4:49 p.m.
Will Reichert created AS7-3744:
----------------------------------
Summary: AccessControlException because of SerializableClass.callReadObject
Key: AS7-3744
URL: https://issues.jboss.org/browse/AS7-3744
Project: Application Server 7
Issue Type: Bug
Components: Remoting
Affects Versions: 7.1.0.Final
Environment: Fedora 16
Reporter: Will Reichert
Assignee: David Lloyd
Priority: Blocker
see https://community.jboss.org/message/716366#716366 for details.
Invoking an EJB from a remote client throws an AccessControlException after 60+ successful
invocations despite AllPermission in the policy file. The patch we developed in the
discussion was to modify
org/jboss/marshalling/reflect/SerializableClass.callReadObject(...) to use a privileged
action. The workaround passed the tests in jboss-marshalling and worked for the remote EJB
invocation (over 100,000 successful invocations before stopping test).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:02 p.m.
[
https://issues.jboss.org/browse/AS7-3744?page=com.atlassian.jira.plugin.s...
]
David Lloyd commented on AS7-3744:
----------------------------------
I think the fix just masks the real problem, which has to do with some race condition in
the JDK having to do with non-trivial protection domains.
The proposed patch concept introduces a real security risk that allows anyone to bypass
access control even if a security manager is present, and also defeats the security
restrictions upon the serialized object itself, so the patch will definitely not make it
upstream as-is. If the problem relates to protection domain depth, than an acceptable
version of the patch (which would perform a permission check before acquiring an
access-privileged SerializableClass instance) would likely suffer from the same problem.
AccessControlException because of SerializableClass.callReadObject
------------------------------------------------------------------
Key: AS7-3744
URL: https://issues.jboss.org/browse/AS7-3744
Project: Application Server 7
Issue Type: Bug
Components: Remoting
Affects Versions: 7.1.0.Final
Environment: Fedora 16
Reporter: Will Reichert
Assignee: David Lloyd
Priority: Blocker
see https://community.jboss.org/message/716366#716366 for details.
Invoking an EJB from a remote client throws an AccessControlException after 60+
successful invocations despite AllPermission in the policy file. The patch we developed in
the discussion was to modify
org/jboss/marshalling/reflect/SerializableClass.callReadObject(...) to use a privileged
action. The workaround passed the tests in jboss-marshalling and worked for the remote EJB
invocation (over 100,000 successful invocations before stopping test).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:34 p.m.
[
https://issues.jboss.org/browse/AS7-3744?page=com.atlassian.jira.plugin.s...
]
David Lloyd commented on AS7-3744:
----------------------------------
Here is a possibly better patch:
http://github.com/dmlloyd/jboss-marshalling/commit/85e6d3f - would you mind testing it
with your stress test?
AccessControlException because of SerializableClass.callReadObject
------------------------------------------------------------------
Key: AS7-3744
URL: https://issues.jboss.org/browse/AS7-3744
Project: Application Server 7
Issue Type: Bug
Components: Remoting
Affects Versions: 7.1.0.Final
Environment: Fedora 16
Reporter: Will Reichert
Assignee: David Lloyd
Priority: Blocker
see https://community.jboss.org/message/716366#716366 for details.
Invoking an EJB from a remote client throws an AccessControlException after 60+
successful invocations despite AllPermission in the policy file. The patch we developed in
the discussion was to modify
org/jboss/marshalling/reflect/SerializableClass.callReadObject(...) to use a privileged
action. The workaround passed the tests in jboss-marshalling and worked for the remote EJB
invocation (over 100,000 successful invocations before stopping test).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:17 a.m.
[
https://issues.jboss.org/browse/AS7-3744?page=com.atlassian.jira.plugin.s...
]
Will Reichert commented on AS7-3744:
------------------------------------
David, the patch works in my environment (Fedora 16) but it does not for another member of
the performance team (not sure the OS). I am not certain how best to proceed but I believe
this is pointing toward a potential race condition inside the JDK.
AccessControlException because of SerializableClass.callReadObject
------------------------------------------------------------------
Key: AS7-3744
URL: https://issues.jboss.org/browse/AS7-3744
Project: Application Server 7
Issue Type: Bug
Components: Remoting
Affects Versions: 7.1.0.Final
Environment: Fedora 16
Reporter: Will Reichert
Assignee: David Lloyd
Priority: Blocker
see https://community.jboss.org/message/716366#716366 for details.
Invoking an EJB from a remote client throws an AccessControlException after 60+
successful invocations despite AllPermission in the policy file. The patch we developed in
the discussion was to modify
org/jboss/marshalling/reflect/SerializableClass.callReadObject(...) to use a privileged
action. The workaround passed the tests in jboss-marshalling and worked for the remote EJB
invocation (over 100,000 successful invocations before stopping test).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:51 a.m.
[
https://issues.jboss.org/browse/AS7-3744?page=com.atlassian.jira.plugin.s...
]
Jeremy Whiting commented on AS7-3744:
-------------------------------------
Hi David,
I have been testing on F16 the same benchmark. After doing a re-installation of the
update marshalling libraries the problem no longer occurs.
AccessControlException because of SerializableClass.callReadObject
------------------------------------------------------------------
Key: AS7-3744
URL: https://issues.jboss.org/browse/AS7-3744
Project: Application Server 7
Issue Type: Bug
Components: Remoting
Affects Versions: 7.1.0.Final
Environment: Fedora 16
Reporter: Will Reichert
Assignee: David Lloyd
Priority: Blocker
see https://community.jboss.org/message/716366#716366 for details.
Invoking an EJB from a remote client throws an AccessControlException after 60+
successful invocations despite AllPermission in the policy file. The patch we developed in
the discussion was to modify
org/jboss/marshalling/reflect/SerializableClass.callReadObject(...) to use a privileged
action. The workaround passed the tests in jboss-marshalling and worked for the remote EJB
invocation (over 100,000 successful invocations before stopping test).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:05 p.m.
[
https://issues.jboss.org/browse/AS7-3744?page=com.atlassian.jira.plugin.s...
]
David Lloyd commented on AS7-3744:
----------------------------------
Okay in that case I'll push up this patch and call this "resolved".
AccessControlException because of SerializableClass.callReadObject
------------------------------------------------------------------
Key: AS7-3744
URL: https://issues.jboss.org/browse/AS7-3744
Project: Application Server 7
Issue Type: Bug
Components: Remoting
Affects Versions: 1.3.7.GA
Environment: Fedora 16
Reporter: Will Reichert
Assignee: David Lloyd
Priority: Blocker
see https://community.jboss.org/message/716366#716366 for details.
Invoking an EJB from a remote client throws an AccessControlException after 60+
successful invocations despite AllPermission in the policy file. The patch we developed in
the discussion was to modify
org/jboss/marshalling/reflect/SerializableClass.callReadObject(...) to use a privileged
action. The workaround passed the tests in jboss-marshalling and worked for the remote EJB
invocation (over 100,000 successful invocations before stopping test).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5214
days inactive
5215
days old
5 comments
3 participants
participants (3)
-
David Lloyd (JIRA) -
Jeremy Whiting (JIRA)
-
Will Reichert (JIRA)