Bug 1065994

Summary:	[GSS] (6.2.x) Cannot change application permissions on EAP 6 when the Java Security Manager is enabled
Product:	[JBoss] JBoss Enterprise Application Platform 6	Reporter:	Derek Horton <dehort>
Component:	jbossas	Assignee:	Ivo Studensky <istudens>
Status:	CLOSED DUPLICATE	QA Contact:	Josef Cacek <jcacek>
Severity:	high	Docs Contact:	Russell Dickenson <rdickens>
Priority:	unspecified
Version:	6.2.0	CC:	abn, cdewolf, david.lloyd, istudens, jason.greene, jcacek, tfonteyn, vtunka
Target Milestone:	CR3
Target Release:	EAP 6.2.3
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	1067620 (view as bug list)		Environment:
Last Closed:	2014-04-17 11:14:47 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1067620
Bug Blocks:	953259, 1067532, 1067621, 1076629

Description Derek Horton 2014-02-17 13:18:05 UTC

Description of problem:

It looks like all deployed applications are granted "AllPermission" and there does not appear to be a way to change this.

Changing the grant statements in the policy file (-Djava.security.policy) doesn't seem to affect the permissions.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.  Create a war that reads a file from the file system
2.  Configure JBoss to use the java security manager
3.  Hit the web application

Actual results:
The web application can access files on the file system.


Expected results:
The web application should not be able to access files on the file system.

Additional info:

Comment 1 Derek Horton 2014-02-17 13:30:01 UTC

Make the following config changes:

JAVA_OPTS="$JAVA_OPTS -Djava.security.manager -Djboss.home.dir=$JBOSS_HOME -Djava.security.policy==$PWD/server.policy"
JAVA_OPTS="$JAVA_OPTS -Djboss.modules.policy-permissions=true"



diff --git a/bin/standalone.sh b/bin/standalone.sh
index 6324aa5..1c119e2 100755
--- a/bin/standalone.sh
+++ b/bin/standalone.sh
@@ -272,6 +272,7 @@ while true; do
          -jar \"$JBOSS_HOME/jboss-modules.jar\" \
          -mp \"${JBOSS_MODULEPATH}\" \
          -jaxpmodule "javax.xml.jaxp-provider" \
+         -secmgr \
          org.jboss.as.standalone \
          -Djboss.home.dir=\"$JBOSS_HOME\" \
          -Djboss.server.base.dir=\"$JBOSS_BASE_DIR\" \
diff --git a/modules/system/layers/base/org/jboss/as/host-controller/main/module.xml b/modules/system/layers/base/org/jboss/as/host-controller/main/module.
xml
index 6a48ee4..8dc16ec 100644
--- a/modules/system/layers/base/org/jboss/as/host-controller/main/module.xml
+++ b/modules/system/layers/base/org/jboss/as/host-controller/main/module.xml
@@ -37,7 +37,7 @@
     <dependencies>
         <module name="javax.api"/>
         <module name="org.jboss.staxmapper"/>
-        <module name="org.jboss.vfs"/>
+        <module name="org.jboss.vfs" services="import"/>
         <module name="org.jboss.as.controller"/>
         <module name="org.jboss.as.core-security"/>        
         <module name="org.jboss.common-core"/>
diff --git a/modules/system/layers/base/org/jboss/as/server/main/module.xml b/modules/system/layers/base/org/jboss/as/server/main/module.xml
index 810b681..6a61c97 100644
--- a/modules/system/layers/base/org/jboss/as/server/main/module.xml
+++ b/modules/system/layers/base/org/jboss/as/server/main/module.xml
@@ -52,7 +52,7 @@
         <module name="org.jboss.sasl"/>
         <module name="org.jboss.stdio"/>
         <module name="org.jboss.threads"/>
-        <module name="org.jboss.vfs"/>
+        <module name="org.jboss.vfs" services="import"/>
         <module name="org.jboss.as.controller"/>
         <module name="org.jboss.as.deployment-repository"/>
         <module name="org.jboss.as.domain-http-interface"/>

Comment 2 JBoss JIRA Server 2014-02-20 23:02:57 UTC

David Lloyd <david.lloyd> updated the status of jira MODULES-184 to Resolved

Comment 11 Ivo Studensky 2014-04-15 11:21:50 UTC

The fix comes in bz1080939.

Comment 12 Ivo Studensky 2014-04-17 11:14:47 UTC


*** This bug has been marked as a duplicate of bug 1080939 ***