You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@karaf.apache.org by ff...@apache.org on 2015/07/02 12:03:05 UTC
karaf git commit: [KARAF-3823]introduce
karaf.secured.command.compulsory.roles system property (cherry picked from
commit 648f860b3da95a2d8d06923130af06b5f41775a0)
Repository: karaf
Updated Branches:
refs/heads/karaf-3.0.x b25e6c00d -> 01a1f2b69
[KARAF-3823]introduce karaf.secured.command.compulsory.roles system property
(cherry picked from commit 648f860b3da95a2d8d06923130af06b5f41775a0)
Project: http://git-wip-us.apache.org/repos/asf/karaf/repo
Commit: http://git-wip-us.apache.org/repos/asf/karaf/commit/01a1f2b6
Tree: http://git-wip-us.apache.org/repos/asf/karaf/tree/01a1f2b6
Diff: http://git-wip-us.apache.org/repos/asf/karaf/diff/01a1f2b6
Branch: refs/heads/karaf-3.0.x
Commit: 01a1f2b691dde3858ab157e4739714ac32ff3714
Parents: b25e6c0
Author: Freeman Fang <fr...@gmail.com>
Authored: Thu Jul 2 13:56:48 2015 +0800
Committer: Freeman Fang <fr...@gmail.com>
Committed: Thu Jul 2 18:00:24 2015 +0800
----------------------------------------------------------------------
.../resources/resources/etc/system.properties | 7 ++++++
.../service/guard/impl/GuardProxyCatalog.java | 24 +++++++++++++++++---
2 files changed, 28 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/karaf/blob/01a1f2b6/assemblies/features/framework/src/main/resources/resources/etc/system.properties
----------------------------------------------------------------------
diff --git a/assemblies/features/framework/src/main/resources/resources/etc/system.properties b/assemblies/features/framework/src/main/resources/resources/etc/system.properties
index 6ceb39a..801117d 100644
--- a/assemblies/features/framework/src/main/resources/resources/etc/system.properties
+++ b/assemblies/features/framework/src/main/resources/resources/etc/system.properties
@@ -110,6 +110,13 @@ org.apache.aries.proxy.weaving.disabled = org.objectweb.asm.*,org.slf4j.*,org.ap
karaf.secured.services = (&(osgi.command.scope=*)(osgi.command.function=*))
#
+# By default, if there's no ACL policy for a certain karaf command, this command is allowed to access
+# without the RBAC. We can change this behavior by enable the following property, which means
+# if a karaf command has no corresponding ACL then access it must have one of the karaf.secured.command.compulsory.roles
+#
+#karaf.secured.command.compulsory.roles=admin
+
+#
# Security properties
#
# To enable OSGi security, uncomment the properties below,
http://git-wip-us.apache.org/repos/asf/karaf/blob/01a1f2b6/service/guard/src/main/java/org/apache/karaf/service/guard/impl/GuardProxyCatalog.java
----------------------------------------------------------------------
diff --git a/service/guard/src/main/java/org/apache/karaf/service/guard/impl/GuardProxyCatalog.java b/service/guard/src/main/java/org/apache/karaf/service/guard/impl/GuardProxyCatalog.java
index 396a768..b6344b5 100644
--- a/service/guard/src/main/java/org/apache/karaf/service/guard/impl/GuardProxyCatalog.java
+++ b/service/guard/src/main/java/org/apache/karaf/service/guard/impl/GuardProxyCatalog.java
@@ -57,6 +57,7 @@ import org.slf4j.LoggerFactory;
public class GuardProxyCatalog implements ServiceListener {
public static final String KARAF_SECURED_SERVICES_SYSPROP = "karaf.secured.services";
public static final String SERVICE_GUARD_ROLES_PROPERTY = "org.apache.karaf.service.guard.roles";
+ public static final String KARAF_SECURED_COMMAND_COMPULSORY_ROLES_PROPERTY = "karaf.secured.command.compulsory.roles";
static final String PROXY_CREATOR_THREAD_NAME = "Secure OSGi Service Proxy Creator";
static final String PROXY_SERVICE_KEY = "." + GuardProxyCatalog.class.getName(); // The only currently used value is Boolean.TRUE
@@ -74,15 +75,24 @@ public class GuardProxyCatalog implements ServiceListener {
final ServiceTracker<ProxyManager, ProxyManager> proxyManagerTracker;
final ConcurrentMap<Long, ServiceRegistrationHolder> proxyMap = new ConcurrentHashMap<Long, ServiceRegistrationHolder>();
final BlockingQueue<CreateProxyRunnable> createProxyQueue = new LinkedBlockingQueue<CreateProxyRunnable>();
+ final String compulsoryRoles;
// These two variables control the proxy creator thread, which is started as soon as a ProxyManager Service
// becomes available.
volatile boolean runProxyCreator = true;
volatile Thread proxyCreatorThread = null;
+
+
GuardProxyCatalog(BundleContext bc) throws Exception {
LOG.trace("Starting GuardProxyCatalog");
myBundleContext = bc;
+
+ compulsoryRoles = System.getProperty(GuardProxyCatalog.KARAF_SECURED_COMMAND_COMPULSORY_ROLES_PROPERTY);
+ if (compulsoryRoles == null) {
+ //default behavior as before, no compulsory roles for a karaf command without the ACL
+ LOG.info("No compulsory roles for a karaf command without the ACL as its system property is not set: {}", GuardProxyCatalog.KARAF_SECURED_COMMAND_COMPULSORY_ROLES_PROPERTY);
+ }
// The service listener is used to update/unregister proxies if the backing service changes/goes away
bc.addServiceListener(this);
@@ -483,8 +493,9 @@ public class GuardProxyCatalog implements ServiceListener {
// This can probably be optimized. Maybe we can cache the config object relevant instead of
// walking through all of the ones that have 'service.guard'.
+ Object guardFilter = null;
for (Configuration config : getServiceGuardConfigs()) {
- Object guardFilter = config.getProperties().get(SERVICE_GUARD_KEY);
+ guardFilter = config.getProperties().get(SERVICE_GUARD_KEY);
if (guardFilter instanceof String) {
Filter filter = myBundleContext.createFilter((String) guardFilter);
if (filter.match(serviceReference)) {
@@ -504,8 +515,15 @@ public class GuardProxyCatalog implements ServiceListener {
}
if (!foundMatchingConfig) {
- // No mappings for this service, anyone can invoke
- return null;
+ if (compulsoryRoles != null && (guardFilter instanceof String)
+ && ((String)guardFilter).indexOf("osgi.command.scope") > 0
+ && ((String)guardFilter).indexOf("osgi.command.functio") > 0) {
+ //use compulsoryRoles roles for those karaf command without any ACL
+ roleMappings.put(Specificity.NAME_MATCH, ACLConfigurationParser.parseRoles(compulsoryRoles));
+ } else {
+ // No mappings for this service, anyone can invoke
+ return null;
+ }
}
if (roleMappings.size() == 0) {