Безопасность Java 2 с Axis2 1.4 в Websphere 7 - PullRequest
Новая
       43

Безопасность Java 2 с Axis2 1.4 в Websphere 7

0 голосов
/ 08 марта 2012

У меня очень сложное приложение (скажем, корпоративное приложение), развернутое в Websphere 7 (с родительской политикой загрузчика последнего класса), которое содержит несколько зависимостей. Развертываемый файл .ear содержит 4 файла .war внутри. Одним из них является axis2.war.

Все работает нормально, пока я не включу административную защиту и безопасность Java 2. После отладки всех исключений AccessControlException и добавления необходимых разрешений в .. \ profile \ was70profile1 \ config \ cell \ AMSCNT0009Node01Cell \ application \ app.ear \ deployments \ app \ META-INF \ was.policy и .. \ анкеты \ was70profile1 \ instalApps \ AMSCNT0009Node01Cell \ app.ear \ META-INF \ was.policy Я получаю одно исключение AccessControlException, которое, похоже, никоим образом не исчезает (java.io.FilePermission C : \ Program Files \ IBM \ SDP \ runtimes \ base_v7 \ profile \ was70profile1 \ instalApps \ AMSCNT0009Node01Cell \ app.ear \ appAxis2-3.5.2.war \ WEB-INF \ scriptServices read).

Мои файлы was.policy: 

    /* AUTOMATICALLY GENERATED ON Mon Mar 05 13:40:14 CET 2012*/
/* DO NOT EDIT */

grant codeBase "file:${application}" {
  permission java.util.PropertyPermission "*", "read, write";
  permission java.util.PropertyPermission "org.apache.commons.logging.LogFactory", "read, write";
  permission java.util.PropertyPermission "Axis2.prohibitDebugLogging" , "read,write";

  permission java.lang.RuntimePermission "modifyThreadGroup";
  permission java.lang.RuntimePermission "modifyThread";
  permission java.lang.RuntimePermission "createClassLoader";
  permission java.lang.RuntimePermission "setContextClassLoader";
  permission java.lang.RuntimePermission "checkPropertiesAccess";
  permission java.lang.RuntimePermission "getClassLoader";
  permission java.lang.RuntimePermission "loadLibrary.*";
  permission java.lang.RuntimePermission "getProtectionDomain";
  permission java.lang.RuntimePermission "shutdownHooks";
  permission java.lang.RuntimePermission "accessDeclaredMembers";

  permission java.security.SecurityPermission "getPolicy";
  permission javax.management.MBeanServerPermission "createMBeanServer";
  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";

  permission com.ibm.oti.shared.SharedClassPermission "java.net.URLClassLoader", "read, write";
  permission com.ibm.oti.shared.SharedClassPermission "org.apache.axis2.deployment.DeploymentClassLoader", "read, write";

  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\profiles\\was70profile1\\attachments", "read, write";
  permission java.io.FilePermission "alerts.log", "read, write";
  permission java.io.FilePermission "jmxPerformance.log", "read, write";
  permission java.io.FilePermission "AppLog.txt", "read, write";
  permission java.io.FilePermission "hibernateStatsLogger.log", "read, write";

  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\plugins\\-", "read";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\plugins", "read";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\lib\\-", "read";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\deploytool\\-", "read";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\java\\-", "read";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\java\\jre\\lib\\-", "read";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\properties\\-", "read, write";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\properties\\*", "read, write";

  permission java.io.FilePermission "${app.installed.path}", "read, write";
  permission java.io.FilePermission "${app.installed.path}\\*", "read, write";

  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\profiles\\was70profile1\\logs\\_axis2", "read, write, delete";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\profiles\\was70profile1\\logs\\_axis2\\*", "read, write, delete";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\profiles\\was70profile1\\logs\\_axis2\\-", "read, write, delete";

  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\profiles\\was70profile1\\temp\\AMSCNT0009Node01\\server1\\app", "read, write, delete";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\profiles\\was70profile1\\temp\\AMSCNT0009Node01\\server1\\app\\*", "read, write, delete";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\profiles\\was70profile1\\temp\\AMSCNT0009Node01\\server1\\app\\-", "read, write, delete";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\WEB-INF\\classes\\-", "read";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\WEB-INF\\conf\\-", "read";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\java\\-", "read";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\java\\*", "read";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\java\\conf\\-", "read";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\WEB-INF", "read";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\WEB-INF\\-", "read";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\WEB-INF\\scriptServices", "read, write";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\WEB-INF\\scriptServices\\*", "read, write";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\WEB-INF\\modules\\*", "read, write";
  permission java.io.FilePermission "${app.installed.path}\\appAxis2-3.5.2.war\\WEB-INF\\services\\*", "read, write";

  permission java.io.FilePermission "${app.installed.path}\\appModelSvcs-1.4.2.war\\WEB-INF\\scriptServices", "read, write";  
  permission java.io.FilePermission "${app.installed.path}\\appModelSvcs-1.4.2.war\\WEB-INF\\scriptServices\\*", "read, write";
  permission java.io.FilePermission "${app.installed.path}\\appModelSvcs-1.4.2.war\\WEB-INF\\modules\\-", "read, write";
  permission java.io.FilePermission "${app.installed.path}\\appModelSvcs-1.4.2.war\\WEB-INF\\services\\-", "read, write";
  permission java.io.FilePermission "${app.installed.path}\\appModelSvcs-1.4.2.war\\WEB-INF\\-", "read";
  permission java.io.FilePermission "${app.installed.path}\\appModelSvcs-1.4.2.war\\WEB-INF", "read";

  permission java.io.FilePermission "${app.installed.path}\\appEFDSimulator-3.5.2.war\\WEB-INF\\*", "read, write";

  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\profiles\\was70profile1", "read, write";
  permission java.io.FilePermission "C:\\Program Files\\IBM\\SDP\\runtimes\\base_v7\\profiles\\was70profile1\\properties", "read, write";
};

След: 

    [3/8/12 16:41:24:320 CET] 00000018 SecurityManag W   SECJ0314W: Current Java 2 Security policy reported a potential violation of Java 2 Security Permission. Refer to the InfoCenter for further information.

Permission:

      C:\Program Files\IBM\SDP\runtimes\base_v7\profiles\was70profile1\installedApps\AMSCNT0009Node01Cell\app.ear\appAxis2-3.5.2.war\WEB-INF\scriptServices : Access denied (java.io.FilePermission C:\Program Files\IBM\SDP\runtimes\base_v7\profiles\was70profile1\installedApps\AMSCNT0009Node01Cell\app.ear\appAxis2-3.5.2.war\WEB-INF\scriptServices read)

Code:

     org.apache.axis2.scripting.ScriptRepositoryListener$1  in  {file:/C:/Program Files/IBM/SDP/runtimes/base_v7/profiles/was70profile1/temp/AMSCNT0009Node01/server1/app/appAxis2-3.5.2.war/_axis2/axis23638axis2-scripting-1.4.mar}


Stack Trace:

java.security.AccessControlException: Access denied (java.io.FilePermission C:\Program Files\IBM\SDP\runtimes\base_v7\profiles\was70profile1\installedApps\AMSCNT0009Node01Cell\app.ear\appAxis2-3.5.2.war\WEB-INF\scriptServices read)
    at java.lang.Throwable.<init>(Throwable.java:67)
    at java.security.AccessControlException.<init>(Unknown Source)
    at java.security.AccessController.checkPermission(AccessController.java:108)
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
    at com.ibm.ws.security.core.SecurityManager.checkPermission(SecurityManager.java:210)
    at java.lang.SecurityManager.checkRead(SecurityManager.java:871)
    at java.io.File.list(File.java:982)
    at java.io.File.listFiles(File.java:1062)
    at org.apache.axis2.scripting.ScriptRepositoryListener$1.run(ScriptRepositoryListener.java:47)
    at java.security.AccessController.doPrivileged(AccessController.java:202)
    at org.apache.axis2.java.security.AccessController.doPrivileged(AccessController.java:78)
    at org.apache.axis2.scripting.ScriptRepositoryListener.findServicesInDirectory(ScriptRepositoryListener.java:45)
    at org.apache.axis2.deployment.RepositoryListener.checkServices(RepositoryListener.java:225)
    at org.apache.axis2.deployment.DeploymentEngine.loadServices(DeploymentEngine.java:131)

Я уже пытался изменить исходный код axis2 1.4, заменив axis2-kernel.jar и axis2-scripting-1.4.mar на пользовательские с исправлением ниже:

https://issues.apache.org/jira/browse/AXIS2-3816

Я также попытался изменить исходный код axis2, выбрав папку, отличную от WEB-INF \ scriptServices, но AccessControlException остается, теперь в новой папке.

Если у кого-нибудь есть подсказка, как это исправить, будет очень признателен. Заранее спасибо!

1 Ответ

1 голос
/ 13 марта 2012

Я обнаружил, что единственным решением является удаление scripting-xxx.mar из папки модулей. Axis2 1.5 поставляется с методом doPrivileged () в классе ScriptRepositoryListener, но он также не работает.

...