[jbossws-commits] JBossWS SVN: r11187 - in stack/cxf/trunk/modules/testsuite: src and 4 other directories.

Author: jim.ma Date: 2009-12-03 05:02:58 -0500 (Thu, 03 Dec 2009) New Revision: 11187 Added: stack/cxf/trunk/modules/testsuite/src/ stack/cxf/trunk/modules/testsuite/src/test/ stack/cxf/trunk/modules/testsuite/src/test/resources/ stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/ stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/ stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/server.policy Log: [JBWS-2692]:added the server.policy for jboss-5.1.0 Added: stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/server.policy =================================================================== --- stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/server.policy (rev 0) +++ stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/server.policy 2009-12-03 10:02:58 UTC (rev 11187) @@ -0,0 +1,433 @@ +// The Java2 security policy for the securitymgr tests +// Install with -Djava.security.policy==server.policy +// and -Djboss.home.dir=path_to_jboss_distribution + +// *************************************** +// Trusted core Java code +//*************************************** +grant codeBase "file:${java.home}/lib/ext/-" { + permission java.security.AllPermission; +}; +grant codeBase "file:${java.home}/lib/*" { + permission java.security.AllPermission; +}; +// For java.home pointing to the JDK jre directory +grant codeBase "file:${java.home}/../lib/*" { + permission java.security.AllPermission; +}; + + + + +//******************************************** +// Trusted core JBoss code (REAL URL Version) +//******************************************** +grant codeBase "file:${jboss.home.dir}/bin/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/common/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/server/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deployers/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/work/-" { + permission java.security.AllPermission; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/common/lib/log4j.jar!/" { + permission java.lang.RuntimePermission "getClassLoader"; +}; +grant codeBase "jar:file:${jboss.server.home.dir}/common/lib/servlet-api.jar!/" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +//******************************************** +// Trusted core JBoss code (VFS URL Version) +//******************************************** +grant codeBase "vfszip:${jboss.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.home.dir}/common/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.home.dir}/server/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deployers/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/work/-" { + permission java.security.AllPermission; +}; + + +//******************************************************* +// Trusted Specific JBoss Code (REAL URL Version) +//******************************************************* +grant codeBase "file:${jboss.server.home.dir}/conf/bindingservice.beans/jboss-bindingservice.jar/-"{ + permission java.io.FilePermission "${jboss.home.dir}/deploy/jbossweb.sar/server.xml", "read"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" { + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jmx-console.war/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jmx-remoting.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission java.net.SocketPermission "*", "accept,listen,resolve"; + permission java.lang.RuntimePermission "getClassLoader"; + permission java.util.logging.LoggingPermission "control"; +}; + + +grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/jsf-libs/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar/-" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/conf/bindingservice.beans/jboss-bindingservice.jar!/"{ + permission java.util.PropertyPermission "*", "write"; + permission java.io.FilePermission "${jboss.server.home.dir}/deploy/jbossweb.sar/server.xml", "read"; + permission java.io.FilePermission "${jboss.server.home.dir}/tmp/-", "write,delete"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar!/jboss-local-jdbc.jar" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/management/console-mgr.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","*"; + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup,rebind,unbind"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/-" { + permission java.security.AllPermission; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/jms-ra.rar!/jms-ra.jar" { + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar", "read"; + permission javax.management.MBeanPermission "*", "getAttribute,invoke,setAttribute"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/jms-ra.rar/jms-ra.jar!/" { + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar", "read"; + permission javax.management.MBeanPermission "*", "getAttribute,invoke,setAttribute"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/quartz-ra.rar!/quartz-ra.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/quartz-ra.rar/quartz-ra.jar!/" { + permission java.security.AllPermission; +}; + + + +//******************************************************* +// Trusted Specific JBoss Code (VFS URL Version) +//******************************************************* +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" { + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" { + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jmx-console.war/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/jmx-console.war/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jmx-remoting.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission java.net.SocketPermission "*", "accept,listen,resolve"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jboss-web-service.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jbossweb.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/jbossweb.sar/jbossweb.jar/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jsf-libs/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jasper-jdt.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jstl.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar/-" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/management/console-mgr.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","*"; + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup,rebind,unbind"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup,rebind,unbind"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jms-ra.rar/jms-ra.jar" { + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar", "read"; + permission javax.management.MBeanPermission "*", "getAttribute,invoke,setAttribute"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/quartz-ra.rar/quartz-ra.jar" { + permission java.security.AllPermission; +}; + +//*************************************************************** +// JBoss AS Test Suite Permissions (REAL URL Version) +//*************************************************************** + +// Permissions for the WarPermissionsUnitTestCase +grant codeBase "file:${jboss.test.deploy.dir}/securitymgr/-" { + permission java.util.PropertyPermission "*", "read"; + permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; +}; + +grant codeBase "file:${jboss.test.deploy.dir}/securitymgr/-" { + permission java.util.PropertyPermission "*", "read"; + permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete"; +}; + +grant codeBase "file:${jboss.test.deploy.dir}/jbosstest-web.ear/-" { + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","list,lookup"; + permission org.jboss.naming.JndiPermission "env","list"; + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "getClassLoader"; + permission java.lang.RuntimePermission "getProtectionDomain"; +}; + +grant codeBase "jar:file:${jboss.test.deploy.dir}/jbosstest-web.ear!/jbosstest-web.war" { + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","list,lookup"; + permission org.jboss.naming.JndiPermission "env","list"; + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "getClassLoader"; + permission java.lang.RuntimePermission "getProtectionDomain"; +}; +grant codeBase "jar:file:${jboss.test.deploy.dir}/jbosstest-web.ear!/lib/util.jar" { + permission java.lang.RuntimePermission "getClassLoader"; + permission java.lang.RuntimePermission "getProtectionDomain"; +}; + + +grant codeBase "file:${jboss.test.deploy.dir}/-" { + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","listBindings,lookup"; +}; + +grant codeBase "file:${jboss.test.deploy.dir}/class-loading.war/WEB-INF/classes/" { + permission java.lang.RuntimePermission "getClassLoader"; + permission java.lang.RuntimePermission "getProtectionDomain"; + permission javax.management.MBeanPermission "*", "getMBeanInfo"; +}; + +grant codeBase "file:${jboss.test.deploy.dir}/security-ejb3.jar" { + permission java.lang.RuntimePermission "createClassLoader"; +}; + +grant codeBase "jar:file:${jboss.test.deploy.dir}/security-ejb3.jar!/-" { + permission java.security.AllPermission; +}; + +//*************************************************************** +// JBoss AS Test Suite Permissions (VFS URL Version) +//*************************************************************** + +// Permissions for the WarPermissionsUnitTestCase +grant codeBase "vfszip:${jboss.test.deploy.dir}/securitymgr/-" { + permission java.util.PropertyPermission "*", "read"; + permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; +}; + +grant codeBase "vfsfile:${jboss.test.deploy.dir}/securitymgr/-" { + permission java.util.PropertyPermission "*", "read"; + permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete"; +}; + +grant codeBase "vfszip:${jboss.test.deploy.dir}/jbosstest-web.ear/-" { + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","list,lookup"; + permission org.jboss.naming.JndiPermission "env","list"; + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "getClassLoader"; + permission java.lang.RuntimePermission "getProtectionDomain"; +}; + +grant codeBase "vfszip:${jboss.test.deploy.dir}/-" { + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","listBindings,lookup"; +}; + +grant codeBase "vfszip:${jboss.test.deploy.dir}/class-loading.war/WEB-INF/classes/" { + permission java.lang.RuntimePermission "getClassLoader"; + permission java.lang.RuntimePermission "getProtectionDomain"; + permission javax.management.MBeanPermission "*", "getMBeanInfo"; +}; + +grant codeBase "vfsmemory://*" { + permission java.security.AllPermission; +}; + +//**************************************************************** +// jbossws cxf permission +//**************************************************************** +//for juddi deployment +grant codeBase "file:${jboss.server.home.dir}/deploy/juddi-service.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission org.jboss.naming.JndiPermission "JAXR", "rebind"; +}; +//for admin console- TODO:Review it +grant codeBase "file:${jboss.server.home.dir}/deployers/jbossweb.deployer/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/admin-console.war/-" { + permission java.security.AllPermission; +}; + +//**************************************************************** +// Default block of permissions +// Minimal permissions are allowed to everyone else +//**************************************************************** +grant { + + permission java.io.FilePermission "${jboss.server.home.dir}/tmp/-", "read"; + permission java.io.FilePermission "${jboss.home.dir}/server/lib/quartz.jar/org/quartz/quartz.properties", "read"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "quartz.properties", "read"; + permission java.util.PropertyPermission "*", "read"; + permission java.lang.RuntimePermission "queuePrintJob"; + permission java.net.SocketPermission "*", "connect"; + permission java.security.SecurityPermission "getPolicy"; + permission java.lang.RuntimePermission "accessClassInPackage.*"; + permission java.lang.RuntimePermission "getProtectionDomain"; + permission java.lang.RuntimePermission "org.jboss.security.SecurityAssociation.getSubject"; + permission java.lang.RuntimePermission "org.jboss.security.plugins.JBossSecurityContext.getSubjectInfo"; + + permission javax.management.MBeanServerPermission "findMBeanServer"; + permission javax.management.MBeanPermission "org.jboss.mx.modelmbean.XMBean#*[JMImplementation:type=MBeanRegistry]", "*"; + permission javax.management.MBeanPermission "org.jboss.security.plugins.AuthorizationManagerService#*[jboss.security:service=AuthorizationManager]", "invoke"; + permission javax.management.MBeanPermission "org.jboss.jms.server.jbosssx.JBossASSecurityMetadataStore#*[jboss.messaging:service=SecurityStore]", "invoke"; + permission javax.management.MBeanPermission "org.jboss.security.auth.login.XMLLoginConfig#*[jboss.security:service=XMLLoginConfig]", "invoke"; + permission javax.management.MBeanPermission "org.jboss.security.plugins.JaasSecurityManagerService#*[jboss.security:service=JaasSecurityManager]", "invoke"; + permission javax.management.MBeanPermission "*", "getMBeanInfo"; + permission javax.management.MBeanPermission "*", "getAttribute"; + + permission javax.security.auth.AuthPermission "createLoginContext.*"; + permission javax.security.auth.AuthPermission "getLoginConfiguration"; + + //TODO: use codeBase permission + //admin-console + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "rebind"; + permission java.util.logging.LoggingPermission "control"; + + // for org.jboss.test.ws.jaxws.cxf.webserviceref.WebServiceRefServletTestCase.testServletClient() + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "accessDeclaredMembers"; + permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; + // for frameworktest org.jboss.test.ws.jaxws.smoke.tools.WSRunClientTestCase.test() + permission java.lang.RuntimePermission "org.jboss.security.plugins.JBossSecurityContext.getData"; + + //add write permission to frameworktest : org.jboss.test.ws.jaxws.jbws2000.JBWS2000TestCase + permission java.io.FilePermission "/tmp/-", "write,delete"; + //frameworktest : org.jboss.test.ws.jaxws.jbws1822.JBWS1822TestCase + permission java.lang.RuntimePermission "createClassLoader"; + //Allow client to regiester MBean : org.jboss.test.ws.management.recording.CustomRecordProcessorTestCase.testAddCustomProcessor() + permission javax.management.MBeanTrustPermission "register"; +};