Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1117285

Summary: EAP 6.1.2.CR2 doesn't start with security manager when a deployment permission is specified
Product: [JBoss] JBoss Enterprise Application Platform 6 Reporter: Josef Cacek <jcacek>
Component: Logging, VFSAssignee: Carlo de Wolf <cdewolf>
Status: CLOSED CURRENTRELEASE QA Contact: Josef Cacek <jcacek>
Severity: high Docs Contact: Russell Dickenson <rdickens>
Priority: unspecified    
Version: 6.1.2CC: cdewolf, dosoudil, myarboro, olukas
Target Milestone: CR3   
Target Release: EAP 6.1.2   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-08-07 12:12:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1073545, 1115372    

Description Josef Cacek 2014-07-08 12:49:31 UTC
EAP 6.1.2.CR2 doesn't start when Java Security Manager (JSM) is enabled and a deployment permission is specified. The issue only occurs on following Java versions:
- Oracle Java 1.6.x
- IBM Java 1.6.x with customized policy.provider (sun.security.provider.PolicyFile)

The problem is related to JBoss Modules upgrade in CR2. It does not occur with CR1 build. This update requires also an upgrade of the VFS module which was not done. The original VFS implementation (see e.g. VFSUtils class) tries to use JBoss LogManager, but its initialization fails. The new VFS implementation (e.g. in 6.2.0) uses its own logging classes. 

When the VFS module is replaced in 6.1.2 by the one from 6.2.0, the server starts.

How to reproduce
================

1) create a custom policy file /tmp/eap.policy with a deployment permission. For instance:
grant codeBase "vfs:/content/myapp.war" {
  permission java.security.AllPermission;
};
grant {
  permission java.security.AllPermission;
};

2) enable JSM in standalone.conf: Add following line at the end of file:
JAVA_OPTS="$JAVA_OPTS -Djava.security.manager -Djava.security.policy=/tmp/eap.policy -Djboss.home.dir=$JBOSS_HOME -Djboss.modules.policy-permissions=true"

3) run standalone.sh - it fails with:
ERROR: JBAS014612: Operation ("parallel-extension-add") failed - address: ([])
java.lang.RuntimeException: JBAS014670: Failed initializing module org.jboss.as.logging

Important part of the stack trace
=================================
...
  [13] java.util.logging.LogManager.<clinit> (LogManager.java:156)
  [14] org.jboss.logging.LoggerProviders.tryJBossLogManager (LoggerProviders.java:98)
  [15] org.jboss.logging.LoggerProviders.findProvider (LoggerProviders.java:63)
  [16] org.jboss.logging.LoggerProviders.find (LoggerProviders.java:31)
  [17] org.jboss.logging.LoggerProviders.<clinit> (LoggerProviders.java:28)
  [18] org.jboss.logging.Logger.getLogger (Logger.java:2,160)
  [19] org.jboss.logging.Logger.getLogger (Logger.java:2,185)
  [20] org.jboss.vfs.VFSUtils.<clinit> (VFSUtils.java:76)
  [21] org.jboss.vfs.protocol.AbstractURLConnection.toURI (AbstractURLConnection.java:90)
  [22] org.jboss.vfs.protocol.VirtualFileURLConnection.<init> (VirtualFileURLConnection.java:48)
  [23] org.jboss.vfs.protocol.VirtualFileURLStreamHandler.openConnection (VirtualFileURLStreamHandler.java:37)
  [24] java.net.URL.openConnection (URL.java:945)
  [25] sun.security.provider.PolicyFile.canonicalizeCodebase (PolicyFile.java:1,784)
  [26] sun.security.provider.PolicyFile.getCodeSource (PolicyFile.java:768)
  [27] sun.security.provider.PolicyFile.addGrantEntry (PolicyFile.java:792)
  [28] sun.security.provider.PolicyFile.init (PolicyFile.java:638)
  [29] sun.security.provider.PolicyFile.access$400 (PolicyFile.java:264)
  [30] sun.security.provider.PolicyFile$3.run (PolicyFile.java:531)
  [31] java.security.AccessController.doPrivileged (native method)
  [32] sun.security.provider.PolicyFile.initPolicyFile (PolicyFile.java:504)
  [33] sun.security.provider.PolicyFile.initPolicyFile (PolicyFile.java:490)
  [34] sun.security.provider.PolicyFile.init (PolicyFile.java:449)
  [35] sun.security.provider.PolicyFile.refresh (PolicyFile.java:1,087)
  [36] org.jboss.modules.ModulesPolicy.refresh (ModulesPolicy.java:79)
  [37] org.jboss.modules.Main.main (Main.java:408)

Comment 3 Ondrej Lukas 2014-07-15 06:58:29 UTC
Verified in EAP 6.1.2.CR3.