<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="https://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
AS8: JBoss Security Manager discussion
</h3>
<span style="margin-bottom: 10px;">
created by <a href="https://community.jboss.org/people/anil.saldhana">Anil Saldhana</a> in <i>JBoss AS 7 Development</i> - <a href="https://community.jboss.org/docs/DOC-48383">View the full document</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>David M Lloyd, Stefan, Flavia and I had a high level discussion on supporting Java Security Manager in AS8 in line with the needs of EE7 and JBoss Modules.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>We had an etherpad discussion.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Etherpad</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><pre class="jive-pre"><code class="jive-code">
Requirements
(Let us capture general requirements here)
Support for VMwide Security Manager policy?
Support META-INF/permissions.xml required by EE7  for web, ejb and application clients
>From DML:Support EE 7 Security Manager requirements
Maintain relationships established by JACC specification for Run As vs. AccessControlContext
Application components must be able to support at least the permissions listed in Table EE.6-2 in EE(7).6.2.2.3.
Deployers must support application component permissions as specified by EE.6.2.2.6.
Server  administrators must have a way of declaring permission restrictions for  deployments.  If a deployment with declared permissions does not meet  the configured permission set, the deployment must fail as per  EE.6.2.2.6.
Perform wellIdeally  we will be able to use a more efficient mechanism to evaluate  permissions than a complete execution stack scan.  The JDK always grants  itself all permissions - by checking the class loader for null -
                and  generally acts  as if doPrivileged is always in force.  Perhaps we can  utilize a similar trick to allow our provided modules to execute  quickly.
Discussion Points
Should we do permissions within module.xml? (https://issues.jboss.org/browse/MODULES-157)
Action Items
1. Deployment Descriptor parsing for META-INF/permissions.xml
2. Domain.xml/Standalone.xml global permission block (parsing and handling)
3. JBoss Modules permission handling  (parsing and handling)
4. System to merge deployment permissions into the module defined permissions.
Questions
Should permissions.xml for Web Deployments be in WEB-INF and not META-INF? JSR342 draft seems to imply they will be in META-INF  (Answer:  permissions.xml is a SE requirement for the EE platform. So it is META-INF)
</code></pre><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Chat Discussion</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="chatday" id="chatday2013-02-20" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2 class="dayheader">February 20, 2013</h2><div class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:49 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">there are some horrible things like having a WEB-INF/classes/META-INF</span><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:49 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">that is persistence.xml</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:50 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">the only thing I would like to know is where the admin perms would be stored</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:50 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">module.xml</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:50 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">that is a big question, and also, what form should it take</span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:50 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">yeah</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:50 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">for deployments I think the standalone/domain.xml should contain the admin policy, but I don't know what capabilities we should give it</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:51 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">e.g. do we require the admin perm overrides to be present  at deploy time (assume AllPermission if not present), or do we have a general config that includes matching wildcards, or what</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:52 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">we can leave it to the admin - AllPerm or denyall</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:52 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">when we ship, we go with allperm</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:53 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">my gut feeling is that we'll need something more nuanced than an all-on/all-off switch </span></p><p class="chatline chatauthor2" style="background: none repeat scroll 0% 0% #c7ffff;"><span class="chatlinetime">12:53 </span><span class="chatlinename">Stefan: </span><span class="chatlinetext">have to agree with david on this one</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:53 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">domain.xml contains the default permission policy</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:53 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">overrides happen in module.xml</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:53 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">deployments do not contain a module.xml</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:53 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">and permissions.xml/rar.xml</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:54 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">for deployments we'd rely on META-INF/permissions.xml</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:54 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">yeah</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:54 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">right</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:54 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">on the other hand, standalone/domain.xml permissions will not affect filesystem modules</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:54 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">that global policy (if any) has to be statically defined somewhere</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:55 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">like I said though - if we can avoid global policy files, that's best</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:56 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">the policy file mechanism is defined by convention, not spec, therefore we shouldn't rely on it</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">12:56 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">no requirement to go with policy file</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:58 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">it implies though that if we do want an overriding global policy of some sort, it has to be of our own format, and it has to come from jboss modules</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">12:58 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">so that jboss modules can merge the policy with that of the individual modules</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:00 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">since modules is the building block, it makes sense to have it at the module level</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:00 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">we definitely should think more from securing modules</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:00 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">more from the perspective of securing the system via modules</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:03 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I'm not 100% brushed up on how protectiondomains and ACCs and all that stuff play together though</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:04 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I think once we start playing with it, we will see the challenges</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:05 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">if one of you guys is already an expert that'd really help</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:05 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">save some time</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:05 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">this can actually be done in the modules project</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:06 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I mean test cases and performance measures</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:06 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">what the SM does is very small IMO</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:06 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I can wire in the basic infrastructure to modules but a second/third pair of eyes would be good to have</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:06 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">setting up the protection domains at the module CL level</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:06 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">we will be there, DML</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:07 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I think I will start establishing some processes around this.  testing/configuration etc.</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:07 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">that is but one task though</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:07 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I think that it might be a good idea to create a top-level JIRA with subtasks to track the individual work units, with a dependent relationship to the EE7 JIRA subtask</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">work units like:</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">descriptor parsing</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:08 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">right</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">DUP changes to install permissions into the module spec</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:08 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">Action Items to the left here. <span> :) </span></span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:08 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">I will set up the JIRA issues for the action items</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">subsystem config</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:08 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">etc.</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:12 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">will list the action items here and start creating subtasks</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:14 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I guess that's about it, other than just testing</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:14 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">right.  few minutes - check the action items here</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:15 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">once you are happy, I can transfer to subtasks in JIRA</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:15 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I'd feel better if we had some plan for global module config, and an idea of how the global domain config might look</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:15 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">we need to have that discussion.</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:16 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">we can create a subtask placeholder for the domain config question and then open it up for discussion on the dev list</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:16 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">right</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:16 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">added some action items. take a look</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:17 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">AS DUP implementation to merge descriptor information into the module definition</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:24 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">I guess that's it for now</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:24 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">we can always add more later as things come up</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:25 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">did we lose Stefan?</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:26 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">probably</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:26 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">they have electricity issues due to summer thunderstorms in Brazil</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:31 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">FYI the subtask in the EE7 task should stay right where it is</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:32 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">you can't have a task hierarchy, so we need a new top-level JIRA that links back to that subtask</span></p><p class="chatline chatauthor3" style="background: none repeat scroll 0% 0% #fff1c7;"><span class="chatlinetime">13:32 </span><span class="chatlinename">dmlloyd: </span><span class="chatlinetext">with notes to close one when you close the other</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:32 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">ok</span></p><p class="chatline chatauthor1" style="background: none repeat scroll 0% 0% #ecd4d4;"><span class="chatlinetime">13:32 </span><span class="chatlinename">Anil Saldhana: </span><span class="chatlinetext">did not realize it was a subtask. <span> :) </span></span></p></div></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Comment by <a href="https://community.jboss.org/docs/DOC-48383">going to Community</a></p>
<p style="margin: 0;">Create a new document in JBoss AS 7 Development at <a href="https://community.jboss.org/choose-container!input.jspa?contentType=102&containerType=14&container=2225">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>