<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="https://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
AS8: JBoss Security Manager discussion
</h3>
<span style="margin-bottom: 10px;">
modified by <a href="https://community.jboss.org/people/anil.saldhana">Anil Saldhana</a> in <i>JBoss AS 7 Development</i> - <a href="https://community.jboss.org/docs/DOC-48383">View the full document</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>David M Lloyd, Stefan, Flavia and I had a high level discussion on supporting Java Security Manager in AS8 in line with the needs of EE7 and JBoss Modules.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><strong>JIRA</strong><span>:  </span><a class="jive-link-external-small" href="https://issues.jboss.org/browse/AS7-6572" target="_blank">https://issues.jboss.org/browse/AS7-6572</a></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><strong>Internal reference</strong><span>: </span><a class="jive-link-external-small" href="http://etherpad.corp.redhat.com/FaKiGVezLI" rel="nofollow" target="_blank">http://etherpad.corp.redhat.com/FaKiGVezLI</a></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>We had an etherpad discussion.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Etherpad</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p id="magicdomid38" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p id="magicdomid39" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p id="magicdomid40"><span class="author-g-z122zxw9e4wjvpi9l067 b"><strong>Requirements </strong></span></p><p id="magicdomid41"><span class="author-g-z122zxw9e4wjvpi9l067">(Let us capture general requirements here)</span></p><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Support for VMwide Security Manager policy?</span></li></ul><p style="min-height: 8pt; height: 8pt; padding: 0px;"><span id="magicdomid43"></span> </p><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Support META-INF/permissions.xml required by EE7  for web, ejb and application clients</span></li></ul><p><span id="magicdomid46"><span class="author-g-z122zxw9e4wjvpi9l067">From DML:</span></span><span id="magicdomid47"></span></p><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Support EE 7 Security Manager requirements</span></li></ul><p style="min-height: 8pt; height: 8pt; padding: 0px;"><span id="magicdomid48"></span> </p><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Maintain relationships established by JACC specification for Run As vs. AccessControlContext</span></li></ul><p style="min-height: 8pt; height: 8pt; padding: 0px;"><span id="magicdomid49"></span> </p><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Application components must be able to support at least the permissions listed in Table EE.6-2 in EE(7).6.2.2.3.</span></li></ul><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Deployers must support application component permissions as specified by EE.6.2.2.6.</span></li></ul><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Server  administrators must have a way of declaring permission restrictions for  deployments.  If a deployment with declared permissions does not meet  the configured permission set, the deployment must fail as per  EE.6.2.2.6.</span></li></ul><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Perform well</span></li></ul><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Ideally  we will be able to use a more efficient mechanism to evaluate  permissions than a complete execution stack scan.  The JDK always grants  itself all permissions - by checking the class loader for null - and  generally acts as if doPrivileged is always in force.  Perhaps we can  utilize a similar trick to allow our provided modules to execute  quickly.</span></li></ul><ul><li></li></ul><p><span id="magicdomid56"><span class="author-g-z122zxw9e4wjvpi9l067 b"><strong>Discussion Points</strong></span></span></p><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Should we do permissions within module.xml? (</span><span class="author-g-z122zxw9e4wjvpi9l067 url"><a class="jive-link-external-small" href="https://issues.jboss.org/browse/MODULES-157%29">https://issues.jboss.org/browse/MODULES-157)</a></span></li></ul><p id="magicdomid58" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p id="magicdomid59" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p id="magicdomid60"><span class="author-g-z122zxw9e4wjvpi9l067 b"><strong>Action Items</strong></span></p><p class="ace-line" id="magicdomid134"><span class="author-g-z122zxw9e4wjvpi9l067">1. Deployment Descriptor parsing for META-INF/permissions.xml</span></p><p class="ace-line" id="magicdomid246"><span class="author-g-z122zxw9e4wjvpi9l067">2. Domain.xml/Standalone.xml global permission block (parsing and handling)</span></p><p class="ace-line" id="magicdomid331"><span class="author-g-z122zxw9e4wjvpi9l067">3. JBoss Modules permission handling  (parsing and handling)</span></p><p class="ace-line" id="magicdomid401"><span class="author-g-z122zxw9e4wjvpi9l067">4. System to merge deployment permissions into the module defined permissions.</span></p><p id="magicdomid62" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p id="magicdomid63" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p id="magicdomid64"><span class="author-g-z122zxw9e4wjvpi9l067 b"><strong>Questions </strong></span></p><ul><li><span class="author-g-z122zxw9e4wjvpi9l067">Should permissions.xml for Web Deployments be in WEB-INF and not META-INF? JSR342 draft seems to imply they will be in META-INF  (</span><span class="author-g-z122zxw9e4wjvpi9l067 i"><em>Answer:  permissions.xml is a SE requirement for the EE platform. So it is META-INF</em></span><span class="author-g-z122zxw9e4wjvpi9l067">)</span></li></ul><ul><li></li></ul><p id="magicdomid67" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2></h2><h2>Chat Discussion</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="chatday" id="chatday2013-02-20" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2 class="dayheader">February 20, 2013</h2><div class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><p><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">Just want to have a general chat on this topic...</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:19 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">Important for Stefan to participate.</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:19 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">Flavia mainly because DML mentioned modules</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:20 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">Ok, so app components must now support the declaration of security permissions. Besides, we need to consider setting up permissions for the modules</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:21 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">previously,  ra.xml could contain security permissions</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:21 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">now additionally permissions.xml can be provided</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:21 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">right, I believe the model is pretty similar to the one found in ra.xml</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:22 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">the bigger Q is should we support permissions in module.xml?</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:22 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">we discussed that in Aug 2011 with no action. <span> :) </span></span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:22 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">I believe we do. What do we do now when the sec manager is active and one of the modules contains code that needs permissions</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:23 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">The key aspects for a security manager access check  includes CodeSource, Permissions and Subject</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetext"><br/></span></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">CodeSource is driven by the classloader</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:24 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">perms come from config and subject from the underlying sec context</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:25 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">what happens now if sec manager is enabled on AS7? Do we have an AllPerm for all modules?</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:25 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I dont think so.  Right now, they are governed by the codesource url</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:26 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">defined in the general policy file.</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:26 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">DML wanted to see if we could add sec permissions at the module level</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:27 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">I think it is a good idea but the amount of work required for that can be insane due to the number of modules</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:28 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">it is NOT required for all modules. If admin wants to do for a select set of modules, he should be able to</span></p><p class="chatline chatauthor4" style="background: none repeat scroll 0% 0% #c78fff;"><span class="chatlinetime">12:29 </span><span class="chatlinename">Flavia: </span><span class="chatlinetext">okay, so this does not affect MSC directly, it will affect Modules afaics</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:31 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">Who does modules?</span></p><p class="chatline chatauthor4" style="background: none repeat scroll 0% 0% #c78fff;"><span class="chatlinetime">12:32 </span><span class="chatlinename">Flavia: </span><span class="chatlinetext">I am not sure, but I think that mostly David</span></p><p class="chatline chatauthor4" style="background: none repeat scroll 0% 0% #c78fff;"><span class="chatlinetime">12:33 </span><span class="chatlinename">Flavia: </span><span class="chatlinetext">I agree with Stefan that there could be a perf impact if we add this to every single module in AS</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:33 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">Remember it is user's choice whether they run AS under a JSM</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:37 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">hey DML. etherpad is insanely slow</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:37 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">at least it's up.  This morning there was an outage</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:40 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I brought in your comments from the other ether here.</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:40 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">My thought with modules is that they could request to be granted AllPermission by default</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:40 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">that way we don't have to go through and retroactively redo every one</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:40 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">but we can, later on, restrict modules if we want to</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:41 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">Agree.</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:41 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">my main motivation is to avoid having a global security policy file</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:41 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">that's never been anything but a PITA</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:42 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">by supporting it in modules we can establish permissions by class loader instead of code source</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:42 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">the challenge is for a complete system, you will have to evaluate every module.</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:42 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">if you have ALLPerm for unspecified modules</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:42 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">we can simply compile and install the permissions as the modules are loaded</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:43 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">where are they specified?</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:43 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">in module.xml</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:43 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">those would be the permissions the module requests, not necessarily the permissions they are granted</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:44 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">ok, so we would be adding an AllPerm to every module.xml, leaving us with something that can be refined with timeso the idea is to add an AllPerm to every module.xml?</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:44 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">ideally an administrator would also have their vote as to what permissions to use, and the effective permissions would be the union of the two</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:44 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">yeah that's the idea</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:44 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">really it's not so different from the EE7 rules - the deployment contains requested permissions, the administrator can further limit them, and the result is a union</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:44 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">for some reason part of what I wrote was duplicated</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:45 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">probably because etherpad is junk <span> :) </span></span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:45 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">union or intersection</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:45 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">intersection, sorry</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:45 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">ah, ok <span> :) </span></span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:45 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I am fine with it.  We should discuss this with Jason and the list.</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:45 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">cripes, I wonder how long I've been doing that.</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:46 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">DML - permissions.xml can be in META-INF</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:47 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">for web deployments, should they go in WEB-INF?</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:47 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I'd say META-INF only, unless the EE or servlet spec specifically allow for WEB-INF</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:47 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I thought web deployments typically used WEB-INF</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:47 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">these are SE requirements for EE</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:47 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">they do for web stuff</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:47 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">so maybe META-INF</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:48 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">but servlet is a rule-breaker in a lot of ways</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:48 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">they do require META-INF for a few things too, by spec (though I think in some cases we allow WEB-INF)</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:49 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">stefan , what do you think?  Allperm for all modules  and admin changes based on his requirement</span></p></div><div class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"> </div><div class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"> </div><div class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:49 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">there are some horrible things like having a WEB-INF/classes/META-INF</span></div><div class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:49 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">that is persistence.xml</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:50 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">the only thing I would like to know is where the admin perms would be stored</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:50 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">module.xml</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:50 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">that is a big question, and also, what form should it take</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:50 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">yeah</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:50 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">for deployments I think the standalone/domain.xml should contain the admin policy, but I don't know what capabilities we should give it</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:51 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">e.g. do we require the admin perm overrides to be present  at deploy time (assume AllPermission if not present), or do we have a general config that includes matching wildcards, or what</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:52 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">we can leave it to the admin - AllPerm or denyall</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:52 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">when we ship, we go with allperm</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:53 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">my gut feeling is that we'll need something more nuanced than an all-on/all-off switch </span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:53 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">have to agree with david on this one</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:53 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">domain.xml contains the default permission policy</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:53 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">overrides happen in module.xml</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:53 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">deployments do not contain a module.xml</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:53 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">and permissions.xml/rar.xml</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:54 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">for deployments we'd rely on META-INF/permissions.xml</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:54 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">yeah</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:54 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">right</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:54 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">on the other hand, standalone/domain.xml permissions will not affect filesystem modules</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:54 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">that global policy (if any) has to be statically defined somewhere</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:55 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">like I said though - if we can avoid global policy files, that's best</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:56 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">the policy file mechanism is defined by convention, not spec, therefore we shouldn't rely on it</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:56 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">no requirement to go with policy file</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:58 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">it implies though that if we do want an overriding global policy of some sort, it has to be of our own format, and it has to come from jboss modules</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:58 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">so that jboss modules can merge the policy with that of the individual modules</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:00 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">since modules is the building block, it makes sense to have it at the module level</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:00 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">we definitely should think more from securing modules</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:00 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">more from the perspective of securing the system via modules</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:03 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I'm not 100% brushed up on how protectiondomains and ACCs and all that stuff play together though</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:04 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I think once we start playing with it, we will see the challenges</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:05 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">if one of you guys is already an expert that'd really help</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:05 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">save some time</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:05 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">this can actually be done in the modules project</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:06 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I mean test cases and performance measures</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:06 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">what the SM does is very small IMO</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:06 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I can wire in the basic infrastructure to modules but a second/third pair of eyes would be good to have</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:06 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">setting up the protection domains at the module CL level</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:06 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">we will be there, DML</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:07 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I think I will start establishing some processes around this.  testing/configuration etc.</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:07 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">that is but one task though</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:07 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I think that it might be a good idea to create a top-level JIRA with subtasks to track the individual work units, with a dependent relationship to the EE7 JIRA subtask</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">work units like:</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">descriptor parsing</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:08 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">right</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">DUP changes to install permissions into the module spec</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:08 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">Action Items to the left here. <span> :) </span></span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:08 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I will set up the JIRA issues for the action items</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">subsystem config</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">etc.</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:12 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">will list the action items here and start creating subtasks</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:14 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I guess that's about it, other than just testing</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:14 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">right.  few minutes - check the action items here</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:15 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">once you are happy, I can transfer to subtasks in JIRA</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:15 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I'd feel better if we had some plan for global module config, and an idea of how the global domain config might look</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:15 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">we need to have that discussion.</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:16 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">we can create a subtask placeholder for the domain config question and then open it up for discussion on the dev list</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:16 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">right</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:16 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">added some action items. take a look</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:17 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">AS DUP implementation to merge descriptor information into the module definition</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:24 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I guess that's it for now</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:24 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">we can always add more later as things come up</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:25 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">did we lose Stefan?</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:26 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">probably</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:26 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">they have electricity issues due to summer thunderstorms in Brazil</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:31 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">FYI the subtask in the EE7 task should stay right where it is</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:32 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">you can't have a task hierarchy, so we need a new top-level JIRA that links back to that subtask</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:32 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">with notes to close one when you close the other</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:32 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">ok</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:32 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">did not realize it was a subtask. <span> :) </span></span></p><p class="chatline chatauthor1" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p></div><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Followup</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><span>DML did some work: </span><a class="jive-link-external-small" href="https://github.com/dmlloyd/jboss-modules/compare/dc534ef...f4c74be" target="_blank">https://github.com/dmlloyd/jboss-modules/compare/dc534ef...f4c74be</a></p></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Comment by <a href="https://community.jboss.org/docs/DOC-48383">going to Community</a></p>
<p style="margin: 0;">Create a new document in JBoss AS 7 Development at <a href="https://community.jboss.org/choose-container!input.jspa?contentType=102&containerType=14&container=2225">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>