Author: jim.ma
Date: 2009-12-03 05:02:58 -0500 (Thu, 03 Dec 2009)
New Revision: 11187
Added:
stack/cxf/trunk/modules/testsuite/src/
stack/cxf/trunk/modules/testsuite/src/test/
stack/cxf/trunk/modules/testsuite/src/test/resources/
stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/
stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/
stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/server.policy
Log:
[JBWS-2692]:added the server.policy for jboss-5.1.0
Added:
stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/server.policy
===================================================================
---
stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/server.policy
(rev 0)
+++
stack/cxf/trunk/modules/testsuite/src/test/resources/securityMgr/jboss-5.1.0.GA/server.policy 2009-12-03
10:02:58 UTC (rev 11187)
@@ -0,0 +1,433 @@
+// The Java2 security policy for the securitymgr tests
+// Install with -Djava.security.policy==server.policy
+// and -Djboss.home.dir=path_to_jboss_distribution
+
+// ***************************************
+// Trusted core Java code
+//***************************************
+grant codeBase "file:${java.home}/lib/ext/-" {
+ permission java.security.AllPermission;
+};
+grant codeBase "file:${java.home}/lib/*" {
+ permission java.security.AllPermission;
+};
+// For java.home pointing to the JDK jre directory
+grant codeBase "file:${java.home}/../lib/*" {
+ permission java.security.AllPermission;
+};
+
+
+
+
+//********************************************
+// Trusted core JBoss code (REAL URL Version)
+//********************************************
+grant codeBase "file:${jboss.home.dir}/bin/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.home.dir}/lib/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.home.dir}/lib/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.home.dir}/common/lib/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.home.dir}/server/lib/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/lib/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/deployers/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/work/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "jar:file:${jboss.server.home.dir}/common/lib/log4j.jar!/" {
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+grant codeBase "jar:file:${jboss.server.home.dir}/common/lib/servlet-api.jar!/"
{
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+//********************************************
+// Trusted core JBoss code (VFS URL Version)
+//********************************************
+grant codeBase "vfszip:${jboss.home.dir}/lib/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "vfszip:${jboss.home.dir}/common/lib/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "vfszip:${jboss.home.dir}/server/lib/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/lib/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/deployers/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/work/-" {
+ permission java.security.AllPermission;
+};
+
+
+//*******************************************************
+// Trusted Specific JBoss Code (REAL URL Version)
+//*******************************************************
+grant codeBase
"file:${jboss.server.home.dir}/conf/bindingservice.beans/jboss-bindingservice.jar/-"{
+ permission java.io.FilePermission
"${jboss.home.dir}/deploy/jbossweb.sar/server.xml", "read";
+};
+
+grant codeBase
"file:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" {
+ permission javax.management.MBeanPermission "*",
"addNotificationListener,getAttribute";
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+grant codeBase "file:${jboss.server.home.dir}/deploy/jmx-console.war/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/deploy/jmx-remoting.sar/-" {
+ permission javax.management.MBeanTrustPermission "register";
+ permission java.net.SocketPermission "*",
"accept,listen,resolve";
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission java.util.logging.LoggingPermission "control";
+};
+
+
+grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/jsf-libs/-"
{
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar/-" {
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+grant codeBase
"jar:file:${jboss.server.home.dir}/conf/bindingservice.beans/jboss-bindingservice.jar!/"{
+ permission java.util.PropertyPermission "*", "write";
+ permission java.io.FilePermission
"${jboss.server.home.dir}/deploy/jbossweb.sar/server.xml", "read";
+ permission java.io.FilePermission "${jboss.server.home.dir}/tmp/-",
"write,delete";
+};
+
+grant codeBase
"jar:file:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar!/jboss-local-jdbc.jar"
{
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+grant codeBase
"file:${jboss.server.home.dir}/deploy/management/console-mgr.sar/-" {
+ permission javax.management.MBeanTrustPermission "register";
+ permission javax.management.MBeanPermission "*",
"addNotificationListener,getAttribute";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","*";
+ permission java.io.FilePermission "<<ALL FILES>>",
"read";
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+grant codeBase "file:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-"
{
+ permission javax.management.MBeanTrustPermission "register";
+ permission javax.management.MBeanPermission "*", "getAttribute";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","lookup,rebind,unbind";
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase
"jar:file:${jboss.server.home.dir}/deploy/jms-ra.rar!/jms-ra.jar" {
+ permission java.lang.RuntimePermission "setContextClassLoader";
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","lookup";
+ permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar",
"read";
+ permission javax.management.MBeanPermission "*",
"getAttribute,invoke,setAttribute";
+};
+
+grant codeBase
"jar:file:${jboss.server.home.dir}/deploy/jms-ra.rar/jms-ra.jar!/" {
+ permission java.lang.RuntimePermission "setContextClassLoader";
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","lookup";
+ permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar",
"read";
+ permission javax.management.MBeanPermission "*",
"getAttribute,invoke,setAttribute";
+};
+
+grant codeBase
"jar:file:${jboss.server.home.dir}/deploy/quartz-ra.rar!/quartz-ra.jar" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase
"jar:file:${jboss.server.home.dir}/deploy/quartz-ra.rar/quartz-ra.jar!/" {
+ permission java.security.AllPermission;
+};
+
+
+
+//*******************************************************
+// Trusted Specific JBoss Code (VFS URL Version)
+//*******************************************************
+grant codeBase
"vfszip:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" {
+ permission javax.management.MBeanPermission "*",
"addNotificationListener,getAttribute";
+};
+
+grant codeBase
"vfsfile:${jboss.server.home.dir}/deploy/http-invoker.sar/invoker.war/-" {
+ permission javax.management.MBeanPermission "*",
"addNotificationListener,getAttribute";
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jmx-console.war/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "vfsfile:${jboss.server.home.dir}/deploy/jmx-console.war/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jmx-remoting.sar/-" {
+ permission javax.management.MBeanTrustPermission "register";
+ permission java.net.SocketPermission "*",
"accept,listen,resolve";
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+
+grant codeBase
"vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jboss-web-service.jar" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase
"vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jbossweb.jar" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase
"vfsfile:${jboss.server.home.dir}/deploy/jbossweb.sar/jbossweb.jar/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jsf-libs/-"
{
+ permission java.security.AllPermission;
+};
+
+grant codeBase
"vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jasper-jdt.jar" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jbossweb.sar/jstl.jar"
{
+ permission java.security.AllPermission;
+};
+
+grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jboss-local-jdbc.rar/-"
{
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+grant codeBase
"vfszip:${jboss.server.home.dir}/deploy/management/console-mgr.sar/-" {
+ permission javax.management.MBeanTrustPermission "register";
+ permission javax.management.MBeanPermission "*",
"addNotificationListener,getAttribute";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","*";
+ permission java.io.FilePermission "<<ALL FILES>>",
"read";
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+
+grant codeBase
"vfszip:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" {
+ permission javax.management.MBeanTrustPermission "register";
+ permission javax.management.MBeanPermission "*", "getAttribute";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","lookup,rebind,unbind";
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+grant codeBase
"vfsfile:${jboss.server.home.dir}/deploy/uuid-key-generator.sar/-" {
+ permission javax.management.MBeanTrustPermission "register";
+ permission javax.management.MBeanPermission "*", "getAttribute";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","lookup,rebind,unbind";
+ permission java.lang.RuntimePermission "getClassLoader";
+};
+
+grant codeBase "vfszip:${jboss.server.home.dir}/deploy/jms-ra.rar/jms-ra.jar"
{
+ permission java.lang.RuntimePermission "setContextClassLoader";
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","lookup";
+ permission java.io.FilePermission "${jboss.home.dir}/lib/jboss-aop.jar",
"read";
+ permission javax.management.MBeanPermission "*",
"getAttribute,invoke,setAttribute";
+};
+
+grant codeBase
"vfszip:${jboss.server.home.dir}/deploy/quartz-ra.rar/quartz-ra.jar" {
+ permission java.security.AllPermission;
+};
+
+//***************************************************************
+// JBoss AS Test Suite Permissions (REAL URL Version)
+//***************************************************************
+
+// Permissions for the WarPermissionsUnitTestCase
+grant codeBase "file:${jboss.test.deploy.dir}/securitymgr/-" {
+ permission java.util.PropertyPermission "*", "read";
+ permission java.io.FilePermission "<<ALL FILES>>",
"read,write,delete";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","lookup";
+};
+
+grant codeBase "file:${jboss.test.deploy.dir}/securitymgr/-" {
+ permission java.util.PropertyPermission "*", "read";
+ permission java.io.FilePermission "<<ALL FILES>>",
"read,write,delete";
+};
+
+grant codeBase "file:${jboss.test.deploy.dir}/jbosstest-web.ear/-" {
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","list,lookup";
+ permission org.jboss.naming.JndiPermission "env","list";
+ permission java.io.FilePermission "<<ALL FILES>>",
"read";
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission java.lang.RuntimePermission "getProtectionDomain";
+};
+
+grant codeBase
"jar:file:${jboss.test.deploy.dir}/jbosstest-web.ear!/jbosstest-web.war" {
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","list,lookup";
+ permission org.jboss.naming.JndiPermission "env","list";
+ permission java.io.FilePermission "<<ALL FILES>>",
"read";
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission java.lang.RuntimePermission "getProtectionDomain";
+};
+grant codeBase
"jar:file:${jboss.test.deploy.dir}/jbosstest-web.ear!/lib/util.jar" {
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission java.lang.RuntimePermission "getProtectionDomain";
+};
+
+
+grant codeBase "file:${jboss.test.deploy.dir}/-" {
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","listBindings,lookup";
+};
+
+grant codeBase
"file:${jboss.test.deploy.dir}/class-loading.war/WEB-INF/classes/" {
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission java.lang.RuntimePermission "getProtectionDomain";
+ permission javax.management.MBeanPermission "*", "getMBeanInfo";
+};
+
+grant codeBase "file:${jboss.test.deploy.dir}/security-ejb3.jar" {
+ permission java.lang.RuntimePermission "createClassLoader";
+};
+
+grant codeBase "jar:file:${jboss.test.deploy.dir}/security-ejb3.jar!/-" {
+ permission java.security.AllPermission;
+};
+
+//***************************************************************
+// JBoss AS Test Suite Permissions (VFS URL Version)
+//***************************************************************
+
+// Permissions for the WarPermissionsUnitTestCase
+grant codeBase "vfszip:${jboss.test.deploy.dir}/securitymgr/-" {
+ permission java.util.PropertyPermission "*", "read";
+ permission java.io.FilePermission "<<ALL FILES>>",
"read,write,delete";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","lookup";
+};
+
+grant codeBase "vfsfile:${jboss.test.deploy.dir}/securitymgr/-" {
+ permission java.util.PropertyPermission "*", "read";
+ permission java.io.FilePermission "<<ALL FILES>>",
"read,write,delete";
+};
+
+grant codeBase "vfszip:${jboss.test.deploy.dir}/jbosstest-web.ear/-" {
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","list,lookup";
+ permission org.jboss.naming.JndiPermission "env","list";
+ permission java.io.FilePermission "<<ALL FILES>>",
"read";
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission java.lang.RuntimePermission "getProtectionDomain";
+};
+
+grant codeBase "vfszip:${jboss.test.deploy.dir}/-" {
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","listBindings,lookup";
+};
+
+grant codeBase
"vfszip:${jboss.test.deploy.dir}/class-loading.war/WEB-INF/classes/" {
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission java.lang.RuntimePermission "getProtectionDomain";
+ permission javax.management.MBeanPermission "*", "getMBeanInfo";
+};
+
+grant codeBase "vfsmemory://*" {
+ permission java.security.AllPermission;
+};
+
+//****************************************************************
+// jbossws cxf permission
+//****************************************************************
+//for juddi deployment
+grant codeBase "file:${jboss.server.home.dir}/deploy/juddi-service.sar/-" {
+ permission javax.management.MBeanTrustPermission "register";
+ permission org.jboss.naming.JndiPermission "JAXR", "rebind";
+};
+//for admin console- TODO:Review it
+grant codeBase "file:${jboss.server.home.dir}/deployers/jbossweb.deployer/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/deploy/jbossweb.sar/-" {
+ permission java.security.AllPermission;
+};
+
+grant codeBase "file:${jboss.server.home.dir}/deploy/admin-console.war/-" {
+ permission java.security.AllPermission;
+};
+
+//****************************************************************
+// Default block of permissions
+// Minimal permissions are allowed to everyone else
+//****************************************************************
+grant {
+
+ permission java.io.FilePermission "${jboss.server.home.dir}/tmp/-",
"read";
+ permission java.io.FilePermission
"${jboss.home.dir}/server/lib/quartz.jar/org/quartz/quartz.properties",
"read";
+ permission org.jboss.naming.JndiPermission "<<ALL
BINDINGS>>","lookup";
+ permission java.io.FilePermission "quartz.properties", "read";
+ permission java.util.PropertyPermission "*", "read";
+ permission java.lang.RuntimePermission "queuePrintJob";
+ permission java.net.SocketPermission "*", "connect";
+ permission java.security.SecurityPermission "getPolicy";
+ permission java.lang.RuntimePermission "accessClassInPackage.*";
+ permission java.lang.RuntimePermission "getProtectionDomain";
+ permission java.lang.RuntimePermission
"org.jboss.security.SecurityAssociation.getSubject";
+ permission java.lang.RuntimePermission
"org.jboss.security.plugins.JBossSecurityContext.getSubjectInfo";
+
+ permission javax.management.MBeanServerPermission "findMBeanServer";
+ permission javax.management.MBeanPermission
"org.jboss.mx.modelmbean.XMBean#*[JMImplementation:type=MBeanRegistry]",
"*";
+ permission javax.management.MBeanPermission
"org.jboss.security.plugins.AuthorizationManagerService#*[jboss.security:service=AuthorizationManager]",
"invoke";
+ permission javax.management.MBeanPermission
"org.jboss.jms.server.jbosssx.JBossASSecurityMetadataStore#*[jboss.messaging:service=SecurityStore]",
"invoke";
+ permission javax.management.MBeanPermission
"org.jboss.security.auth.login.XMLLoginConfig#*[jboss.security:service=XMLLoginConfig]",
"invoke";
+ permission javax.management.MBeanPermission
"org.jboss.security.plugins.JaasSecurityManagerService#*[jboss.security:service=JaasSecurityManager]",
"invoke";
+ permission javax.management.MBeanPermission "*", "getMBeanInfo";
+ permission javax.management.MBeanPermission "*", "getAttribute";
+
+ permission javax.security.auth.AuthPermission "createLoginContext.*";
+ permission javax.security.auth.AuthPermission "getLoginConfiguration";
+
+ //TODO: use codeBase permission
+ //admin-console
+ permission java.lang.RuntimePermission "getClassLoader";
+ permission org.jboss.naming.JndiPermission "rebind";
+ permission java.util.logging.LoggingPermission "control";
+
+ // for
org.jboss.test.ws.jaxws.cxf.webserviceref.WebServiceRefServletTestCase.testServletClient()
+ permission java.io.FilePermission "<<ALL FILES>>",
"read";
+ permission java.lang.RuntimePermission "accessDeclaredMembers";
+ permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
+ // for frameworktest org.jboss.test.ws.jaxws.smoke.tools.WSRunClientTestCase.test()
+ permission java.lang.RuntimePermission
"org.jboss.security.plugins.JBossSecurityContext.getData";
+
+ //add write permission to frameworktest :
org.jboss.test.ws.jaxws.jbws2000.JBWS2000TestCase
+ permission java.io.FilePermission "/tmp/-", "write,delete";
+ //frameworktest : org.jboss.test.ws.jaxws.jbws1822.JBWS1822TestCase
+ permission java.lang.RuntimePermission "createClassLoader";
+ //Allow client to regiester MBean :
org.jboss.test.ws.management.recording.CustomRecordProcessorTestCase.testAddCustomProcessor()
+ permission javax.management.MBeanTrustPermission "register";
+};