<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="https://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
AS8: JBoss Security Manager Implementation Plan
</h3>
<span style="margin-bottom: 10px;">
modified by <a href="https://community.jboss.org/people/dmlloyd">David Lloyd</a> in <i>JBoss AS 7 Development</i> - <a href="https://community.jboss.org/docs/DOC-48386">View the full document</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>This wiki article will propose an implementation plan for the security manager related changes for JBoss AS8.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Background</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><span>Please follow </span><a class="jive-link-wiki-small" href="https://community.jboss.org/docs/DOC-48383" target="_blank">https://community.jboss.org/wiki/AS8JBossSecurityManagerDiscussion</a><span>   for some background information.</span></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Goal is to minimize the global policy file <em>historic</em> approach and adapt the Java Security Manager infrastructure in AS8 to a more modular approach.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2>Approach</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><ul><li style="text-align: start;">We will have a security manager subsystem to define the global permission collection that modules will inherit by default.  </li><li style="text-align: start;">module.xml can define the permission collection that governs the module.  This is what the ModuleClassLoader will return to the security manager when asked for permission collection.</li><li style="text-align: start;">EE deployments can do META-INF/permissions.xml (as per EE7).   The deployment permissions need to be merged into the module level permissions.</li></ul><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2 style="text-align: start;"></h2><h2 style="text-align: start;">Security Manager and Policy Implementation</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="text-align: start;">The JVM can run under a Java Security Manager via two options:</p><ul><li style="text-align: start;">Pass  -Djava.security.manager as command option</li><li style="text-align: start;">Programmatically, call    System.setSecurityManager(securityManager)</li></ul><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="text-align: start;">So we have two options to start the security manager in AS8.  (<em>I personally like the programmatic option that will let the JVM and JBoss Modules system to start up before the security manager is put into operation</em>).</p><h3 style="text-align: start;">Command Line Option</h3><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="text-align: start;">When we use the command line option,  the default security manager implementation (that uses Sun PolicyFile implementation)   will use the java.policy file from jre/lib/security folder of the JVM to construct the permissions that the JVM will have in starting up.  This takes care of the JVM starting up.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="text-align: start;">We will need to bootstrap the JBoss Modules system.  Now we have to think about providing the permissions for the jboss-modules.jar  </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="text-align: start;">The easiest way to achieve this is to add an entry into the java.policy file.   or  have a single entry in a policy file within the AS8 folders and mandate users not add/delete anything from this file.   This will get the JBoss Modules system starting.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="text-align: start;">Once the module system is started,  we will use the programmatic stuff below.</p><h3 style="text-align: start;">Command Line Option #2</h3><p>JBoss Modules has a special bootstrap option for security manager startup.  Instead of passing -Djava.security.manager to the JVM, you run JBoss Modules with the -secmgr flag.  This loads up a special policy that grants JBoss Modules AllPermission, but otherwise inherits the Policy defined by the JVM (or the application, if it has one).  In this way, JBoss AS can be started up under a security manager without any other special setup (in particular, without a JVM-specific policy file).  Requires at least 1.2.0.CR2 for proper operation.</p><h3 style="text-align: start;">Programmatic Option</h3><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>There will be a security manager subsystem defined in the domain model.   It will have a flag called <strong><em>enable</em></strong>  which by default will be <em>false</em>.   If the user configures the <em>enable</em> flag to true,  the program will call <em>System.setSecurityManager()</em>,  if  <em>System.getSecurityManager() == null</em>.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>The security manager subsystem can define the permission block for use by default by the module class loader.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><ul><li style="text-align: start;">We need to come up with a schema for the permission collection that can be used in the security-manager subsystem. We can use some of the concepts used in the policy file but make it usable.</li><li style="text-align: start;">The permission collection generated in the SM subsystem needs to be available to the module classloader if explicit permission collection not defined in module.xml for the module in question.</li></ul><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="text-align: start;">To summarize the options, the following systems will need to be configured with permissions:</p><p style="text-align: start;">a) JVM Bootstrap</p><p style="text-align: start;">b) JBoss Modules Bootstrap</p><p style="text-align: start;">c) JBoss Application Server</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2 style="text-align: start;">Module Permission Collection</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="text-align: start;">module.xml will have a permission collection block that mirrors what is defined in the security-manager subsystem of the domain model. This is what the module classloader will pick up. If left undefined, the global permission collection from the security-manager domain model will be adopted.</p><h2 style="text-align: start;">Deployment Permission Collection</h2><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="text-align: start;">EE7 deployments can define a permission collection via META-INF/permissions.xml   We will need to merge/adapt/convert this into a module level permission collection at the class loader for the deployment.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2 style="text-align: start;">References</h2><p style="text-align: start;"><a class="jive-link-wiki-small" href="https://community.jboss.org/docs/DOC-17431" target="_blank">https://community.jboss.org/wiki/JBossAS7SecurityRunningUnderAJavaSecurityManager</a></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><h2 style="text-align: start;"></h2><h2 style="text-align: start;">Chat Dumps</h2><h3 style="text-align: start;"></h3><h3 style="text-align: start;">21 Feb 2013</h3><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:27:03 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: working on the wiki article that outlines a plan.  I am unsure yet that we need a policy implementation.</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:27:16 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: but look at my article in about an hour.  then we can talk.<strong> <br/></strong></p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:31:39 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>okay.  I came up with a few more ideas before I fell asleep last night<strong> <br/></strong></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:42:28 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: saw your posts last night. I did make a post close to midnight.</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:42:30 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span><a class="jive-link-wiki-small" href="https://community.jboss.org/docs/DOC-48386">https://community.jboss.org/wiki/AS8JBossSecurityManagerImplementationPlan</a></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:42:40 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: it is half written.  adding details now.<strong> <br/></strong></p><p><span style="color: #af7f00; font-size: 10pt; font-weight: normal;">(09:44:23 AM) </span><span style="font-weight: bold; color: #af7f00;">dmlloyd: </span>asaldhan, I figured out that in JBoss Modules I can wrap the system Policy with one that grants modules itself AllPermission and that gets around the boot issue</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:44:41 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>so basically if you pass -secmgr to JBoss Modules at boot, you're fully secured</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:44:56 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>I know that doesn't answer any of the other questions though</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:45:16 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>but at least it's one less headache <span> :) </span></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:45:25 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: I like the programmatic option wherein JVM and Modules bootstrapped before SM kicks in</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:45:38 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: unless the admin is paranoid, then he can go the command line way</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:46:12 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>the problem is that it comes in so late</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:46:50 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>one thing to consider though is that we have a few places where we want to administratively configure stuff that needs to take effect at or near JVM startup</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:47:26 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>so secmgr is not unique in that regard</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:48:00 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>so it's possible that even with the command line switch, the subsystem can still control it<strong> <br/></strong></p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:48:43 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>now, all that said, I think the programmatic option is still viable</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:49:10 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: from admin perspective, they usually trust JVM and core JBoss infrastructure.</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:49:27 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: it is the applications that get deployed on the runtime that can go berseck</p><p><span style="color: #062585; font-size: 10pt; font-weight: normal;">(09:49:49 AM) </span><span style="font-weight: bold; color: #062585;">***asaldhan </span>has updated the article<strong> <br/></strong></p><p><span style="color: #af7f00; font-size: 10pt; font-weight: normal;">(09:51:05 AM) </span><span style="font-weight: bold; color: #af7f00;">dmlloyd: </span>asaldhan: that is true</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:51:22 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>tbh all of my changes should be able to support programmatic SM enablement later on</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:52:16 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: in my view 95% of usecases will go by programmatic approach.  for the paranoid, the cmd line option can go</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:52:27 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>we could cut down significantly on startup time this way</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:52:41 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: right.</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:52:55 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: what I feel is the flag   "enable=true"  which kicks in the SM</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:53:00 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: usability will be cool</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:53:24 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: by default, the permissions should be DenyAll  as long as all the modules shipped in AS8 have allperm in module.xml</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:53:32 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>that flag should be "enable=(true|false|inherit)" though - otherwise if they set it on the command line and it's set to "false" then the SM will turn off once the subsystem kicks in <span> :) </span></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:53:37 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: that way, admin has to configure his apps and custom modules</p><p><span style="color: #af7f00; font-size: 10pt; font-weight: normal;">(09:53:49 AM) </span><span style="font-weight: bold; color: #af7f00;">dmlloyd: </span>asaldhan, the EE spec gives a minimum permission set actually</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:53:56 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: right</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:54:25 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>I wonder if we should automatically set those up or if the EE perm set should just be the default<strong> <br/></strong></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:57:42 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: what I am wondering is by default,  there should be no SM.  Just a Policy implementation for modules  that does policy.implies(permission) check for sensitive operations</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:58:07 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: this is more of a JBoss modules concept that will be extended to the AS8 server</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:58:46 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: there really is no major need for SM to be ON vmwide</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:59:17 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>most things which check permissions will skip the check if there's no SM</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:59:33 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>check out these changes though:</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:59:35 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span><a class="jive-link-external-small" href="http://github.com/jbossas/jboss-modules/compare/c217927...a6345ca">http://github.com/jbossas/jboss-modules/compare/c217927...a6345ca</a></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:59:42 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: will check the changes. </p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(09:59:44 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: BUT</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(09:59:45 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>these should allow a SM to be turned on later</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:00:04 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: it is the modules codebase that can do policy.implies for many of its operations.</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:00:23 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>it could, but to what purpose?<strong> <br/></strong></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:01:11 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: your changes was what I was mentioning about the policy</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:02:33 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: you need the SM for policing n/w operations, socket ops, IO etc done by the JVM and application code.       But the modules can police some of the classloader checks using modulepolicy when a SM is absent</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:02:35 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>ah right, so we're saying the same thing</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:02:48 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>okay, that's true</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:03:17 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>but I don't think it's too necessary as there aren't too many actual privileged operations like that in modules really</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:03:35 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: ModuleCL operations maybe?</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:03:48 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: public private api etc?</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:03:55 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: I am just talking loudly</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:04:01 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>thinking</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:04:02 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>I use access control for most things</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:04:12 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>java language access control that is</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:04:29 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>AccessControlContext?</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:04:34 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>accesscontroller.doPriv?</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:04:58 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>no, private/protected/etc.<strong> <br/></strong></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:05:34 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>yeah  but what about cases where in methods are declared public  but they cannot be accessed from outside the module.  Like app classes should not call these.  There is no SM installed.<strong> <br/></strong></p><p><span style="color: #062585; font-size: 10pt; font-weight: normal;">(10:06:12 AM) </span><span style="font-weight: bold; color: #062585;">***asaldhan </span>is looking at a modular system</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:07:17 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>I use visibility restriction for those cases</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:12:27 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: one change in your thought.   SM subsystem enable=false  does not disable SM if bootstrapped via cmd line.  It only does System.setSM if enable=true</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:12:58 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>how can users turn it off then?</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:19:56 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>realistically enabling SM from the cmdline isn't that different from enabling it programmatically</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:19:59 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>it just happens sooner</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:20:24 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: we will only ship with programmatic option</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:20:39 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: we may have an article for how to do with cmd line option for paranoid admins</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:21:05 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: the cmd line folks will be less <1% of total users.</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:21:29 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>okay so perhaps we can just make it a doc issue</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:21:48 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: management of the SM now becomes part of domain management</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:21:52 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>if you turn on SM on the command line, you must remember to have it on in your config as well</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:21:58 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: rather than mucking with cmd files</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:22:14 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: cmd line turn on will have the steps in the document.</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:22:45 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>one other concern is that we have to make sure that our service dependencies do not allow deployments to start up before the sec mgr subsystem kicks in<strong> <br/></strong></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:23:26 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd:  how quickly can the sec mgr subsystem kick in?  will the service dependency resolution happen before that?<strong> <br/></strong></p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:24:53 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: the flow should be (JVM)---> (Modules Bootstrap)---->SM ----> everything else</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:28:09 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>all subsystems will begin initializing at the same time</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:28:39 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>deployments should not start up until all the subsystems do, but that's something definitely to verify</p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:28:52 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: should the SM subsystem be part of the modules bootstrap?</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:29:20 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>if we do that we'll break all kinds of things - I don't think we want to open that door just yet</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:29:29 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>in AS 9 we may have some better options though... </p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:35:41 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>one note for the future... the sec mgr subsystem is clearly something that is not applicable to embedded servers</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:36:05 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>I think at some point we'll have to go through and specify what subsystems apply to embedded, jvm, or both<strong> <br/></strong></p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:36:18 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>I can easily imagine special embedded-specific subsystems</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:37:35 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>well *parts* of the sec mgr subsys anyway</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:37:56 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>for example in embedded you can't be installing SMs, but you can for example assign permissions to deployment modules</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><span style="color: #204a87; font-size: 10pt; font-weight: normal;">(10:44:53 AM) </span><span style="font-weight: bold; color: #204a87;">asaldhan: </span>dmlloyd: The module system can definitely be doing a lot of Policy.implies checks if it desires. <span> :) </span><strong> <br/></strong></p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:49:18 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>okay, so I think we're pretty well sorted out on that score</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:57:15 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>the last discussion for SM is, what do we need to configure in the domain, and how will it look</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(10:57:26 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>use cases -> requirements -> design</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(11:27:42 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>I guess the questions are:</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(11:28:04 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>1) do we configure a maximal permission set globally for all deployments?</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(11:28:12 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>2) do we do the same for deployments based on some pattern?</p><p><span style="color: #8633b2; font-size: 10pt; font-weight: normal;">(11:28:51 AM) </span><span style="font-weight: normal; color: #8633b2;">dmlloyd: </span>3) what about extensions/filesystem JARs?</p></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Comment by <a href="https://community.jboss.org/docs/DOC-48386">going to Community</a></p>
<p style="margin: 0;">Create a new document in JBoss AS 7 Development at <a href="https://community.jboss.org/choose-container!input.jspa?contentType=102&containerType=14&container=2225">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>