主页 / server / 问题 / 124004
Accepted
Stefan Kendall
Asked: 2010-03-19 12:30:54 +0800 CST

Tomcat 6：访问控制异常？

  • 772

我正在尝试设置一个 tomcat6 服务器，并且正在尝试匹配其他人建立的另一个设置。但是，我的部署（默认 Ubuntu 安装）使用policy.d/目录结构，而建立的服务器只使用一个catalina.policy文件。我尝试将 policy.d 中的每个条目设置为与给定的 catalina.policy 匹配，但我仍然在启动时获得以下堆栈跟踪（来自 localhost 日志）。

那我有两个问题。首先，我如何让 tomcat 使用单个 poilcy 文件，而不是提供的目录结构policy.d/？其次，为什么当我指定所有文件使用相同的策略时，我仍然会得到下面的堆栈跟踪？

堆栈跟踪：

SEVERE: Servlet /myapp threw load() exception
java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.org.apache.jasper)
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:342)
        at java.security.AccessController.checkPermission(AccessController.java:553)
        at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
        at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1529)
        at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:291)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:264)
        at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1314)
        at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1245)
        at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:332)
        at org.apache.jasper.servlet.JspServlet.init(JspServlet.java:100)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:616)
        at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:244)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:276)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:162)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:115)
        at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1166)
        at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:992)
        at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4058)
        at org.apache.catalina.core.StandardContext.start(StandardContext.java:4367)
        at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
        at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:123)
        at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
        at java.security.AccessController.doPrivileged(Native Method)
        at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:769)
        at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525)
        at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:978)
        at org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java:941)
        at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:499)
        at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1201)
        at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:318)
        at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
        at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)
        at org.apache.catalina.core.StandardHost.start(StandardHost.java:719)
        at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
        at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
        at org.apache.catalina.core.StandardService.start(StandardService.java:516)
        at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
        at org.apache.catalina.startup.Catalina.start(Catalina.java:578)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:616)
        at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:616)
        at org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:177)

政策.d

grant codeBase "file:${java.home}/lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions
grant codeBase "file:${java.home}/jre/lib/ext/-" {
        permission java.security.AllPermission;
};

// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/../lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions when
// ${java.home} points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/lib/ext/-" {
        permission java.security.AllPermission;
};

// ========== CATALINA CODE PERMISSIONS =======================================
// These permissions apply to the daemon code
grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
        permission java.security.AllPermission;
};

// These permissions apply to the logging API
grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
        permission java.util.PropertyPermission "java.util.logging.config.class", "read";
        permission java.util.PropertyPermission "java.util.logging.config.file", "read";
        permission java.io.FilePermission "${java.home}${file.separator}lib${file.separator}logging.properties", "read"; 
        permission java.lang.RuntimePermission "shutdownHooks";
        permission java.io.FilePermission "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
        permission java.util.PropertyPermission "catalina.base", "read";
        permission java.util.logging.LoggingPermission "control";
        permission java.io.FilePermission "${catalina.base}${file.separator}logs", "read, write";
        permission java.io.FilePermission "${catalina.base}${file.separator}logs${file.separator}*", "read, write";
        permission java.lang.RuntimePermission "getClassLoader";
        // To enable per context logging configuration, permit read access to the appropriate file.
        // Be sure that the logging configuration is secure before enabling such access
        // eg for the examples web application:
        // permission java.io.FilePermission "${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties", "read";
};

// These permissions apply to the server startup code
grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
        permission java.security.AllPermission;
};

// These permissions apply to the servlet API classes
// and those that are shared across all class loaders
// located in the "lib" directory
grant codeBase "file:${catalina.home}/lib/-" {
        permission java.security.AllPermission;
};


// ========== WEB APPLICATION PERMISSIONS =====================================
// These permissions are granted by default to all web applications
// In addition, a web application will be given a read FilePermission
// and JndiPermission for all files and directories in its document root.
grant { 
    // Required for JNDI lookup of named JDBC DataSource's and
    // javamail named MimePart DataSource used to send mail
    permission java.util.PropertyPermission "java.home", "read";
    permission java.util.PropertyPermission "java.naming.*", "read";
    permission java.util.PropertyPermission "javax.sql.*", "read";

    // OS Specific properties to allow read access
    permission java.util.PropertyPermission "os.name", "read";
    permission java.util.PropertyPermission "os.version", "read";
    permission java.util.PropertyPermission "os.arch", "read";
    permission java.util.PropertyPermission "file.separator", "read";
    permission java.util.PropertyPermission "path.separator", "read";
    permission java.util.PropertyPermission "line.separator", "read";

    // JVM properties to allow read access
    permission java.util.PropertyPermission "java.version", "read";
    permission java.util.PropertyPermission "java.vendor", "read";
    permission java.util.PropertyPermission "java.vendor.url", "read";
    permission java.util.PropertyPermission "java.class.version", "read";
    permission java.util.PropertyPermission "java.specification.version", "read";
    permission java.util.PropertyPermission "java.specification.vendor", "read";
    permission java.util.PropertyPermission "java.specification.name", "read";

    permission java.util.PropertyPermission "java.vm.specification.version", "read";
    permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
    permission java.util.PropertyPermission "java.vm.specification.name", "read";
    permission java.util.PropertyPermission "java.vm.version", "read";
    permission java.util.PropertyPermission "java.vm.vendor", "read";
    permission java.util.PropertyPermission "java.vm.name", "read";

    // Required for OpenJMX
    permission java.lang.RuntimePermission "getAttribute";

    // Allow read of JAXP compliant XML parser debug
    permission java.util.PropertyPermission "jaxp.debug", "read";

    // Precompiled JSPs need access to this package.
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*";

    // Precompiled JSPs need access to this system property.
    permission java.util.PropertyPermission "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";

};
java tomcat6 jsp

2 个回答

  1. 好的第一件事：你真的需要使用 Java 安全策略吗？到目前为止最简单的解决方案是在 tomcat 的启动脚本中禁用它：

    在 /etc/init.d/tomcat6 替换

        TOMCAT6_SECURITY=yes

    和

        TOMCAT6_SECURITY=no

    假设您必须使用安全管理器，并且必须匹配现有安装，我建议您卸载 tomcat6，从 Web 下载它，然后在 /opt 或 /usr/local 之外运行整个目录。这意味着您必须自己跟踪安全更新，但至少所有文件都在同一个位置，并且更容易获得配置帮助。

    好的，现在让我们尝试使用您所拥有的。如果您有自定义策略文件，这应该是 policy.d 中的唯一文件，或者至少将您的权限添加到旨在覆盖所有其他文件的“50local.policy”。或者，您可以将路径更改为 /etc/init.d/tomcat6 中的安全策略

    您还应该将“-Djava.security.debug=failure”添加到安全部分，如下所示： 

        if [ "$TOMCAT6_SECURITY" = "yes" ]; then
       JAVA_OPTS="$JAVA_OPTS -Djava.security.manager -Djava.security.policy=$POLICY_CACHE -Djava.security.debug=failure"
    fi

    这将为您提供更多有用的错误消息，通常会准确地告诉您要向策略添加哪些权限以避免错误。

    注意：如果在 Eclipse 中使用 TOMCAT，请双击服务器选项卡中的 TOMCAT 并取消选中“使用安全性”

    • 4
  2. Best Answer

    我从不喜欢 Ubuntu 如何将 Tomcat 文件分散到各处。相反，我更喜欢下载 Tomcat 二进制发行版并设置自定义配置，我认为这更简单、更灵活且更易于维护。我已经在我的网站http://www.brianshowalter.com上的几个博客条目中解释了如何做到这一点。

    我还会质疑是否真的有必要使用 Java 安全策略。在某些情况下，是的，它为处理敏感数据的应用程序提供了有价值的额外安全性，但我怀疑在许多情况下，额外的复杂性和正确配置的需要不值得额外的时间和精力。

    • 2

相关问题