[jboss-remoting-commits] JBoss Remoting SVN: r3878 - remoting2/branches/2.x.
jboss-remoting-commits at lists.jboss.org
jboss-remoting-commits at lists.jboss.org
Wed Apr 2 01:43:36 EDT 2008
Author: ron.sigal at jboss.com
Date: 2008-04-02 01:43:36 -0400 (Wed, 02 Apr 2008)
New Revision: 3878
Modified:
remoting2/branches/2.x/test.policy
Log:
JBREM-934: Various additions and modifications.
Modified: remoting2/branches/2.x/test.policy
===================================================================
--- remoting2/branches/2.x/test.policy 2008-04-02 05:41:45 UTC (rev 3877)
+++ remoting2/branches/2.x/test.policy 2008-04-02 05:43:36 UTC (rev 3878)
@@ -1,85 +1,143 @@
+//***************************************************
+//**** Permissions to run Remoting itself ****
+//***************************************************
+grant codeBase "file:${build.home}/output/classes/-"
+{
+/////////////////////////////////////////////////////////////////////////////////////////////
+// Used by remote class loading system
-// Permissions to run Remoting itself
-grant codeBase "file:${build.home}/output/classes/-" {
- // Used by remote class loading system
permission java.lang.RuntimePermission "createClassLoader";
permission java.lang.RuntimePermission "getClassLoader";
- // Can't create sockets without it
+/////////////////////////////////////////////////////////////////////////////////////////////
+// Can't create sockets without it
+
permission java.net.SocketPermission "*:*", "accept,connect,listen,resolve";
- // HTTP client invokers use Class.getMethod()
+/////////////////////////////////////////////////////////////////////////////////////////////
+// HTTP client invokers use Class.getMethod()
+
permission java.lang.RuntimePermission "accessClassInPackage.sun.net.www.protocol.https";
permission java.lang.RuntimePermission "accessClassInPackage.sun.net.www.protocol.http";
- // Permission to create an MBean server
+/////////////////////////////////////////////////////////////////////////////////////////////
+// MBean permissions
+
permission javax.management.MBeanServerPermission "createMBeanServer, releaseMBeanServer";
permission javax.management.MBeanTrustPermission "register";
+
+ // org.jboss.remoting.ident.Identity
+ permission javax.management.MBeanPermission "javax.management.MBeanServerDelegate#-[JMImplementation:type=MBeanServerDelegate]", "queryMBeans, isInstanceOf";
permission javax.management.MBeanPermission "javax.management.MBeanServerDelegate#MBeanServerId[JMImplementation:type=MBeanServerDelegate]", "getAttribute";
- permission javax.management.MBeanPermission "-#-[-]", "queryMBeans";
- permission javax.management.MBeanPermission "org.jboss.remoting.transport.Connector#-[jboss.remoting:type=Connector,*]", "queryMBeans, isInstanceOf";
- permission javax.management.MBeanPermission "org.jboss.remoting.ServerInvoker#-[jboss.remoting:service=invoker,*]", "unregisterMBean, registerMBean, queryMBeans, isInstanceOf";
- permission javax.management.MBeanPermission "javax.management.MBeanServerDelegate#-[JMImplementation:type=MBeanServerDelegate]", "queryMBeans, isInstanceOf, getAttribute";
- permission javax.management.MBeanPermission "org.jboss.remoting.detection.multicast.MulticastDetector#-[remoting:type=JNDIDetector]", "queryMBeans, isInstanceOf";
- permission javax.management.MBeanPermission "org.jboss.remoting.detection.multicast.MulticastDetector#-[remoting:type=MulticastDetector]", "queryMBeans, isInstanceOf, unregisterMBean";
- permission javax.management.MBeanPermission "org.jboss.remoting.network.NetworkRegistry#-[remoting:type=NetworkRegistry]", "queryMBeans, isInstanceOf";
- permission javax.management.MBeanPermission "org.jboss.remoting.network.NetworkRegistry#Servers[remoting:type=NetworkRegistry]", "getAttribute";
permission javax.management.MBeanPermission "-#ServerDataDir[jboss.system:type=ServerConfig]", "getAttribute";
+
+ // org.jboss.remoting.callback.ServerInvokerCallbackHandler
+ permission javax.management.MBeanPermission "*#SSLSocketBuilder[*:*]", "getAttribute";
+ permission javax.management.MBeanPermission "org.jboss.remoting.security.SSLServerSocketFactoryServiceMBean#-[*:*]", "isInstanceOf";
+ permission javax.management.MBeanPermission "org.jboss.remoting.security.SSLServerSocketFactoryService#-[*:*]", "getClassLoaderFor";
+
+ // org.jboss.remoting.network.NetworkRegistryFinder
+ permission javax.management.MBeanPermission "*#-[*:*]", "queryMBeans";
+ // jboss.remoting.network.NetworkRegistryQuery
+ permission javax.management.MBeanPermission "NetworkRegistryMBean#-[*:*]", "isInstanceOf";
+
+ // org.jboss.remoting.detection.AbstractDetector
+// permission javax.management.MBeanPermission "*#*[*:*]", "invoke";
+ permission javax.management.MBeanPermission "*#addServer[remoting:type=NetworkRegistry]", "invoke";
+ permission javax.management.MBeanPermission "*#updateServer[remoting:type=NetworkRegistry]", "invoke";
+ permission javax.management.MBeanPermission "*#removeServer[remoting:type=NetworkRegistry]", "invoke";
+ permission javax.management.MBeanPermission "*#Servers[*:*]", "getAttribute";
+
+ // org.jboss.remoting.transport.Connector
+ permission javax.management.MBeanPermission "org.jboss.remoting.transport.*#-[jboss.remoting:service=invoker,*]", "unregisterMBean, registerMBean, queryMBeans, isInstanceOf";
+
+ // org.jboss.remoting.detection.util.DetectorUtil and org.jboss.remoting.transporter.InternalTransporterServices
+ permission javax.management.MBeanPermission "org.jboss.remoting.network.NetworkRegistry#-[remoting:type=NetworkRegistry]", "registerMBean";
+
+ // org.jboss.remoting.detection.util.DetectorUtil
+ permission javax.management.MBeanPermission "org.jboss.remoting.transport.Connector#-[jboss.remoting:type=Connector,*]", "registerMBean, queryMBeans, isInstanceOf";
+
+// permission javax.management.MBeanPermission "org.jboss.remoting.detection.multicast.MulticastDetector#-[remoting:type=JNDIDetector]", "queryMBeans, isInstanceOf";
+// permission javax.management.MBeanPermission "org.jboss.remoting.detection.multicast.MulticastDetector#-[remoting:type=MulticastDetector]", "queryMBeans, isInstanceOf, unregisterMBean";
+// permission javax.management.MBeanPermission "org.jboss.remoting.network.NetworkRegistry#-[remoting:type=NetworkRegistry]", "queryMBeans, isInstanceOf";
+
+// permission javax.management.MBeanPermission "org.jboss.remoting.security.SSLServerSocketFactoryService#-[*:*]", "isInstanceOf";
+
+ // org.jboss.remoting.security.CustomSSLServerSocketFactory
+ permission javax.management.MBeanPermission "org.jboss.remoting.security.CustomSSLServerSocketFactory#*[*:*]", "invoke";
+
+
+ permission javax.management.MBeanPermission "org.jboss.*#createServerSocket[*:*]", "invoke";
+ permission javax.management.MBeanPermission "*#-[*:*]", "isInstanceOf, registerMBean";
+
+
// TODO: Figure out why these aren't covered by the AllPermission entries below
- permission javax.management.MBeanPermission "org.jboss.test.remoting.detection.metadata.MetadataTestCase$TestNetworkRegistry#-[remoting:type=NetworkRegistry]", "unregisterMBean, registerMBean, queryMBeans, isInstanceOf";
+// permission javax.management.MBeanPermission "org.jboss.test.remoting.detection.metadata.MetadataTestCase$TestNetworkRegistry#-[remoting:type=NetworkRegistry]", "unregisterMBean, registerMBean, queryMBeans, isInstanceOf";
- // System properties accessed by Remoting
- permission java.util.PropertyPermission "jboss.remoting.pre_2_0_compatible", "read";
- permission java.util.PropertyPermission "jboss.remoting.version", "read, write";
- permission java.util.PropertyPermission "legacyParsing", "read";
- permission java.util.PropertyPermission "jboss.bind.address", "read";
- permission java.util.PropertyPermission "remoting.bind_by_host", "read";
+/////////////////////////////////////////////////////////////////////////////////////////////
+// System properties accessed by Remoting
+
+ permission java.util.PropertyPermission "SERIALIZATION", "read";
+ permission java.util.PropertyPermission "file.separator", "read";
+ permission java.util.PropertyPermission "http.basic.password", "read";
+ permission java.util.PropertyPermission "http.basic.username", "read";
+ permission java.util.PropertyPermission "javax.net.ssl.keyStore", "read";
+ permission java.util.PropertyPermission "javax.net.ssl.keyStorePassword", "read";
+ permission java.util.PropertyPermission "javax.net.ssl.keyStoreType", "read";
permission java.util.PropertyPermission "javax.net.ssl.trustStore", "read";
+ permission java.util.PropertyPermission "javax.net.ssl.trustStorePassword", "read";
permission java.util.PropertyPermission "javax.net.ssl.trustStoreType", "read";
- permission java.util.PropertyPermission "javax.net.ssl.trustStorePassword", "read";
- permission java.util.PropertyPermission "javax.net.ssl.keyStorePassword", "read";
- permission java.util.PropertyPermission "javax.net.ssl.keyStoreType", "read";
- permission java.util.PropertyPermission "javax.net.ssl.keyStore", "read";
- permission java.util.PropertyPermission "jboss.identity.domain", "read";
+ permission java.util.PropertyPermission "jboss.bind.address", "read";
permission java.util.PropertyPermission "jboss.identity", "read, write";
permission java.util.PropertyPermission "jboss.identity.dir", "read";
+ permission java.util.PropertyPermission "jboss.identity.domain", "read";
+ permission java.util.PropertyPermission "jboss.remoting.compression.debug", "read";
+ permission java.util.PropertyPermission "jboss.remoting.compression.min", "read";
+ permission java.util.PropertyPermission "jboss.remoting.domain", "write";
+ permission java.util.PropertyPermission "jboss.remoting.instanceid", "write";
permission java.util.PropertyPermission "jboss.remoting.jmxid", "write";
- permission java.util.PropertyPermission "jboss.remoting.instanceid", "write";
- permission java.util.PropertyPermission "jboss.remoting.domain", "write";
- permission java.util.PropertyPermission "SERIALIZATION", "read";
- permission java.util.PropertyPermission "http.basic.username", "read";
- permission java.util.PropertyPermission "http.basic.password", "read";
+ permission java.util.PropertyPermission "jboss.remoting.pre_2_0_compatible", "read";
+ permission java.util.PropertyPermission "jboss.remoting.version", "read, write";
+ permission java.util.PropertyPermission "jboss.server.data.dir", "read";
+ permission java.util.PropertyPermission "legacyParsing", "read";
+ permission java.util.PropertyPermission "org.apache.tomcat.util.*", "read";
permission java.util.PropertyPermission "org.jboss.remoting.defaultSocketFactory", "read";
- permission java.util.PropertyPermission "jboss.server.data.dir", "read";
- permission java.util.PropertyPermission "file.separator", "read";
- permission java.util.PropertyPermission "jboss.remoting.compression.debug", "read";
- permission java.util.PropertyPermission "jboss.remoting.compression.min", "read";
- permission java.util.PropertyPermission "remoting.stream.transport", "read";
+ permission java.util.PropertyPermission "org.jboss.security.ignoreHttpsHost" , "read";
+ permission java.util.PropertyPermission "remoting.bind_by_host", "read";
permission java.util.PropertyPermission "remoting.stream.host", "read";
permission java.util.PropertyPermission "remoting.stream.port", "read";
- permission java.util.PropertyPermission "org.jboss.security.ignoreHttpsHost" , "read";
- permission java.util.PropertyPermission "tomcat.util.buf.StringCache.byte.enabled", "read";
-
- // Tomcat native - TODO - this should be in a privileged block in jbossnative
+ permission java.util.PropertyPermission "remoting.stream.transport", "read";
+ permission java.util.PropertyPermission "tomcat.util.buf.StringCache.*", "read";
+
+/////////////////////////////////////////////////////////////////////////////////////////////
+// Tomcat native - TODO - this should be in a privileged block in jbossnative
+
permission java.lang.RuntimePermission "loadLibrary.tcnative-1";
permission java.lang.RuntimePermission "loadLibrary.libtcnative-1";
permission java.util.PropertyPermission "java.library.path", "read";
- // Permission to read the test keystore
- permission java.io.FilePermission "${build.home}/output/tests/classes/-", "read";
+/////////////////////////////////////////////////////////////////////////////////////////////
+// File permissions
+
permission java.io.FilePermission "${build.home}", "read";
permission java.io.FilePermission "${build.home}/jboss.identity", "read";
+ permission java.io.FilePermission "${build.home}", "read";
permission java.io.FilePermission "-", "read";
+ permission java.io.FilePermission "-", "delete"; // Used by org.jboss.remotinng.callback.CallbackStore: configurable.
- // Permission for org.jboss.remoting.ident.Identity to create "jboss.identity" file. Could be extended.
- permission java.io.FilePermission "${build.home}", "write";
+ // Permission for org.jboss.remoting.ident.Identity to create and read "jboss.identity" file. Could be extended.
+ permission java.io.FilePermission "-", "read, write";
- // Used by org.jboss.util.propertyeditor.PropertyEditors.mapJavaBeanProperties(), though still a Remoting permission I think
+/////////////////////////////////////////////////////////////////////////////////////////////
+// Used by org.jboss.util.propertyeditor.PropertyEditors.mapJavaBeanProperties(), though still a Remoting permission I think
+
permission java.lang.RuntimePermission "accessClassInPackage.sun.beans.editors";
permission java.lang.RuntimePermission "accessClassInPackage.sun.net.www.protocol.http";
- // TODO - JBoss Serialization SHOULD be doing these operations in a privileged block - JBSER-105
+/////////////////////////////////////////////////////////////////////////////////////////////
+// TODO - JBoss Serialization SHOULD be doing these operations in a privileged block - JBSER-105
+
permission java.lang.RuntimePermission "accessDeclaredMembers";
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
permission java.lang.RuntimePermission "accessClassInPackage.sun.reflect";
@@ -88,7 +146,9 @@
permission java.lang.RuntimePermission "accessClassInPackage.sun.misc";
permission java.io.SerializablePermission "enableSubstitution"; // <- this one is a "maybe" :-)
- // TODO - We should use a version of JBoss logging + log4j that does this stuff in privileged blocks
+/////////////////////////////////////////////////////////////////////////////////////////////
+// TODO - We should use a version of JBoss logging + log4j that does this stuff in privileged blocks
+
permission java.util.PropertyPermission "org.jboss.logging.Logger.pluginClass", "read";
permission java.io.FilePermission "${build.home}/src/etc/log4j.properties", "read";
permission java.util.PropertyPermission "log4j.defaultInitOverride", "read";
@@ -110,30 +170,53 @@
permission java.io.FilePermission "${build.home}/output/classes/-", "read";
};
-grant codeBase "file:${build.home}/lib/-" {
+
+//******************************************************************
+//**** Permissions for third party libraries ****
+//******************************************************************
+grant codeBase "file:${build.home}/lib/-"
+{
permission java.security.AllPermission;
};
-grant codeBase "file:${build.home}/src/etc/-" {
- permission java.security.AllPermission;
+//grant codeBase "file:${build.home}/src/etc/-" {
+// permission java.security.AllPermission;
+//};
+
+//******************************************************************
+//**** Permissions needed by Remoting to run the test suite ****
+//******************************************************************
+grant codeBase "file:${build.home}/output/classes/-"
+{
+ // Permission to read the test keystore
+ permission java.io.FilePermission "${build.home}/output/tests/classes/-", "read";
};
-grant codeBase "file:${build.home}/output/tests/classes/-" {
+//***************************************************
+//**** Permissions used by the test suite ****
+//***************************************************
+grant codeBase "file:${build.home}/output/tests/classes/-"
+{
// Used by the test suite itself
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
permission javax.management.MBeanServerPermission "createMBeanServer, findMBeanServer";
+ permission javax.management.MBeanServerPermission "*";
permission javax.management.MBeanTrustPermission "register";
- permission javax.management.MBeanPermission "org.jboss.remoting.ServerInvoker#-[jboss.remoting:service=invoker,*]", "unregisterMBean, registerMBean, queryMBeans, isInstanceOf";
+ permission javax.management.MBeanPermission "org.jboss.remoting.transport.*#-[jboss.remoting:service=invoker,*]", "unregisterMBean, registerMBean, queryMBeans, isInstanceOf";
permission javax.management.MBeanPermission "org.jboss.remoting.transport.Connector#-[jboss.remoting:type=Connector,*]", "registerMBean, unregisterMBean, queryMBeans, isInstanceOf";
permission javax.management.MBeanPermission "org.jboss.remoting.transport.Connector#-[test:type=connector]", "registerMBean";
permission javax.management.MBeanPermission "org.jboss.test.remoting.detection.metadata.MetadataTestCase$TestNetworkRegistry#-[remoting:type=NetworkRegistry]", "registerMBean, unregisterMBean, queryMBeans, isInstanceOf, addNotificationListener";
- permission javax.management.MBeanPermission "org.jboss.remoting.network.NetworkRegistry#-[remoting:type=NetworkRegistry]", "registerMBean, unregisterMBean, queryMBeans, isInstanceOf";
- permission javax.management.MBeanPermission "org.jboss.remoting.detection.multicast.MulticastDetector#-[remoting:type=JNDIDetector]", "registerMBean, queryMBeans, isInstanceOf";
- permission javax.management.MBeanPermission "org.jboss.remoting.detection.multicast.MulticastDetector#-[remoting:type=MulticastDetector]", "registerMBean, unregisterMBean, queryMBeans, isInstanceOf";
+ permission javax.management.MBeanPermission "org.jboss.remoting.network.NetworkRegistry#-[remoting:type=NetworkRegistry]", "registerMBean, unregisterMBean, queryMBeans, isInstanceOf, addNotificationListener";
+// permission javax.management.MBeanPermission "org.jboss.remoting.detection.multicast.MulticastDetector#-[remoting:type=JNDIDetector]", "registerMBean, queryMBeans, isInstanceOf";
+ permission javax.management.MBeanPermission "org.jboss.remoting.detection.multicast.MulticastDetector#-[remoting:*]", "registerMBean, unregisterMBean, queryMBeans, isInstanceOf";
permission javax.management.MBeanPermission "org.jboss.remoting.security.SSLServerSocketFactoryService#-[jboss:type=serversocketfactory]", "registerMBean, queryMBeans, isInstanceOf";
permission javax.management.MBeanPermission "org.jboss.test.remoting.transport.config.FactoryConfigTestCaseParent$SelfIdentifyingServerSocketFactory#-[jboss:type=serversocketfactory]", "registerMBean, queryMBeans, isInstanceOf";
permission javax.management.MBeanPermission "org.jboss.remoting.security.SSLServerSocketFactoryService#-[jboss:type=serversocketfactory2]", "registerMBean";
-
+ permission javax.management.MBeanPermission "org.jboss.remoting.security.SSLServerSocketFactoryService#createServerSocket[jboss:*]", "invoke";
+ permission javax.management.MBeanPermission "org.jboss.test.remoting.transport.rmi.ssl.config.FactoryConfigTestCase$SerializableServerSocketFactory#-[jboss:type=serversocketfactory]", "registerMBean";
+ permission javax.management.MBeanPermission "org.jboss.test.remoting.transport.rmi.ssl.config.FactoryConfigTestCase$SerializableServerSocketFactory#-[jboss:type=serversocketfactory2]", "registerMBean";
+ permission javax.management.MBeanPermission "org.jboss.remoting.transport.socket.SocketServerInvoker#Configuration[jboss.remoting:service=invoker,*]", "getAttribute";
+
permission java.lang.RuntimePermission "enableContextClassLoaderOverride";
permission java.lang.RuntimePermission "createClassLoader";
permission java.lang.RuntimePermission "getClassLoader";
@@ -157,6 +240,8 @@
permission java.io.SerializablePermission "enableSubclassImplementation";
permission java.lang.RuntimePermission "accessClassInPackage.sun.misc";
permission java.io.SerializablePermission "enableSubstitution"; // <- this one is a "maybe" :-)
+
+ permission java.util.PropertyPermission "loader.path", "read";
// TESTING ONLY - Use with the LoggingSecurityManager to locate needed permissions for the above block
// permission java.security.AllPermission;
@@ -165,3 +250,8 @@
grant codeBase "file:${ant.library.dir}/-" {
permission java.security.AllPermission;
};
+
+grant
+{
+ permission java.security.SecurityPermission "getProperty.*";
+};
\ No newline at end of file
More information about the jboss-remoting-commits
mailing list