[JBoss JIRA] (REMJMX-158) Unauthorized access exception when closing JMX console and RBAC is set on server
by Richard Opalka (Jira)
[ https://issues.jboss.org/browse/REMJMX-158?page=com.atlassian.jira.plugin... ]
Richard Opalka updated REMJMX-158:
----------------------------------
Git Pull Request: https://github.com/jbossas/remoting-jmx/pull/35
> Unauthorized access exception when closing JMX console and RBAC is set on server
> --------------------------------------------------------------------------------
>
> Key: REMJMX-158
> URL: https://issues.jboss.org/browse/REMJMX-158
> Project: Remoting JMX
> Issue Type: Bug
> Components: Connection
> Reporter: Richard Opalka
> Assignee: Richard Opalka
> Priority: Major
> Fix For: 3.1.0.Beta1
>
>
> javax.management.JMRuntimeException: WFLYJMX0037: Unauthorized access
> at org.jboss.as.jmx.PluggableMBeanServerImpl.authorizeMBeanOperation(PluggableMBeanServerImpl.java:1204)
> at org.jboss.as.jmx.PluggableMBeanServerImpl.authorizeMBeanOperation(PluggableMBeanServerImpl.java:1190)
> at org.jboss.as.jmx.PluggableMBeanServerImpl.removeNotificationListener(PluggableMBeanServerImpl.java:946)
> at org.jboss.as.jmx.BlockingNotificationMBeanServer.removeNotificationListener(BlockingNotificationMBeanServer.java:243)
> at org.jboss.as.jmx.AuthorizingMBeanServer.removeNotificationListener(AuthorizingMBeanServer.java:352)
> at org.jboss.remotingjmx.protocol.v2.ServerProxy$RemoteNotificationManager.removeNotificationListener(ServerProxy.java:229)
> at org.jboss.remotingjmx.protocol.v2.ServerProxy$RemoteNotificationManager.removeNotificationListeners(ServerProxy.java:239)
> at org.jboss.remotingjmx.protocol.v2.ServerProxy$RemoteNotificationManager.removeNotificationListener(ServerProxy.java:222)
> at org.jboss.remotingjmx.protocol.v2.ServerProxy$RemoteNotificationManager.access$1900(ServerProxy.java:199)
> at org.jboss.remotingjmx.protocol.v2.ServerProxy.end(ServerProxy.java:167)
> at org.jboss.remotingjmx.protocol.v2.ServerCommon$MessageReciever.handleEnd(ServerCommon.java:216)
> at org.jboss.remoting3.remote.RemoteConnectionChannel.lambda$notifyEnd$0(RemoteConnectionChannel.java:291)
> at org.jboss.remoting3.EndpointImpl$TrackingExecutor.lambda$execute$0(EndpointImpl.java:957)
> at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.lang.Thread.run(Thread.java:748)
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 6 months
[JBoss JIRA] (REMJMX-158) Unauthorized access exception when closing JMX console and RBAC is set on server
by Richard Opalka (Jira)
Richard Opalka created REMJMX-158:
-------------------------------------
Summary: Unauthorized access exception when closing JMX console and RBAC is set on server
Key: REMJMX-158
URL: https://issues.jboss.org/browse/REMJMX-158
Project: Remoting JMX
Issue Type: Bug
Components: Connection
Reporter: Richard Opalka
Assignee: Richard Opalka
Fix For: 3.1.0.Beta1
javax.management.JMRuntimeException: WFLYJMX0037: Unauthorized access
at org.jboss.as.jmx.PluggableMBeanServerImpl.authorizeMBeanOperation(PluggableMBeanServerImpl.java:1204)
at org.jboss.as.jmx.PluggableMBeanServerImpl.authorizeMBeanOperation(PluggableMBeanServerImpl.java:1190)
at org.jboss.as.jmx.PluggableMBeanServerImpl.removeNotificationListener(PluggableMBeanServerImpl.java:946)
at org.jboss.as.jmx.BlockingNotificationMBeanServer.removeNotificationListener(BlockingNotificationMBeanServer.java:243)
at org.jboss.as.jmx.AuthorizingMBeanServer.removeNotificationListener(AuthorizingMBeanServer.java:352)
at org.jboss.remotingjmx.protocol.v2.ServerProxy$RemoteNotificationManager.removeNotificationListener(ServerProxy.java:229)
at org.jboss.remotingjmx.protocol.v2.ServerProxy$RemoteNotificationManager.removeNotificationListeners(ServerProxy.java:239)
at org.jboss.remotingjmx.protocol.v2.ServerProxy$RemoteNotificationManager.removeNotificationListener(ServerProxy.java:222)
at org.jboss.remotingjmx.protocol.v2.ServerProxy$RemoteNotificationManager.access$1900(ServerProxy.java:199)
at org.jboss.remotingjmx.protocol.v2.ServerProxy.end(ServerProxy.java:167)
at org.jboss.remotingjmx.protocol.v2.ServerCommon$MessageReciever.handleEnd(ServerCommon.java:216)
at org.jboss.remoting3.remote.RemoteConnectionChannel.lambda$notifyEnd$0(RemoteConnectionChannel.java:291)
at org.jboss.remoting3.EndpointImpl$TrackingExecutor.lambda$execute$0(EndpointImpl.java:957)
at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:748)
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 6 months
[JBoss JIRA] (WFLY-11365) Test JSONBTestCase fails with security manager
by James Perkins (Jira)
[ https://issues.jboss.org/browse/WFLY-11365?page=com.atlassian.jira.plugin... ]
James Perkins commented on WFLY-11365:
--------------------------------------
I've not tested, but what might also work is to include the implementation, Yasson in this case, in the deployment. Again not ideal, but it might work.
> Test JSONBTestCase fails with security manager
> ----------------------------------------------
>
> Key: WFLY-11365
> URL: https://issues.jboss.org/browse/WFLY-11365
> Project: WildFly
> Issue Type: Bug
> Components: EE, Test Suite
> Affects Versions: 15.0.0.Beta1
> Reporter: Martin Choma
> Assignee: Bartosz Baranowski
> Priority: Major
> Labels: security-manager
> Attachments: sm-fix.patch
>
>
> {noformat}
> org.jboss.as.test.integration.json (1)
> JSONBTestCase.testJsonbServlet
> {noformat}
> {noformat}
> java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.io.FilePermission" "/store/repository/org/eclipse/yasson/1.0.2/yasson-1.0.2.jar" "read")" in code source "(vfs:/content/jsonb10-test.war/WEB-INF/classes <no signer certificates>)" of "ModuleClassLoader for Module "deployment.jsonb10-test.war" from Service Module Loader")
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:294)
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:191)
> at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
> at org.wildfly.security.manager.WildFlySecurityManager.checkRead(WildFlySecurityManager.java:359)
> at java.util.zip.ZipFile.<init>(ZipFile.java:216)
> at java.util.zip.ZipFile.<init>(ZipFile.java:155)
> at java.util.jar.JarFile.<init>(JarFile.java:166)
> at java.util.jar.JarFile.<init>(JarFile.java:103)
> at sun.net.www.protocol.jar.URLJarFile.<init>(URLJarFile.java:93)
> at sun.net.www.protocol.jar.URLJarFile.getJarFile(URLJarFile.java:69)
> at sun.net.www.protocol.jar.JarFileFactory.get(JarFileFactory.java:99)
> at sun.net.www.protocol.jar.JarURLConnection.connect(JarURLConnection.java:122)
> at sun.net.www.protocol.jar.JarURLConnection.getInputStream(JarURLConnection.java:152)
> at java.net.URL.openStream(URL.java:1045)
> at java.util.ServiceLoader.parse(ServiceLoader.java:304)
> at java.util.ServiceLoader.access$200(ServiceLoader.java:185)
> at java.util.ServiceLoader$LazyIterator.hasNextService(ServiceLoader.java:357)
> at java.util.ServiceLoader$LazyIterator.access$600(ServiceLoader.java:323)
> at java.util.ServiceLoader$LazyIterator$1.run(ServiceLoader.java:396)
> at java.util.ServiceLoader$LazyIterator$1.run(ServiceLoader.java:395)
> at java.security.AccessController.doPrivileged(Native Method)
> at java.util.ServiceLoader$LazyIterator.hasNext(ServiceLoader.java:398)
> at java.util.ServiceLoader$1.hasNext(ServiceLoader.java:474)
> at javax.json.bind.spi.JsonbProvider.provider(JsonbProvider.java:112)
> at javax.json.bind.JsonbBuilder.create(JsonbBuilder.java:108)
> at org.jboss.as.test.integration.json.JSONBServlet.doGet(JSONBServlet.java:46) ...
> {noformat}
> Looks to me similar to WFLY-11337
> [1] https://ci.wildfly.org/viewLog.html?buildId=128138&buildTypeId=WF_MasterS...
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 6 months
[JBoss JIRA] (WFLY-11365) Test JSONBTestCase fails with security manager
by Brian Stansberry (Jira)
[ https://issues.jboss.org/browse/WFLY-11365?page=com.atlassian.jira.plugin... ]
Brian Stansberry commented on WFLY-11365:
-----------------------------------------
Yes, adding the permissions isn't a wonderful workaround. I just think this kind of thing should be fixed upstream and WildFly shouldn't be maintaining forks.
There may be some pushback in upstream projects about doing things in a privileged block. A hopefully helpful way to look at things is to determine whether a given call path is something required by EE8 (the overall spec, not just the project specific spec.) If some call path that's required doesn't work, fixing that's a different request from asking for support for something like a user wanting to use a class generally meant for external client use inside a container (e.g. javax.ws.rs.client.ClientBuilder).
So, for JSON-B, JSR 366, EE.6.16 says:
{quote}In a full Java EE product, all Java EE application client containers, web
containers, and EJB containers are required to support the JSON-B API.{quote}
Now that doesn't say much, but the only way I can interpret it is the web and ejb containers have to expose the API to deployments. Which reasonably means the API jar is part of the container codebase. And then AFAIK the only way to use the API is with 'Jsonb jsonb = JsonbBuilder.create();' Which will fail in any container running with a security manager where the container gives its own code permissions but is restrictive for the deployment; i.e. in any normal container. So, the expected EE 8 use case will not work.
> Test JSONBTestCase fails with security manager
> ----------------------------------------------
>
> Key: WFLY-11365
> URL: https://issues.jboss.org/browse/WFLY-11365
> Project: WildFly
> Issue Type: Bug
> Components: EE, Test Suite
> Affects Versions: 15.0.0.Beta1
> Reporter: Martin Choma
> Assignee: Bartosz Baranowski
> Priority: Major
> Labels: security-manager
> Attachments: sm-fix.patch
>
>
> {noformat}
> org.jboss.as.test.integration.json (1)
> JSONBTestCase.testJsonbServlet
> {noformat}
> {noformat}
> java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.io.FilePermission" "/store/repository/org/eclipse/yasson/1.0.2/yasson-1.0.2.jar" "read")" in code source "(vfs:/content/jsonb10-test.war/WEB-INF/classes <no signer certificates>)" of "ModuleClassLoader for Module "deployment.jsonb10-test.war" from Service Module Loader")
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:294)
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:191)
> at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
> at org.wildfly.security.manager.WildFlySecurityManager.checkRead(WildFlySecurityManager.java:359)
> at java.util.zip.ZipFile.<init>(ZipFile.java:216)
> at java.util.zip.ZipFile.<init>(ZipFile.java:155)
> at java.util.jar.JarFile.<init>(JarFile.java:166)
> at java.util.jar.JarFile.<init>(JarFile.java:103)
> at sun.net.www.protocol.jar.URLJarFile.<init>(URLJarFile.java:93)
> at sun.net.www.protocol.jar.URLJarFile.getJarFile(URLJarFile.java:69)
> at sun.net.www.protocol.jar.JarFileFactory.get(JarFileFactory.java:99)
> at sun.net.www.protocol.jar.JarURLConnection.connect(JarURLConnection.java:122)
> at sun.net.www.protocol.jar.JarURLConnection.getInputStream(JarURLConnection.java:152)
> at java.net.URL.openStream(URL.java:1045)
> at java.util.ServiceLoader.parse(ServiceLoader.java:304)
> at java.util.ServiceLoader.access$200(ServiceLoader.java:185)
> at java.util.ServiceLoader$LazyIterator.hasNextService(ServiceLoader.java:357)
> at java.util.ServiceLoader$LazyIterator.access$600(ServiceLoader.java:323)
> at java.util.ServiceLoader$LazyIterator$1.run(ServiceLoader.java:396)
> at java.util.ServiceLoader$LazyIterator$1.run(ServiceLoader.java:395)
> at java.security.AccessController.doPrivileged(Native Method)
> at java.util.ServiceLoader$LazyIterator.hasNext(ServiceLoader.java:398)
> at java.util.ServiceLoader$1.hasNext(ServiceLoader.java:474)
> at javax.json.bind.spi.JsonbProvider.provider(JsonbProvider.java:112)
> at javax.json.bind.JsonbBuilder.create(JsonbBuilder.java:108)
> at org.jboss.as.test.integration.json.JSONBServlet.doGet(JSONBServlet.java:46) ...
> {noformat}
> Looks to me similar to WFLY-11337
> [1] https://ci.wildfly.org/viewLog.html?buildId=128138&buildTypeId=WF_MasterS...
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 6 months
[JBoss JIRA] (WFLY-11346) MicroProfile tests failing with security manager
by James Perkins (Jira)
[ https://issues.jboss.org/browse/WFLY-11346?page=com.atlassian.jira.plugin... ]
James Perkins commented on WFLY-11346:
--------------------------------------
I think in this case deployments should require the explicit permissions for the properties required. In other words I think the tests only need to be fixed.
> MicroProfile tests failing with security manager
> ------------------------------------------------
>
> Key: WFLY-11346
> URL: https://issues.jboss.org/browse/WFLY-11346
> Project: WildFly
> Issue Type: Bug
> Components: MP Config, Test Suite
> Affects Versions: 14.0.0.Final
> Reporter: Martin Choma
> Assignee: James Perkins
> Priority: Major
> Labels: security-manager
>
> {noformat}
> org.wildfly.test.integration.microprofile.config.smallrye.app (9)
> MicroProfileConfigTestCase.testGetBooleanProperties
> MicroProfileConfigTestCase.testGetDoubleProperties
> MicroProfileConfigTestCase.testGetFloatProperties
> MicroProfileConfigTestCase.testGetIntegerProperties
> MicroProfileConfigTestCase.testGetLongProperties
> MicroProfileConfigTestCase.testGetWithArraySetListDefaultProperties
> MicroProfileConfigTestCase.testGetWithArraySetListOverriddenProperties
> MicroProfileConfigTestCase.testGetWithConfigProperties
> MicroProfileConfigTestCase.testPriorityOrderingProperties
> org.wildfly.test.integration.microprofile.config.smallrye.converter (1)
> MicroProfileConfigConvertersTestCase.testConverterPriority
> org.wildfly.test.integration.microprofile.config.smallrye.management.config_source (1)
> ConfigSourceFromClassTestCase.testGetWithConfigProperties
> org.wildfly.test.integration.microprofile.config.smallrye.management.config_source_provider (1)
> ConfigSourceProviderFromClassTestCase.testGetWithConfigProperties
> {noformat}
> With MicroProfileConfigTestCase there is error
> {noformat}
> 12:01:38,872 ERROR [io.undertow.request] (default task-1) UT005023: Exception handling request to /MicroProfileConfigTestCase/microprofile/arraySetListDefaultTest: org.jboss.resteasy.spi.UnhandledException: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.lang.RuntimePermission" "getenv.myPets")" in code source "(vfs:/content/MicroProfileConfigTestCase.war/WEB-INF/classes <no signer certificates>)" of "null")
> at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:78)
> at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:222)
> at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:197)
> at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:459)
> at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
> at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
> at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
> at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
> at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
> at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
> at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
> at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> at io.opentracing.contrib.jaxrs2.server.SpanFinishingFilter.doFilter(SpanFinishingFilter.java:55)
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
> {noformat}
> So probably solution is to add such permissions to rs application TestApplication.
> For other tests (MicroProfileConfigConvertersTestCase, ConfigSourceFromClassTestCase, ConfigSourceProviderFromClassTestCase) this exception is not printed, but I think cause will be the same as the structure of these tests is the same
> [1] https://ci.wildfly.org/viewLog.html?buildId=128138&buildTypeId=WF_MasterS...
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 6 months
[JBoss JIRA] (WFLY-11346) MicroProfile tests failing with security manager
by James Perkins (Jira)
[ https://issues.jboss.org/browse/WFLY-11346?page=com.atlassian.jira.plugin... ]
James Perkins reassigned WFLY-11346:
------------------------------------
Assignee: James Perkins
> MicroProfile tests failing with security manager
> ------------------------------------------------
>
> Key: WFLY-11346
> URL: https://issues.jboss.org/browse/WFLY-11346
> Project: WildFly
> Issue Type: Bug
> Components: MP Config, Test Suite
> Affects Versions: 14.0.0.Final
> Reporter: Martin Choma
> Assignee: James Perkins
> Priority: Major
> Labels: security-manager
>
> {noformat}
> org.wildfly.test.integration.microprofile.config.smallrye.app (9)
> MicroProfileConfigTestCase.testGetBooleanProperties
> MicroProfileConfigTestCase.testGetDoubleProperties
> MicroProfileConfigTestCase.testGetFloatProperties
> MicroProfileConfigTestCase.testGetIntegerProperties
> MicroProfileConfigTestCase.testGetLongProperties
> MicroProfileConfigTestCase.testGetWithArraySetListDefaultProperties
> MicroProfileConfigTestCase.testGetWithArraySetListOverriddenProperties
> MicroProfileConfigTestCase.testGetWithConfigProperties
> MicroProfileConfigTestCase.testPriorityOrderingProperties
> org.wildfly.test.integration.microprofile.config.smallrye.converter (1)
> MicroProfileConfigConvertersTestCase.testConverterPriority
> org.wildfly.test.integration.microprofile.config.smallrye.management.config_source (1)
> ConfigSourceFromClassTestCase.testGetWithConfigProperties
> org.wildfly.test.integration.microprofile.config.smallrye.management.config_source_provider (1)
> ConfigSourceProviderFromClassTestCase.testGetWithConfigProperties
> {noformat}
> With MicroProfileConfigTestCase there is error
> {noformat}
> 12:01:38,872 ERROR [io.undertow.request] (default task-1) UT005023: Exception handling request to /MicroProfileConfigTestCase/microprofile/arraySetListDefaultTest: org.jboss.resteasy.spi.UnhandledException: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.lang.RuntimePermission" "getenv.myPets")" in code source "(vfs:/content/MicroProfileConfigTestCase.war/WEB-INF/classes <no signer certificates>)" of "null")
> at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:78)
> at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:222)
> at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:197)
> at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:459)
> at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
> at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
> at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
> at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
> at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
> at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
> at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
> at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> at io.opentracing.contrib.jaxrs2.server.SpanFinishingFilter.doFilter(SpanFinishingFilter.java:55)
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
> {noformat}
> So probably solution is to add such permissions to rs application TestApplication.
> For other tests (MicroProfileConfigConvertersTestCase, ConfigSourceFromClassTestCase, ConfigSourceProviderFromClassTestCase) this exception is not printed, but I think cause will be the same as the structure of these tests is the same
> [1] https://ci.wildfly.org/viewLog.html?buildId=128138&buildTypeId=WF_MasterS...
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 6 months
[JBoss JIRA] (WFLY-11347) Tests from org.jboss.as.test.integration.messaging fails with security manager
by James Perkins (Jira)
[ https://issues.jboss.org/browse/WFLY-11347?page=com.atlassian.jira.plugin... ]
James Perkins reassigned WFLY-11347:
------------------------------------
Assignee: ehsavoie Hugonnet (was: Bartosz Baranowski)
> Tests from org.jboss.as.test.integration.messaging fails with security manager
> ------------------------------------------------------------------------------
>
> Key: WFLY-11347
> URL: https://issues.jboss.org/browse/WFLY-11347
> Project: WildFly
> Issue Type: Bug
> Components: JMS, Test Suite
> Affects Versions: 14.0.0.Final
> Reporter: Martin Choma
> Assignee: ehsavoie Hugonnet
> Priority: Major
> Labels: security-manager
>
> {noformat}
> org.jboss.as.test.integration.messaging.jms.external (8)
> DiscoveryGroupExternalMessagingDeploymentTestCase.testSendMessageInClientQueue
> DiscoveryGroupExternalMessagingDeploymentTestCase.testSendMessageInClientTopic
> ExternalMessagingDeploymentRemoteTestCase.testSendMessageInClientQueue
> ExternalMessagingDeploymentRemoteTestCase.testSendMessageInClientTopic
> ExternalMessagingDeploymentTestCase.testSendMessageInClientQueue
> ExternalMessagingDeploymentTestCase.testSendMessageInClientTopic
> SendToExternalJMSQueueTestCase.sendMessage
> SendToExternalJMSTopicTestCase.sendMessage
> org.jboss.as.test.integration.messaging.jms.context.notClosingInjectedContext (1)
> NotClosingInjectedContextTestCase.testLeakingConnection
> org.jboss.as.test.integration.messaging.jms.definitions (3)
> JMSResourceDefinitionsTestCase.testAnnotationBasedDefinitionsWithVaultedAttributes
> JMSResourceDefinitionsTestCase.testDeploymendDescriptorBasedDefinitionsWithVaultedAttributes
> JMSResourceDefinitionsTestCase.testInjectedDefinitions
> org.jboss.as.test.integration.messaging.mgmt (1)
> ExternalPooledConnectionFactoryStatisticsTestCase.testStatistics
> {noformat}
> Check if it is enough to add permission to deployment or doPrivileged block is necessary somewhere. There are erros like this
> {noformat}
> &#27;[33m00:17:58,191 WARN [org.apache.activemq.artemis.core.client] (default task-1) AMQ212007: connector.create or connectorFactory.createConnector should never throw an exception, implementation is badly behaved, but we will deal with it anyway.: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.net.SocketPermission" "localhost" "resolve")" in code source "(vfs:/content/ClientMessagingDeploymentTestCase.war/WEB-INF/classes <no signer certificates>)" of "ModuleClassLoader for Module "deployment.ClientMessagingDeploymentTestCase.war" from Service Module Loader")
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:294)
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:191)
> at java.lang.SecurityManager.checkConnect(SecurityManager.java:1048)
> at org.wildfly.security.manager.WildFlySecurityManager.checkConnect(WildFlySecurityManager.java:389)
> at java.net.InetAddress.getAllByName0(InetAddress.java:1268)
> at java.net.InetAddress.getAllByName(InetAddress.java:1192)
> at java.net.InetAddress.getAllByName(InetAddress.java:1126)
> at java.net.InetAddress.getByName(InetAddress.java:1076)
> at java.net.InetSocketAddress.<init>(InetSocketAddress.java:220)
> at org.apache.activemq.artemis.core.remoting.impl.netty.NettyConnector.createConnection(NettyConnector.java:711)
> Caused by: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.net.SocketPermission" "localhost:45700" "listen,resolve")" in code source "(vfs:/content/ClientMessagingDeploymentTestCase.war/WEB-INF/classes <no signer certificates>)" of "ModuleClassLoader for Module "deployment.ClientMessagingDeploymentTestCase.war" from Service Module Loader")
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:294)
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:191)
> at java.lang.SecurityManager.checkListen(SecurityManager.java:1131)
> at org.wildfly.security.manager.WildFlySecurityManager.checkListen(WildFlySecurityManager.java:401)
> at java.net.DatagramSocket.bind(DatagramSocket.java:389)
> at java.net.MulticastSocket.<init>(MulticastSocket.java:172)
> at org.apache.activemq.artemis.api.core.UDPBroadcastEndpointFactory$UDPBroadcastEndpoint.openClient(UDPBroadcastEndpointFactory.java:203)
> at org.apache.activemq.artemis.core.cluster.DiscoveryGroup.start(DiscoveryGroup.java:105)
> at org.apache.activemq.artemis.core.client.impl.ServerLocatorImpl.initialize(ServerLocatorImpl.java:309)
> {noformat}
> [1] https://ci.wildfly.org/viewLog.html?buildId=128138&buildTypeId=WF_MasterS...
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 6 months
[JBoss JIRA] (WFLY-11365) Test JSONBTestCase fails with security manager
by James Perkins (Jira)
[ https://issues.jboss.org/browse/WFLY-11365?page=com.atlassian.jira.plugin... ]
James Perkins commented on WFLY-11365:
--------------------------------------
The biggest issue is the file permission would likely need to be an explicit path so with something like an RPM this could be an issue. The other option would be to use the {{<<ALL FILES>>}} permission which is not ideal either.
> Test JSONBTestCase fails with security manager
> ----------------------------------------------
>
> Key: WFLY-11365
> URL: https://issues.jboss.org/browse/WFLY-11365
> Project: WildFly
> Issue Type: Bug
> Components: EE, Test Suite
> Affects Versions: 15.0.0.Beta1
> Reporter: Martin Choma
> Assignee: Bartosz Baranowski
> Priority: Major
> Labels: security-manager
> Attachments: sm-fix.patch
>
>
> {noformat}
> org.jboss.as.test.integration.json (1)
> JSONBTestCase.testJsonbServlet
> {noformat}
> {noformat}
> java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.io.FilePermission" "/store/repository/org/eclipse/yasson/1.0.2/yasson-1.0.2.jar" "read")" in code source "(vfs:/content/jsonb10-test.war/WEB-INF/classes <no signer certificates>)" of "ModuleClassLoader for Module "deployment.jsonb10-test.war" from Service Module Loader")
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:294)
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:191)
> at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
> at org.wildfly.security.manager.WildFlySecurityManager.checkRead(WildFlySecurityManager.java:359)
> at java.util.zip.ZipFile.<init>(ZipFile.java:216)
> at java.util.zip.ZipFile.<init>(ZipFile.java:155)
> at java.util.jar.JarFile.<init>(JarFile.java:166)
> at java.util.jar.JarFile.<init>(JarFile.java:103)
> at sun.net.www.protocol.jar.URLJarFile.<init>(URLJarFile.java:93)
> at sun.net.www.protocol.jar.URLJarFile.getJarFile(URLJarFile.java:69)
> at sun.net.www.protocol.jar.JarFileFactory.get(JarFileFactory.java:99)
> at sun.net.www.protocol.jar.JarURLConnection.connect(JarURLConnection.java:122)
> at sun.net.www.protocol.jar.JarURLConnection.getInputStream(JarURLConnection.java:152)
> at java.net.URL.openStream(URL.java:1045)
> at java.util.ServiceLoader.parse(ServiceLoader.java:304)
> at java.util.ServiceLoader.access$200(ServiceLoader.java:185)
> at java.util.ServiceLoader$LazyIterator.hasNextService(ServiceLoader.java:357)
> at java.util.ServiceLoader$LazyIterator.access$600(ServiceLoader.java:323)
> at java.util.ServiceLoader$LazyIterator$1.run(ServiceLoader.java:396)
> at java.util.ServiceLoader$LazyIterator$1.run(ServiceLoader.java:395)
> at java.security.AccessController.doPrivileged(Native Method)
> at java.util.ServiceLoader$LazyIterator.hasNext(ServiceLoader.java:398)
> at java.util.ServiceLoader$1.hasNext(ServiceLoader.java:474)
> at javax.json.bind.spi.JsonbProvider.provider(JsonbProvider.java:112)
> at javax.json.bind.JsonbBuilder.create(JsonbBuilder.java:108)
> at org.jboss.as.test.integration.json.JSONBServlet.doGet(JSONBServlet.java:46) ...
> {noformat}
> Looks to me similar to WFLY-11337
> [1] https://ci.wildfly.org/viewLog.html?buildId=128138&buildTypeId=WF_MasterS...
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 6 months