Tomcat / SecurityManager problem

[Rick Horowitz <rh...@ni4u.com>]

Help!!

I'm trying to use Tomcat with the default SecurityManager and cannot
figure out why I am running into the access control exception described
here.

I am running on WinNT 4.0 sp5 with jdk 1.3 and built Tomcat 3.2b4 from
the sources, so my tomcat.home is d:\tomcat2\build\tomcat.

I'm running Tomcat in JBuilder 3.5 (which runs fine without the security
manager turned on). 

My Java VM settings are as follows: (Note, I'm running with a debug
version of rt.jar, but this too seems fine when not running with a
SecurityManager)

-classic -Xbootclasspath/p:d:\jdk1.3\jre\lib\rt-debug.jar
-Dtomcat.home=d:\tomcat2\build\tomcat -Djava.security.manager
-Djava.security.policy=d:\JAMMConsulting\Corban\apps\prototype\config\security\corban_java2.policy
-Djava.security.auth.policy==d:\JAMMConsulting\Corban\apps\prototype\config\security\corban_jaas.policy
-Djava.security.auth.login.config==d:\JAMMConsulting\Corban\apps\prototype\config\security\corban_jaas.config
-DAPP_HOME=d:\JAMMConsulting\Corban\apps\prototype
-Duser.dir=d:\tomcat2\build\tomcat\bin

I am trying to use JAAS to restrict access to certain servlet requests
on a per logged in user basis, but the problem described here happens
before my use of JAAS even kicks in, so I think it can be ignored for
the time being.

I'm getting the following stack trace when I try to access my index.jsp
page:

java.security.AccessControlException: access denied
(java.util.PropertyPermission tomcat.sessionid.randomclass read)

	at
java.security.AccessControlContext.checkPermission(AccessControlContext.java:272)

	at
java.security.AccessController.checkPermission(AccessController.java:399)

	at java.lang.SecurityManager.checkPermission(SecurityManager.java:545)

	at
java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1278)

	at java.lang.System.getProperty(System.java:560)

	at
org.apache.tomcat.util.SessionIdGenerator.getIdentifier(SessionIdGenerator.java:123)

	at
org.apache.tomcat.util.SessionIdGenerator.generateId(SessionIdGenerator.java:176)

	at
org.apache.tomcat.util.SessionUtil.generateSessionId(SessionUtil.java:179)

	at
org.apache.tomcat.session.StandardManager.getNewSession(StandardManager.java:378)

	at
org.apache.tomcat.session.StandardSessionInterceptor.newSessionRequest(StandardSessionInterceptor.java:160)

	at
org.apache.tomcat.core.ContextManager.doNewSessionRequest(ContextManager.java:865)

	at org.apache.tomcat.core.RequestImpl.getSession(RequestImpl.java:468)

	at
org.apache.tomcat.facade.HttpServletRequestFacade.getSession(HttpServletRequestFacade.java:381)

	at
org.apache.jasper.runtime.PageContextImpl._initialize(PageContextImpl.java:175)

	at
org.apache.jasper.runtime.PageContextImpl.initialize(PageContextImpl.java:151)

	at
org.apache.jasper.runtime.JspFactoryImpl.getPageContext(JspFactoryImpl.java:99)

	at
jsp._0002fjsp_0002findex_0002ejspindex_jsp_0._jspService(_0002fjsp_0002findex_0002ejspindex_jsp_0.java:51)

	at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:119)

	at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

	at
org.apache.jasper.servlet.JspServlet$JspServletWrapper.service(JspServlet.java:177)

	at
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:309)

	at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:382)

	at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

	at
org.apache.tomcat.core.ServletWrapper.doService(ServletWrapper.java:387)

	at org.apache.tomcat.core.Handler.service(Handler.java:263)

	at
org.apache.tomcat.core.ServletWrapper.service(ServletWrapper.java:371)

	at
org.apache.tomcat.core.ContextManager.internalService(ContextManager.java:749)

	at
org.apache.tomcat.core.ContextManager.service(ContextManager.java:695)

	at
org.apache.tomcat.service.http.HttpConnectionHandler.processConnection(HttpConnectionHandler.java:207)

	at
org.apache.tomcat.service.TcpWorkerThread.runIt(PoolTcpEndpoint.java:403)

	at
org.apache.tomcat.util.ThreadPool$ControlRunnable.run(ThreadPool.java:498)

	at java.lang.Thread.run(Thread.java:484)


As you can see, access is denied for a <java.util.PropertyPermission
tomcat.sessionid.randomclass read> attempt.  I have the following
settings, among others, in my configuration files:

1. Default java.security file - left unchanged, so it references the
default policy files:
  policy.url.1=file:${java.home}/lib/security/java.policy
  policy.url.2=file:${user.home}/.java.policy
  (I am not using a .java.policy file in my user.home directory)

2. java.policy - unchanged from default

3. corban_java2.policy - this policy file is added to my policy by the
following system property in my java run statement:
-Djava.security.policy=d:\JAMMConsulting\Corban\apps\prototype\config\security\corban_java2.policy 

corban_java2.policy contains the following grant entries:

  // javac
  grant codeBase "file:${java.home}/lib/-" {
       permission java.security.AllPermission;
  };


  // Tomcat permissions are specified in the
${TOMCAT_HOME}/conf/tomcat.policy file
  // Repeated here...

  // Tomcat gets all permissions
  grant codeBase "file:/d:/tomcat2/build/tomcat/lib/-" {
       permission java.security.AllPermission;
  };

  grant codeBase "file:/d:/tomcat2/build/tomcat/classes/-" {
	permission java.security.AllPermission;
  };


  // Grant read access on webapp dir and write in workdir

  grant codeBase "file:/d:/tomcat2/build/tomcat/webapps/corban/-" {
      permission java.net.SocketPermission "localhost:1024-", "listen";
      permission java.util.PropertyPermission "*", "read";
  };
  grant codeBase
"file:/d:/tomcat2/build/tomcat/work/localhost_8080%2Fcorban/-" {
      permission java.net.SocketPermission "localhost:1024-", "listen";
      permission java.util.PropertyPermission "*", "read";
	permission java.security.AllPermission;
  };

4. server.xml - in this file, I included a <Context> element containing
a <Permission> element, as follows: (According to tomcat_security.txt, I
would expect Tomcat to add this Permission for the application context
/corban)

  <Context path="/corban" 
     docBase="webapps/corban" 
     debug="9" 
     reloadable="false" 
     trusted="false" > 
    <Permission className="java.util.PropertyPermission"
attribute="tomcat.sessionid.randomclass" 	value="read"/>
  </Context>

I really could use some help on this..I've already written the whole
framework for restricting servlet access with JAAS, and don't want to
back it out.

Thanks very much in advance,

Rick Horowitz