Granting Java2 Security permissions in a policy file only to certain components of an ear file ---------------------------------------------------------------------------------------------- Key: JBAS-6660 URL: https://jira.jboss.org/jira/browse/JBAS-6660 Project: JBoss Application Server Issue Type: Feature Request Security Level: Public (Everyone can see) Components: Security Affects Versions: JBossAS-4.0.5.GA Environment: Win XP, Sun JDK 1.5.0_13, JBoss 4.0.5GA Reporter: Robert Panzer Assignee: Anil Saldhana Fix For: JBossAS-4.0.5.GA In our application it is necessary to grant permissions as defined by Java2 Security only to certain jars inside the ear and not the whole application. Our application runs on JBoss 4.0.5GA so all descriptions refer to this version. Support was already added to the MainDeployer and UnifiedClassLoader to remember the original URL aka origUrl so that the UnifiedClassLoader retrieves the permissions from the policy file using the origURL as codeSource. The "real" codeBase might point to a temporary jar in the tmp/ directory, so this is already a enhancement. Unfortunately the origURL always references the top most component of a DeploymentInfo hierarchy. To clarify this let me give the following example of an ear file: jboss +-- server +-- deploy +-- MyApp.ear +-- MyEJB.jar When checking a permission in MyEJB.jar the origURL always points to file:/.../server/deploy/MyApp.ear. But I'd prefer to let it point to file:/xxx/jboss/server/deploy/MyApp.ear/MyEJB.jar so that I'm able to grant permissions only to the MyEJB.jar using an entry in the policy file like: grant codeBase "${jboss.server.home.url}deploy/MyApp.ear/MyEJB.jar" { permission com.foo.MyPermission "A"; permission com.foo.MyPermission "B"; }; I have already prepared a patch that works for me: Added in the class org.jboss.deployment.DeploymentInfo in jboss-system.jar: URL policyCodeSourceUrl = getPolicyCodeSourceUrl(); log.info("Map Policy CodeSource for "+localUrl+" to "+policyCodeSourceUrl); ucl.setPolicyCodeSourceUrl(localUrl, policyCodeSourceUrl); private URL getPolicyCodeSourceUrl() throws Exception { DeploymentInfo current = this; StringBuffer sOrigURL = new StringBuffer(); while (current.parent != null) { sOrigURL.insert(0, "/"+current.shortName); current = current.parent; } String currentUrl = current.url.toExternalForm(); if (currentUrl.endsWith("/")) sOrigURL.insert(0, currentUrl.substring(0, currentUrl.length()-1)); else sOrigURL.insert(0, currentUrl); URL policyCodeSourceUrl = new URL(sOrigURL.toString()); return policyCodeSourceUrl; } Added in the class org.jboss.mx.loading.RepositoryClassLoader in jboss-jmx.jar: /** Maps the local URLs from the repository to URLs pointing to the jar file in the deploy dir, * even into an ear file. */ Map localUrl2PolicyCodeSourceUrlMap = new HashMap(); public void setPolicyCodeSourceUrl(URL localUrl, URL policyCodeSourceUrl) { localUrl2PolicyCodeSourceUrlMap.put(localUrl, policyCodeSourceUrl); } public URL getPolicyCodeSourceUrl( URL localUrl ) { return (URL)localUrl2PolicyCodeSourceUrlMap.get(localUrl); } Added in class org.jboss.mx.loading.UnifiedClassLoader in jboss-jmx.jar : URL policyCodeSourceUrl = getPolicyCodeSourceUrl(cs.getLocation()); if (policyCodeSourceUrl!=null) { permCS = new CodeSource(policyCodeSourceUrl, cs.getCertificates()); } Basically, at deployment time a URL is composed of the complete origUrl of the topmost component and the short names of all sub deployments. Then a mapping from the localURL, that is the codeSource when checking the permission, to the composed Url is stored in the RepositoryClassLoader. When the UnifiedClassLoader.getPermissions(CodeSource cs) is called for a local URL the permissions for the composed CodeBase are returned. This already works in our environment. Do you think that this requirement and the approach to solve our problem is ok? -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira