students?
Is there any option in context.xml or so that I can use?
The second problem is that I want to configure the policy for each
student project when deploying on embedded tomcat(since the students
could change the file in their projects). Where do I have to configure
the policy when instantiating the StandardContext myself? I saw that the
Loader of the context is of the type WebappLoader and the ClassLoader is
a WebappClassLoader. I also found a method addPermission in
WebappClassLoader, but I don't want to parse the policy file myself and
add the permissions one by one. Isn't there an attribute to set the
policy for that class loader?
So to summarize it a bit, I want to know what to configure in e.g.
context.xml(if that is the place where to configure the policy) to have
a specific policy applied.
Mit freundlichen Grüßen,
------------------------------------------------------------------------
*Christian Beikov*
Am 24.04.2013 12:48, schrieb Martin Gainty:
> Sooner or later your students will need to stop playing with IDEs and
> get serious about creating a real war
>
> Maven provides maven-war-plugin for creating deployable web archives
>
> as far as applying differing policies (or configurations) you can use
> archetypes for initial creation of the war
> http://www.sonatype.com/books/mvnex-book/reference/web-sect-creating-project.html
>
> properties for deployment configuration changes can be manipulated by
> passing attributes to MANIFEST.MF
>
> bash>mvn Dmaven.war.containerConfigXML=MYContextXML.xml
> org.apache.maven.plugins:maven-war-plugin:2.3:manifest
>
> http://maven.apache.org/plugins/maven-war-plugin/manifest-mojo.html#containerConfigXML
>
> bash>mvn org.apache.maven.plugins:maven-war-plugin:2.3:war
>
> the first command copies to META-INF your customised MYContextXML.xml
> (context)
> the second command builds out the war in \target folder
>
> http://maven.apache.org/plugins/maven-war-plugin/war-mojo.html
>
> *Viel Gluck*
> Martin
>
> ______________________________________________
> Thank the general and tell him I have no desire to drink with him or
> any other Russian *** ** * *****
> General George Patton
>
>
>
> > Date: Wed, 24 Apr 2013 08:29:27 +0200
> > From: christian.beikov@gmail.com
> > To: users@tomcat.apache.org
> > Subject: Policy files
> >
> > Hello there!
> >
> > I am using tomcat as an embedded container for a while now, it is
> really
> > amazing, but now I got stuck on a topic.
> > I am implementing a testsuite for automatic testing of uploaded
> > solutions by students. The deployment works like a charm, I also found
> > your StuckThreadDetectionValve very useful to kill threads of the
> > students applications.
> > The next assignment will involve some areas where I would like to
> > specify a policy file so that the students can't do anything they
> aren't
> > supposed to. Now to my problem.
> >
> > One thing is that I want a policy file to be in the students projects,
> > so that they actually get the exceptions when they are doing something
> > wrong. What do I have to configure in these student web projects so
> that
> > they can e.g. deploy the project directly from netbeans to tomcat and
> > have the policy applied?
> >
> > The other thing is that I want the policy file to be in my testsuite
> > project and configure it on demand when deploying the student
> solutions.
> > Currently I create an instance of StandardContext for each student web
> > application, then I configure the context and finally add it to the
> host
> > of the server. What do I need to configure, to apply the policy in this
> > case?
> >
> > I hope someone can help me with that, thanks in advance!
> > --
> >
> > Mit freundlichen Grüßen,
> > ------------------------------------------------------------------------
> > *Christian Beikov*
Re: Policy files
Posted by Christian Beikov <ch...@gmail.com>.
Thanks for the quick answer but it seems I didn't explain my situation
completely.
We use Maven for all assignments, I can control what base project they
have to use for a specific assignment. Also in my testsuite I
automatically build these projects and deploy the artifacts to my
embedded tomcat.
The problem is when it comes to the policy files. Where do I need to add
the path to the policy file for the base maven projects of the students?
Is there any option in context.xml or so that I can use?
The second problem is that I want to configure the policy for each
student project when deploying on embedded tomcat(since the students
could change the file in their projects). Where do I have to configure
the policy when instantiating the StandardContext myself? I saw that the
Loader of the context is of the type WebappLoader and the ClassLoader is
a WebappClassLoader. I also found a method addPermission in
WebappClassLoader, but I don't want to parse the policy file myself and
add the permissions one by one. Isn't there an attribute to set the
policy for that class loader?
So to summarize it a bit, I want to know what to configure in e.g.
context.xml(if that is the place where to configure the policy) to have
a specific policy applied.
Mit freundlichen Grüßen,
------------------------------------------------------------------------
*Christian Beikov*
Am 24.04.2013 12:48, schrieb Martin Gainty:
> Sooner or later your students will need to stop playing with IDEs and
> get serious about creating a real war
>
> Maven provides maven-war-plugin for creating deployable web archives
>
> as far as applying differing policies (or configurations) you can use
> archetypes for initial creation of the war
> http://www.sonatype.com/books/mvnex-book/reference/web-sect-creating-project.html
>
> properties for deployment configuration changes can be manipulated by
> passing attributes to MANIFEST.MF
>
> bash>mvn Dmaven.war.containerConfigXML=MYContextXML.xml
> org.apache.maven.plugins:maven-war-plugin:2.3:manifest
>
> http://maven.apache.org/plugins/maven-war-plugin/manifest-mojo.html#containerConfigXML
>
> bash>mvn org.apache.maven.plugins:maven-war-plugin:2.3:war
>
> the first command copies to META-INF your customised MYContextXML.xml
> (context)
> the second command builds out the war in \target folder
>
> http://maven.apache.org/plugins/maven-war-plugin/war-mojo.html
>
> *Viel Gluck*
> Martin
>
> ______________________________________________
> Thank the general and tell him I have no desire to drink with him or
> any other Russian *** ** * *****
> General George Patton
>
>
>
> > Date: Wed, 24 Apr 2013 08:29:27 +0200
> > From: christian.beikov@gmail.com
> > To: users@tomcat.apache.org
> > Subject: Policy files
> >
> > Hello there!
> >
> > I am using tomcat as an embedded container for a while now, it is
> really
> > amazing, but now I got stuck on a topic.
> > I am implementing a testsuite for automatic testing of uploaded
> > solutions by students. The deployment works like a charm, I also found
> > your StuckThreadDetectionValve very useful to kill threads of the
> > students applications.
> > The next assignment will involve some areas where I would like to
> > specify a policy file so that the students can't do anything they
> aren't
> > supposed to. Now to my problem.
> >
> > One thing is that I want a policy file to be in the students projects,
> > so that they actually get the exceptions when they are doing something
> > wrong. What do I have to configure in these student web projects so
> that
> > they can e.g. deploy the project directly from netbeans to tomcat and
> > have the policy applied?
> >
> > The other thing is that I want the policy file to be in my testsuite
> > project and configure it on demand when deploying the student
> solutions.
> > Currently I create an instance of StandardContext for each student web
> > application, then I configure the context and finally add it to the
> host
> > of the server. What do I need to configure, to apply the policy in this
> > case?
> >
> > I hope someone can help me with that, thanks in advance!
> > --
> >
> > Mit freundlichen Grüßen,
> > ------------------------------------------------------------------------
> > *Christian Beikov*