Author: jim.ma Date: 2009-12-10 02:14:15 -0500 (Thu, 10 Dec 2009) New Revision: 11254 Added: stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.0.GA/ stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.0.GA/server.policy stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.1.GA/ stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.1.GA/server.policy Log: [JBWS-2692]:Added server policy for AS 5.0.0 and 5.0.1 Added: stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.0.GA/server.policy =================================================================== --- stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.0.GA/server.policy (rev 0) +++ stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.0.GA/server.policy 2009-12-10 07:14:15 UTC (rev 11254) @@ -0,0 +1,322 @@ +// The Java2 security policy for the securitymgr tests +// Install with -Djava.security.policy==server.policy +// and -Djboss.home.dir=path_to_jboss_distribution + +// *************************************** +// Trusted core Java code +//*************************************** +grant codeBase "file:${java.home}/lib/ext/-" { + permission java.security.AllPermission; +}; +grant codeBase "file:${java.home}/lib/*" { + permission java.security.AllPermission; +}; +// For java.home pointing to the JDK jre directory +grant codeBase "file:${java.home}/../lib/*" { + permission java.security.AllPermission; +}; + + + + +//******************************************** +// Trusted core JBoss code (REAL URL Version) +//******************************************** +grant codeBase "file:${jboss.home.dir}/bin/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/common/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/server/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deployers/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/work/-" { + permission java.security.AllPermission; +}; + + +//******************************************** +// Trusted core JBoss code (VFS URL Version) +//******************************************** +grant codeBase "vfszip:${jboss.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.home.dir}/common/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.home.dir}/server/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deployers/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/work/-" { + permission java.security.AllPermission; +}; + + +//******************************************************* +// Trusted Specific JBoss Code (REAL URL Version) +//******************************************************* +grant codeBase "file:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" { + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jmx-console.war/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jmx-remoting.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission java.net.SocketPermission "*", "accept,listen,resolve"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + + +grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/jsf-libs/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar/-" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar!/jboss-local-jdbc.jar" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/management/console-mgr.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","*"; + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup,rebind,unbind"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/-" { + permission java.security.AllPermission; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/jms-ra.rar!/jms-ra.jar" { + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar", "read"; + permission javax.management.MBeanPermission "*", "getAttribute,invoke,setAttribute"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/jms-ra.rar/jms-ra.jar!/" { + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar", "read"; + permission javax.management.MBeanPermission "*", "getAttribute,invoke,setAttribute"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/quartz-ra.rar!/quartz-ra.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/quartz-ra.rar/quartz-ra.jar!/" { + permission java.security.AllPermission; +}; + + + +//******************************************************* +// Trusted Specific JBoss Code (VFS URL Version) +//******************************************************* +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" { + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" { + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jmx-console.war/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/jmx-console.war/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jmx-remoting.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission java.net.SocketPermission "*", "accept,listen,resolve"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jboss-web-service.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jbossweb.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/jbossweb.sar/jbossweb.jar/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jsf-libs/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jasper-jdt.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jstl.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar/-" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/management/console-mgr.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","*"; + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup,rebind,unbind"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup,rebind,unbind"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jms-ra.rar/jms-ra.jar" { + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar", "read"; + permission javax.management.MBeanPermission "*", "getAttribute,invoke,setAttribute"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/quartz-ra.rar/quartz-ra.jar" { + permission java.security.AllPermission; +}; + +//**************************************************************** +// jbossws cxf permission +//**************************************************************** +//for juddi deployment +grant codeBase "file:${jboss.server.home.dir}/deploy/juddi-service.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission org.jboss.naming.JndiPermission "JAXR", "rebind"; +}; +//for admin console- TODO:Review it +grant codeBase "file:${jboss.server.home.dir}/deployers/jbossweb.deployer/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/admin-console.war/-" { + permission java.security.AllPermission; +}; + +//**************************************************************** +// Default block of permissions +// Minimal permissions are allowed to everyone else +//**************************************************************** +grant { + permission java.io.FilePermission "${jboss.server.home.dir}/tmp/-", "read"; + permission java.io.FilePermission "${jboss.home.dir}/server/lib/quartz.jar/org/quartz/quartz.properties", "read"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "quartz.properties", "read"; + permission java.util.PropertyPermission "*", "read"; + permission java.lang.RuntimePermission "queuePrintJob"; + permission java.net.SocketPermission "*", "connect"; + permission java.security.SecurityPermission "getPolicy"; + permission java.lang.RuntimePermission "accessClassInPackage.*"; + permission java.lang.RuntimePermission "getProtectionDomain"; + permission java.lang.RuntimePermission "org.jboss.security.SecurityAssociation.getSubject"; + permission java.lang.RuntimePermission "org.jboss.security.plugins.JBossSecurityContext.getSubjectInfo"; + + permission javax.management.MBeanServerPermission "findMBeanServer"; + permission javax.management.MBeanPermission "org.jboss.mx.modelmbean.XMBean#*[JMImplementation:type=MBeanRegistry]", "*"; + permission javax.management.MBeanPermission "org.jboss.security.plugins.AuthorizationManagerService#*[jboss.security:service=AuthorizationManager]", "invoke"; + permission javax.management.MBeanPermission "org.jboss.jms.server.jbosssx.JBossASSecurityMetadataStore#*[jboss.messaging:service=SecurityStore]", "invoke"; + permission javax.management.MBeanPermission "org.jboss.security.auth.login.XMLLoginConfig#*[jboss.security:service=XMLLoginConfig]", "invoke"; + permission javax.management.MBeanPermission "org.jboss.security.plugins.JaasSecurityManagerService#*[jboss.security:service=JaasSecurityManager]", "invoke"; + permission javax.management.MBeanPermission "*", "getMBeanInfo"; + permission javax.management.MBeanPermission "*", "getAttribute"; + + permission javax.security.auth.AuthPermission "createLoginContext.*"; + permission javax.security.auth.AuthPermission "getLoginConfiguration"; + + //admin-console + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","rebind,createSubcontext"; + permission java.util.logging.LoggingPermission "control"; + permission javax.management.MBeanPermission "javax.management.MBeanServerDelegate#-[JMImplementation:type=MBeanServerDelegate]", "addNotificationListener"; + + //CXF annotation vistor uses reflection to process annotation + permission java.lang.RuntimePermission "accessDeclaredMembers"; + permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; + + //for frameworktest org.jboss.test.ws.jaxws.smoke.tools.WSRunClientTestCase.test() + permission java.lang.RuntimePermission "org.jboss.security.plugins.JBossSecurityContext.getData"; + + //add write permission to frameworktest : org.jboss.test.ws.jaxws.jbws2000.JBWS2000TestCase + permission java.io.FilePermission "/tmp/-", "write,delete"; + //frameworktest : org.jboss.test.ws.jaxws.jbws1822.JBWS1822TestCase + permission java.lang.RuntimePermission "createClassLoader"; + //Allow client to regiester MBean : org.jboss.test.ws.management.recording.CustomRecordProcessorTestCase.testAddCustomProcessor() + permission javax.management.MBeanTrustPermission "register"; +}; Added: stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.1.GA/server.policy =================================================================== --- stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.1.GA/server.policy (rev 0) +++ stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.0.1.GA/server.policy 2009-12-10 07:14:15 UTC (rev 11254) @@ -0,0 +1,327 @@ +// The Java2 security policy for the securitymgr tests +// Install with -Djava.security.policy==server.policy +// and -Djboss.home.dir=path_to_jboss_distribution + +// *************************************** +// Trusted core Java code +//*************************************** +grant codeBase "file:${java.home}/lib/ext/-" { + permission java.security.AllPermission; +}; +grant codeBase "file:${java.home}/lib/*" { + permission java.security.AllPermission; +}; +// For java.home pointing to the JDK jre directory +grant codeBase "file:${java.home}/../lib/*" { + permission java.security.AllPermission; +}; + + + + +//******************************************** +// Trusted core JBoss code (REAL URL Version) +//******************************************** +grant codeBase "file:${jboss.home.dir}/bin/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/common/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.home.dir}/server/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deployers/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/work/-" { + permission java.security.AllPermission; +}; + + +//******************************************** +// Trusted core JBoss code (VFS URL Version) +//******************************************** +grant codeBase "vfszip:${jboss.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.home.dir}/common/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.home.dir}/server/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/lib/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deployers/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/work/-" { + permission java.security.AllPermission; +}; + + +//******************************************************* +// Trusted Specific JBoss Code (REAL URL Version) +//******************************************************* +grant codeBase "file:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" { + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jmx-console.war/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jmx-remoting.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission java.net.SocketPermission "*", "accept,listen,resolve"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + + +grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/jsf-libs/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar/-" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar!/jboss-local-jdbc.jar" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/management/console-mgr.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","*"; + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup,rebind,unbind"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/-" { + permission java.security.AllPermission; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/jms-ra.rar!/jms-ra.jar" { + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar", "read"; + permission javax.management.MBeanPermission "*", "getAttribute,invoke,setAttribute"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/jms-ra.rar/jms-ra.jar!/" { + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar", "read"; + permission javax.management.MBeanPermission "*", "getAttribute,invoke,setAttribute"; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/quartz-ra.rar!/quartz-ra.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "jar:file:${jboss.server.home.dir}/deploy/quartz-ra.rar/quartz-ra.jar!/" { + permission java.security.AllPermission; +}; + + + +//******************************************************* +// Trusted Specific JBoss Code (VFS URL Version) +//******************************************************* +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" { + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" { + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jmx-console.war/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/jmx-console.war/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jmx-remoting.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission java.net.SocketPermission "*", "accept,listen,resolve"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jboss-web-service.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jbossweb.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/jbossweb.sar/jbossweb.jar/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jsf-libs/-" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jasper-jdt.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jstl.jar" { + permission java.security.AllPermission; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar/-" { + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/management/console-mgr.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "addNotificationListener,getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","*"; + permission java.io.FilePermission "<<ALL FILES>>", "read"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup,rebind,unbind"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission javax.management.MBeanPermission "*", "getAttribute"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup,rebind,unbind"; + permission java.lang.RuntimePermission "getClassLoader"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jms-ra.rar/jms-ra.jar" { + permission java.lang.RuntimePermission "setContextClassLoader"; + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar", "read"; + permission javax.management.MBeanPermission "*", "getAttribute,invoke,setAttribute"; +}; + +grant codeBase "vfszip:${jboss.server.home.dir}/deploy/quartz-ra.rar/quartz-ra.jar" { + permission java.security.AllPermission; +}; + +//**************************************************************** +// jbossws cxf permission +//**************************************************************** +//for juddi deployment +grant codeBase "file:${jboss.server.home.dir}/deploy/juddi-service.sar/-" { + permission javax.management.MBeanTrustPermission "register"; + permission org.jboss.naming.JndiPermission "JAXR", "rebind"; +}; +//for admin console- TODO:Review it +grant codeBase "file:${jboss.server.home.dir}/deployers/jbossweb.deployer/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/-" { + permission java.security.AllPermission; +}; + +grant codeBase "file:${jboss.server.home.dir}/deploy/admin-console.war/-" { + permission java.security.AllPermission; +}; + + + +//**************************************************************** +// Default block of permissions +// Minimal permissions are allowed to everyone else +//**************************************************************** +grant { + permission java.io.FilePermission "${jboss.server.home.dir}/tmp/-", "read"; + permission java.io.FilePermission "${jboss.home.dir}/server/lib/quartz.jar/org/quartz/quartz.properties", "read"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","lookup"; + permission java.io.FilePermission "quartz.properties", "read"; + permission java.util.PropertyPermission "*", "read"; + permission java.lang.RuntimePermission "queuePrintJob"; + permission java.net.SocketPermission "*", "connect"; + permission java.security.SecurityPermission "getPolicy"; + permission java.lang.RuntimePermission "accessClassInPackage.*"; + permission java.lang.RuntimePermission "getProtectionDomain"; + permission java.lang.RuntimePermission "org.jboss.security.SecurityAssociation.getSubject"; + permission java.lang.RuntimePermission "org.jboss.security.plugins.JBossSecurityContext.getSubjectInfo"; + + permission javax.management.MBeanServerPermission "findMBeanServer"; + permission javax.management.MBeanPermission "org.jboss.mx.modelmbean.XMBean#*[JMImplementation:type=MBeanRegistry]", "*"; + permission javax.management.MBeanPermission "org.jboss.security.plugins.AuthorizationManagerService#*[jboss.security:service=AuthorizationManager]", "invoke"; + permission javax.management.MBeanPermission "org.jboss.jms.server.jbosssx.JBossASSecurityMetadataStore#*[jboss.messaging:service=SecurityStore]", "invoke"; + permission javax.management.MBeanPermission "org.jboss.security.auth.login.XMLLoginConfig#*[jboss.security:service=XMLLoginConfig]", "invoke"; + permission javax.management.MBeanPermission "org.jboss.security.plugins.JaasSecurityManagerService#*[jboss.security:service=JaasSecurityManager]", "invoke"; + permission javax.management.MBeanPermission "*", "getMBeanInfo"; + permission javax.management.MBeanPermission "*", "getAttribute"; + + permission javax.security.auth.AuthPermission "createLoginContext.*"; + permission javax.security.auth.AuthPermission "getLoginConfiguration"; + + permission java.io.FilePermission "<<ALL FILES>>", "read"; + + //admin-console + permission java.lang.RuntimePermission "getClassLoader"; + permission org.jboss.naming.JndiPermission "<<ALL BINDINGS>>","rebind,createSubcontext"; + permission java.util.logging.LoggingPermission "control"; + permission javax.management.MBeanPermission "javax.management.MBeanServerDelegate#-[JMImplementation:type=MBeanServerDelegate]", "addNotificationListener"; + + //CXF annotation vistor uses reflection to process annotation + permission java.lang.RuntimePermission "accessDeclaredMembers"; + permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; + + //for frameworktest org.jboss.test.ws.jaxws.smoke.tools.WSRunClientTestCase.test() + permission java.lang.RuntimePermission "org.jboss.security.plugins.JBossSecurityContext.getData"; + + //add write permission to frameworktest : org.jboss.test.ws.jaxws.jbws2000.JBWS2000TestCase + permission java.io.FilePermission "/tmp/-", "write,delete"; + //frameworktest : org.jboss.test.ws.jaxws.jbws1822.JBWS1822TestCase + permission java.lang.RuntimePermission "createClassLoader"; + //Allow client to regiester MBean : org.jboss.test.ws.management.recording.CustomRecordProcessorTestCase.testAddCustomProcessor() + permission javax.management.MBeanTrustPermission "register"; + +};