You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2006/01/22 20:27:48 UTC
DO NOT REPLY [Bug 38352] New: - Additional Entries for Default catalina.policy file.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38352>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38352
Summary: Additional Entries for Default catalina.policy file.
Product: Tomcat 5
Version: 5.5.14
Platform: Other
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: gsexton@mhsoftware.com
This patch adds additional entries to the catalina.policy file. Specifically:
The catalina.base/shared directory is added and given equal permissions to
catalina.home/common
java.io.tmpdir is now readable.
javax.servlet.context.tempdir is now readable. I think to be compliant with the
spec, this must be allowed.
Directory specified by java.io.tmpdir (which is what tomcat points
javax.servlet.context.tempdir to) is now read, write, delete. Again, I think the
spec requires this.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 38352] - Additional Entries for Default catalina.policy file.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38352>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38352
------- Additional Comments From gsexton@mhsoftware.com 2006-01-22 20:28 -------
Created an attachment (id=17486)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=17486&action=view)
A diff file incorporating proposed changes.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 38352] - Additional Entries for Default catalina.policy file.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38352>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38352
------- Additional Comments From gsexton@mhsoftware.com 2006-02-21 18:51 -------
Making java.io.tmpdir writable is fixing an implementation specific issue. The
spec says that the container MUST make temporary working directories available.
The IMPLEMENTATION that tomcat uses is to set javax.servlet.context.tempdir to
java.io.tempdir
So, my making that writable fixes an implementation specific issue for
tomcat. I'll say it again in case I wasn't clear.
1) The spec says javax.servlet.context.tempdir must be a working
directory
2) TOMCAT sets that value to the value of java.io.tmpdir
THEREFORE
FOR THE TOMCAT IMPLEMENTATION
java.io.tmpdir MUST BE WRITABLE.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 38352] - Additional Entries for Default catalina.policy file.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38352>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38352
yoavs@computer.org changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |william.barker@wilshire.com
Status|NEW |NEEDINFO
------- Additional Comments From yoavs@computer.org 2006-12-24 18:06 -------
So Bill and George, if I understand the result of your debate correctly, the
following lines from George's patch should be added to the default policy file:
permission java.util.PropertyPermission "java.io.tmpdir", "read";
permission java.util.PropertyPermission "javax.servlet.context.tempdir", "read";
permission java.io.FilePermission "${java.io.tmpdir}${file.separator}-", "read,
write, delete";
Is that right?
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 38352] - Additional Entries for Default catalina.policy file.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38352>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38352
------- Additional Comments From gsexton@mhsoftware.com 2006-02-21 23:02 -------
I was wrong. tempdir is not defined in terms of java.io.tmpdir. I apologize to
Bill whom I said was wrong and wrote an inflamatory and ill-advised message to.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 38352] - Additional Entries for Default catalina.policy file.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38352>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38352
------- Additional Comments From william.barker@wilshire.com 2006-02-21 03:24 -------
(In reply to comment #0)
Ok, lets see if I can get myself fired here ;-).
> This patch adds additional entries to the catalina.policy file. Specifically:
> The catalina.base/shared directory is added and given equal permissions to
> catalina.home/common
If it works for you, fine. Change it in your copy. However, in general
${catalina.base}/shared will consist of untrusted code, so I don't think it's
a good idea to trust it in the default policy file (which, by design, tries to
be as strict as possible).
> java.io.tmpdir is now readable.
Don't see the need. If you depend on this, your app is non-portable since
there is no requirement that javax.servlet.context.tempdir has any relation to
java.io.tmpdir. In fact, a servlet container is perfectly free to set
java.io.tmpdir to /dev/null if it wants.
> javax.servlet.context.tempdir is now readable. I think to be compliant with
the
> spec, this must be allowed.
This is a request attribute, not a System attribute. This does nothing.
> Directory specified by java.io.tmpdir (which is what tomcat points
> javax.servlet.context.tempdir to) is now read, write, delete. Again, I think
the
> spec requires this.
Would need to research this one. Like pretty much everybody else, I don't
spend enough time testing with SM.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 38352] - Additional Entries for Default catalina.policy file.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=38352>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=38352
------- Additional Comments From william.barker@wilshire.com 2006-02-22 05:51 -------
Created an attachment (id=17767)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=17767&action=view)
Simple JSP page to exibit the bug
Yes, you have a legitimate bug here. It is true that
javax.servlet.context.tempdir is not writable with the default catalina.policy
settings (in violation of the spec) when running with a SM.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org