7:37 p.m.
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public (Everyone can see)
Reporter: Ron Sigal
Fix For: 2.4.0.CR1 (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:39 a.m.
New subject: [JBoss JIRA] Assigned: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=all ]
David Lloyd reassigned JBREM-920:
---------------------------------
Assignee: David Lloyd
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.CR1 (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:41 a.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12401819 ]
David Lloyd commented on JBREM-920:
-----------------------------------
Committed - for better or worse :-)
All functional tests are now running with a security manager. I haven't enabled it
for the stress tests though. I'm leaving this open in the (likely) event that this
somehow breaks Hudson test runs or something.
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.CR1 (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:39 p.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12401855 ]
Ron Sigal commented on JBREM-920:
---------------------------------
This is paying off already. org.jboss.remoting.transport.http.HTTPClientInvoker calls
Class.getMethod():
java.security.AccessControlException: access denied (java.lang.RuntimePermission
accessClassInPackage.sun.net.www.protocol.https)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:269)
at java.security.AccessController.checkPermission(AccessController.java:401)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:524)
at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1491)
at java.lang.Class.checkMemberAccess(Class.java:1450)
at java.lang.Class.getMethod(Class.java:983)
at
org.jboss.remoting.transport.http.HTTPClientInvoker.getSimulatedTimeout(HTTPClientInvoker.java:582)
at
org.jboss.remoting.transport.http.HTTPClientInvoker.transport(HTTPClientInvoker.java:138)
at org.jboss.remoting.MicroRemoteClientInvoker.invoke(MicroRemoteClientInvoker.java:157)
at org.jboss.remoting.Client.invoke(Client.java:1685)
at org.jboss.remoting.Client.invoke(Client.java:589)
at org.jboss.remoting.Client.invoke(Client.java:577)
at
org.jboss.test.remoting.callback.sslsocketfactory.SSLSocketFactoryTestParent.testSSLServerSocketFactory(SSLSocketFactoryTestParent.java:110)
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.CR1 (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:22 p.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12401856 ]
Ron Sigal commented on JBREM-920:
---------------------------------
Here's another necessary permission - java.io.SerializablePermission
enableSubclassImplementation:
org.jboss.test.remoting.client.ClientSerializationTestCase(java_serialization).testJBossSerialization
Failing for the past 1 build (Since Unstable#88 )
Took 0 seconds.
org.jboss.remoting.CannotConnectException: Can not get connection to server. Problem
establishing socket connection for InvokerLocator
[socket://10.18.0.216:3025/?serializationtype=jboss]
at
org.jboss.remoting.transport.socket.MicroSocketClientInvoker.transport(MicroSocketClientInvoker.java:738)
at org.jboss.remoting.MicroRemoteClientInvoker.invoke(MicroRemoteClientInvoker.java:157)
at org.jboss.remoting.Client.invoke(Client.java:1685)
at org.jboss.remoting.Client.invoke(Client.java:589)
at org.jboss.remoting.Client.invoke(Client.java:577)
at
org.jboss.test.remoting.client.ClientSerializationTestCase.testJBossSerialization(ClientSerializationTestCase.java:118)
Caused by: java.lang.reflect.InvocationTargetException
at java.lang.reflect.Constructor.newInstance(Constructor.java:274)
at
org.jboss.remoting.transport.socket.SocketClientInvoker.createClientSocket(SocketClientInvoker.java:162)
at
org.jboss.remoting.transport.socket.MicroSocketClientInvoker.getConnection(MicroSocketClientInvoker.java:1070)
at
org.jboss.remoting.transport.socket.MicroSocketClientInvoker.transport(MicroSocketClientInvoker.java:728)
... 20 more
Caused by: java.security.AccessControlException: access denied
(java.io.SerializablePermission enableSubclassImplementation)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:269)
at java.security.AccessController.checkPermission(AccessController.java:401)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:524)
at java.io.ObjectOutputStream.<init>(ObjectOutputStream.java:206)
at
org.jboss.serial.io.JBossObjectOutputStream.<init>(JBossObjectOutputStream.java:126)
at
org.jboss.serial.io.JBossObjectOutputStream.<init>(JBossObjectOutputStream.java:116)
at
org.jboss.remoting.serialization.impl.jboss.JBossSerializationManager.createOutput(JBossSerializationManager.java:63)
at
org.jboss.remoting.marshal.serializable.SerializableMarshaller.getMarshallingStream(SerializableMarshaller.java:89)
at
org.jboss.remoting.marshal.serializable.SerializableMarshaller.getMarshallingStream(SerializableMarshaller.java:72)
at
org.jboss.remoting.transport.socket.ClientSocketWrapper.createOutputStream(ClientSocketWrapper.java:204)
at
org.jboss.remoting.transport.socket.ClientSocketWrapper.createStreams(ClientSocketWrapper.java:163)
at
org.jboss.remoting.transport.socket.ClientSocketWrapper.<init>(ClientSocketWrapper.java:66)
... 27 more
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.CR1 (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:25 p.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12401857 ]
Ron Sigal commented on JBREM-920:
---------------------------------
Another - java.lang.RuntimePermission accessClassInPackage.sun.net.www.protocol.http
org.jboss.test.remoting.configuration.HTTPConfigurationTestCase(java_serialization_tomcat).testClientConfiguration
java.security.AccessControlException: access denied (java.lang.RuntimePermission
accessClassInPackage.sun.net.www.protocol.http)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:269)
at java.security.AccessController.checkPermission(AccessController.java:401)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:524)
at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1491)
at java.lang.Class.checkMemberAccess(Class.java:1450)
at java.lang.Class.getMethod(Class.java:983)
at
org.jboss.remoting.transport.http.HTTPClientInvoker.getSimulatedTimeout(HTTPClientInvoker.java:582)
at
org.jboss.remoting.transport.http.HTTPClientInvoker.transport(HTTPClientInvoker.java:138)
at org.jboss.remoting.MicroRemoteClientInvoker.invoke(MicroRemoteClientInvoker.java:157)
at org.jboss.remoting.Client.invoke(Client.java:1685)
at org.jboss.remoting.Client.invoke(Client.java:589)
at org.jboss.remoting.Client.invoke(Client.java:577)
at
org.jboss.test.remoting.configuration.HTTPConfigurationTestCase.testClientConfiguration(HTTPConfigurationTestCase.java:112)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:324)
at junit.framework.TestCase.runTest(TestCase.java:154)
at junit.framework.TestCase.runBare(TestCase.java:127)
at junit.framework.TestResult$1.protect(TestResult.java:106)
at junit.framework.TestResult.runProtected(TestResult.java:124)
at junit.framework.TestResult.run(TestResult.java:109)
at junit.framework.TestCase.run(TestCase.java:118)
at junit.framework.TestSuite.runTest(TestSuite.java:208)
at junit.framework.TestSuite.run(TestSuite.java:203)
at
org.apache.tools.ant.taskdefs.optional.junit.JUnitTestRunner.run(JUnitTestRunner.java:297)
at
org.apache.tools.ant.taskdefs.optional.junit.JUnitTestRunner.launch(JUnitTestRunner.java:672)
at
org.apache.tools.ant.taskdefs.optional.junit.JUnitTestRunner.main(JUnitTestRunner.java:567)
Mar 7, 2008 10:45:24 PM org.apache.coyote.http11.Http11BaseProtocol destroy
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.CR1 (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:27 p.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12401858 ]
Ron Sigal commented on JBREM-920:
---------------------------------
Another - java.lang.RuntimePermission setContextClassLoader:
org.jboss.test.remoting.classloader.race.bisocket.BisocketClassloaderRaceTestCase(java_serialization).testSequential
java.security.AccessControlException: access denied (java.lang.RuntimePermission
setContextClassLoader)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:269)
at java.security.AccessController.checkPermission(AccessController.java:401)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:524)
at java.lang.Thread.setContextClassLoader(Thread.java:1212)
at
org.jboss.test.remoting.classloader.race.ClassloaderRaceTestParent$SimpleInvocationThread.run(ClassloaderRaceTestParent.java:315)
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.CR1 (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:13 a.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12401859 ]
Ron Sigal commented on JBREM-920:
---------------------------------
Another - javax.management.MBeanServerPermission: name=createMBeanServer actions=:
org.jboss.test.remoting.detection.registry.NetworkRegistryTestCase(java_serialization).testRegistration
java.security.AccessControlException: access denied
javax.management.MBeanServerPermission: name=createMBeanServer actions=
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:269)
at java.security.AccessController.checkPermission(AccessController.java:401)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:524)
at javax.management.MBeanServerFactory.checkPermission(MBeanServerFactory.java:287)
at javax.management.MBeanServerFactory.createMBeanServer(MBeanServerFactory.java:167)
at javax.management.MBeanServerFactory.createMBeanServer(MBeanServerFactory.java:162)
at
org.jboss.test.remoting.detection.registry.NetworkRegistryTestCase.testRegistration(NetworkRegistryTestCase.java:57)
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.CR1 (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:48 a.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12401870 ]
David Lloyd commented on JBREM-920:
-----------------------------------
And here I thought I found them all. :-)
Fixes committed, will find out about 6-8 hours from now if it actually works.
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.CR1 (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:23 a.m.
New subject: [JBoss JIRA] Updated: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=all ]
Ron Sigal updated JBREM-920:
----------------------------
Fix Version/s: 2.4.0.GA
(was: 2.4.0.CR1 (Pinto))
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.GA
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:49 p.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12403948 ]
David Lloyd commented on JBREM-920:
-----------------------------------
Many tests are passing despite access failures. I've added a "tripwire"
sort of security manager that logs the violations, with interesting results. For
example:
java.security.AccessControlException: access denied (java.util.PropertyPermission
org.jboss.logging.Logger.pluginClass read)
at
java.security.AccessControlContext.checkPermission(AccessControlContext.java:264)
at java.security.AccessController.checkPermission(AccessController.java:427)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at
org.jboss.test.security.LoggingSecurityManager.checkPermission(LoggingSecurityManager.java:22)
at java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1285)
at
org.jboss.test.security.LoggingSecurityManager.checkPropertyAccess(LoggingSecurityManager.java:191)
at java.lang.System.getProperty(System.java:662)
at org.jboss.logging.Logger.init(Logger.java:359)
Do we need an updated jboss logging? Ours is: Implementation-Version: 4.0.4beta (build:
CVSTag=Branch_4_0 date=200601031254) How do we decide which version to use? I presume
that we're getting the above problem because the Logger isn't doing
System.getProperty within a privileged block.
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.GA
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:11 p.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12403959 ]
David Lloyd commented on JBREM-920:
-----------------------------------
Need a privileged block added:
java.security.AccessControlException: access denied (java.net.SocketPermission
127.0.0.1:3455 connect,resolve)
[...]
at
org.jboss.remoting.transport.rmi.RMIServerInvoker.initRMI(RMIServerInvoker.java:219)
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.GA
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:36 p.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12403960 ]
David Lloyd commented on JBREM-920:
-----------------------------------
One more privileged block:
java.security.AccessControlException: access denied (java.net.SocketPermission
127.0.0.1:8888 connect,resolve)
[...]
at
org.jboss.remoting.transport.rmi.RMIClientInvoker.handleConnect(RMIClientInvoker.java:232)
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.GA
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:15 a.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12403970 ]
Ron Sigal commented on JBREM-920:
---------------------------------
Updated RMIServerInvoker, RMIClientInvoker, and ObjectInputStreamWithClassLoader.
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.GA
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:03 p.m.
New subject: [JBoss JIRA] Commented: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=comments#action_12409701 ]
Ron Sigal commented on JBREM-920:
---------------------------------
Four policy files have been created in the src/etc directory:
* remoting.security.policy.core: these are the permissions needed to run all of the
Remoting facilities, i.e., the code in src/main
* remoting.security.policy.tests: these are the permissions needed to run most of the
Remoting test suite, i.e., the code in src/tests, with the following exceptions
* remoting.security.policy.tests.marshal: these are the permissions used to run ant
target "tests.marshal"
* remoting.security.policy.tests.minimal: these are the permissions used to run ant
target "tests.functional.main.security" and
"tests.functional.main.http.security"
Many of the tests require more permissions than the typical application code, e.g., the
ability to access a classloader, so it is possible that giving the test suite the
necessary permissions could result in failing to uncover a permission that should have
been granted to the core Remoting code. Therefore, the
"tests.functional.main.http.security" target was created, which runs a single
test for each of the Remoting transports. These particular tests run with a very small
set of permissions.
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.GA
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:43 p.m.
New subject: [JBoss JIRA] Updated: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=all ]
Ron Sigal updated JBREM-920:
----------------------------
Fix Version/s: 2.4.0.CR2
(was: 2.4.0.GA)
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.CR2
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:05 p.m.
New subject: [JBoss JIRA] Updated: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=all ]
Ron Sigal updated JBREM-920:
----------------------------
Fix Version/s: 2.4.0.GA
(was: 2.4.0.CR2)
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: David Lloyd
Fix For: 2.4.0.GA
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:29 p.m.
New subject: [JBoss JIRA] Assigned: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=all ]
Ron Sigal reassigned JBREM-920:
-------------------------------
Assignee: Ron Sigal (was: David Lloyd)
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: Ron Sigal
Fix For: 2.4.0.GA
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:19 p.m.
New subject: [JBoss JIRA] Closed: (JBREM-920) Create build.xml target to run test suite with a Security Manager
[ http://jira.jboss.com/jira/browse/JBREM-920?page=all ]
Ron Sigal closed JBREM-920.
---------------------------
Resolution: Done
Six builds of the Remoting functional test suite are now running in hudson:
* jdk 1.4 / no security manager
* jdk 1.4 / with security manager
* jdk 1.5 / no security manager
* jdk 1.5 / with security manager
* jdk 1.6 / no security manager
* jdk 1.6 / with security manager
The installation of a security manager is turned on and off with the flag
-Denable.security.manager={true,false}
There are currently no problems with the jdk 1.5 and 1.6 builds with security manager
installed. The jdk 1.4 build has some problems because the classes
javax.management.MBeanServerPermission and javax.management.MBeanPermission are not
available in rt.jar. It is necessary to install a JMX implementation in jre/lib/endorsed.
With the Sun reference implemenation jmxri.jar installed, the problems go away when run
on a Windows laptop. A request has been made for the appropriate configuration on the
JBoss labs machines.
Create build.xml target to run test suite with a Security Manager
-----------------------------------------------------------------
Key: JBREM-920
URL: http://jira.jboss.com/jira/browse/JBREM-920
Project: JBoss Remoting
Issue Type: Task
Security Level: Public(Everyone can see)
Reporter: Ron Sigal
Assigned To: Ron Sigal
Fix For: 2.4.0.GA (Pinto)
From Anil Saldana:
Presuming that you have a test suite and either use ANT or Maven, I
recommend an extra target to run the test suite in a Java Security
Manager with minimal permissions. So for ANT, you will have an
additional target. For MAVEN, you can use a profile.
The idea is that you have a Java Security Policy file in which you
provide unlimited permission to third party libraries and minimal
permissions to your own code. This exercise is to detect critical
sections of code that need special privileges and get into privileged
blocks. If you have an extra target for the security manager and your
test runs happen on hudson, you can detect issues with security manager
as new code gets added.
Please do not have one test that does System.setSecurityManager but run
your entire test suite via the security manager
(-Djava.security.manager -Djava.security.policy=somefile).
Example: (Take a look by clicking "Configure" on the LHS)
http://hudson.qa.jboss.com/hudson/job/JBossSX_SecurityManager/
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-s...
Now if your head is spinning or you do not care about security or do not
have the time to do it, please tell me. I can engage myself, someone
from JBoss Security Team or the QA person handling your project to add a
JIRA issue (and make the build.xml/pom.xml changes for your project).
Why is this important?
* Because many customers run JBAS in a security manager and we need to
detect issues in our own code. Also during a recent integration work
with JBoss Messaging for the SOA platform, there was one issue with
remoting (JBREM-811) that gave some head ache to Clebert and Ron (who is
still reeling). It took some cycles from me also.
* We need to have tests running in a security manager on an ongoing basis.
I understand that there are resource issues in various projects. But
that does not discount the work that we need to do before we ship JBAS. ;)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6631
days inactive
6722
days old
18 comments
2 participants
participants (2)
-
David Lloyd (JIRA) -
Ron Sigal (JIRA)