[转]Security Manager HOW-TO for Tomcat 5.5

The Apache Jakarta Tomcat 5.5 Servlet/JSP Container

Security Manager HOW-TO

背景

Java的SecurityManager允许浏览器在它可执行的范围内运行，这样可以防止不可靠的程序读写用户在局部文件系统里的文件，或者未经授权进行网络连接，等等。同样，SecurityManager可用来防止不可靠的程序在你的浏览器上运行，在运行Tomcat时使用SecurityManager可以保护你的服务器不受到类似于木马的servlets, JSPs, JSP beans 和 tag libraries的影响，或者发生错误。

试想某个被允许在你的网站上发表JSPs的人不慎包括了以下的语句在他们的JSP里：
&lt;%System.exit(1);%&gt;
每次Tomcat运行该JSP都会导致Tomcat中断。使用Java SecurityManager如同多了一层防护，可以让服务器更加安全可靠。

警告——虽然Tomcat 5的程序通过了安全检查，最重要的程序包都已被保护，新的安全机制也已实施，但在允许用户发表网络程序，JSPs, servlets, beans, 或 tag libraries之前，你还是有必要确保SecurityManager的各项配置符合你的要求。当然，有SecurityManager绝对比没有它要安全的多。

许可权限

Permission类是用来定义Tomcat载入的类所拥有的权限。Java本身包括了一些Permission类，你也可以在你的网络应用中加入你自己的Permission类。这两种技术在Tomcat 5里都被应用。

标准许可权限

这里简单总结了标准系统中适用于Tomcat的SecurityManager Permission 类。更多信息请参看http://java.sun.com/security/。

java.util.PropertyPermission - 控制读/写Java虚拟器的属性，如java.home 。

java.lang.RuntimePermission - 控制使用一些系统/运行时(System/Runtime)的功能，如exit() 和 exec()。它也控制包(package)的访问/定义。

java.io.FilePermission - 控制对文件和目录的读/写/执行操作。

java.net.SocketPermission - 控制使用网路sockets连接。

java.net.NetPermission - 控制使用multicast网路连接。

java.lang.reflect.ReflectPermission - 控制使用reflection来对类进行检视。

java.security.SecurityPermission - 控制对安全方法的访问。

java.security.AllPermission - 给予所有访问权限，就如你运行一个没有SecurityManager的Tomcat 。
Tomcat用户特有权限
Tomcat利用一个叫做org.apache.naming.JndiPermission 客户许可类。它用来控制以JNDI命名的文件资源的可读权限。该许可的名称是以JNDI来表达，没有命令。在给予许可时，"*"的结尾可以用来以wild card方式映射JNDI命名的文件资源。例如，你可以在你的政策(policy)文件加入以下一行：
permission org.apache.naming.JndiPermission "jndi://localhost/examples/*";
一个象这样的许可(Permission)会在部署网络程序时被自动产生，允许它读取它自己的静态资源，但不允许它使用文件访问权来读取其它文件(除非你明确地给出访问那些文件的许可).

并且, Tomcat 总是自动产生以下文件许可:
permission java.io.FilePermission "** your application context**", "read";
这里**your application context**代表那个拥有你的应用程序的文件夹(或者是WAR文件)。

用SecurityManager配置Tomcat

政策文件的格式

由Java SecurityManager实现的安全政策被配置存放在$CATALINA_HOME/conf/catalina.policy 文件里。这个文件完全替代了JDK系统目录里的java.policy文件。这个catalina.policy 文件可以手动修改，或者使用Java 1.2 及其后版本的policytool程序修改。 $CATALINA_HOME/conf/catalina.policy

catalina.policy 文件中的条文使用了标准的java.policy文件格式，如下：


	// Example policy file entry grant [signedBy <signer>,] [codeBase <code source>] { permission <class> [<name> [, <action list>]]; };

其中signedBy 和 codeBase是选择项。注释行是以"//"开始，直到该行结束。codeBase是URL的格式，文件的URL中可用如${java.home}和${catalina.home}等属性(这些属性会被扩展到由环境变量JAVA_HOME 和 CATALINA_HOME为他们定义的目录路径)。 ${catalina.home}

缺省政策文件

缺省$CATALINA_HOME/conf/catalina.policy 文件看起来象这样： $CATALINA_HOME/conf/catalina.policy

// ============================================================================
// catalina.corepolicy - Security Policy Permissions for Tomcat 5
//
// This file contains a default set of security policies to be enforced (by the
// JVM) when Catalina is executed with the "-security" option.  In addition
// to the permissions granted here, the following additional permissions are
// granted to the codebase specific to each web application:
//
// * Read access to the document root directory
//
// $Id: security-manager-howto.xml,v 1.5 2003/01/15 03:40:43 glenn Exp $
// ============================================================================


// ========== SYSTEM CODE PERMISSIONS =========================================


// These permissions apply to javac
grant codeBase "file:${java.home}/lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions
grant codeBase "file:${java.home}/jre/lib/ext/-" {
        permission java.security.AllPermission;
};

// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/../lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions when
// ${java.home} points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/lib/ext/-" {
        permission java.security.AllPermission;
};


// ========== CATALINA CODE PERMISSIONS =======================================


// These permissions apply to the launcher code
grant codeBase "file:${catalina.home}/bin/commons-launcher.jar" {
        permission java.security.AllPermission;
};

// These permissions apply to the server startup code
grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
        permission java.security.AllPermission;
};

// These permissions apply to the servlet API classes
// and those that are shared across all class loaders
// located in the "common" directory
grant codeBase "file:${catalina.home}/common/-" {
        permission java.security.AllPermission;
};

// These permissions apply to the container's core code, plus any additional
// libraries installed in the "server" directory
grant codeBase "file:${catalina.home}/server/-" {
        permission java.security.AllPermission;
};

// ========== WEB APPLICATION PERMISSIONS =====================================


// These permissions are granted by default to all web applications
// In addition, a web application will be given a read FilePermission
// and JndiPermission for all files and directories in its document root.
grant { 
        // Required for JNDI lookup of named JDBC DataSource's and
        // javamail named MimePart DataSource used to send mail
        permission java.util.PropertyPermission "java.home", "read";
        permission java.util.PropertyPermission "java.naming.*", "read";
        permission java.util.PropertyPermission "javax.sql.*", "read";

        // OS Specific properties to allow read access
	permission java.util.PropertyPermission "os.name", "read";
	permission java.util.PropertyPermission "os.version", "read";
	permission java.util.PropertyPermission "os.arch", "read";
	permission java.util.PropertyPermission "file.separator", "read";
	permission java.util.PropertyPermission "path.separator", "read";
	permission java.util.PropertyPermission "line.separator", "read";

        // JVM properties to allow read access
        permission java.util.PropertyPermission "java.version", "read";
        permission java.util.PropertyPermission "java.vendor", "read";
        permission java.util.PropertyPermission "java.vendor.url", "read";
        permission java.util.PropertyPermission "java.class.version", "read";
	permission java.util.PropertyPermission "java.specification.version", "read";
	permission java.util.PropertyPermission "java.specification.vendor", "read";
	permission java.util.PropertyPermission "java.specification.name", "read";

	permission java.util.PropertyPermission "java.vm.specification.version", "read";
	permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
	permission java.util.PropertyPermission "java.vm.specification.name", "read";
	permission java.util.PropertyPermission "java.vm.version", "read";
	permission java.util.PropertyPermission "java.vm.vendor", "read";
	permission java.util.PropertyPermission "java.vm.name", "read";

        // Required for getting BeanInfo
        permission java.lang.RuntimePermission "accessClassInPackage.sun.beans.*";

        // Required for OpenJMX
        permission java.lang.RuntimePermission "getAttribute";

	// Allow read of JAXP compliant XML parser debug
	permission java.util.PropertyPermission "jaxp.debug", "read";
};


// You can assign additional permissions to particular web applications by
// adding additional "grant" entries here, based on the code base for that
// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
//
// Different permissions can be granted to JSP pages, classes loaded from
// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
// directory, or even to individual jar files in the /WEB-INF/lib/ directory.
//
// For instance, assume that the standard "examples" application
// included a JDBC driver that needed to establish a network connection to the
// corresponding database and used the scrape taglib to get the weather from
// the NOAA web server.  You might create a "grant" entries like this:
//
// The permissions granted to the context root directory apply to JSP pages.
// grant codeBase "file:${catalina.home}/webapps/examples/-" {
//      permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
//      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
// };
//
// The permissions granted to the context WEB-INF/classes directory
// grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/classes/-" {
// };
//
// The permission granted to your JDBC driver
// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
//      permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
// };
// The permission granted to the scrape taglib
// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
//      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
// };

启动附带SecurityManager的Tomcat

在你配置好与SecurityManager一起使用的catalina.policy文件之后，你可以使用"-security"选项来启动Tomcat。


	$CATALINA_HOME/bin/catalina.sh start -security (Unix) %CATALINA_HOME%\bin\catalina start -security (Windows)

Tomcat里受保护包的配置

从Tomcat 5开始，现在可以配置Tomcat内部包的许可。更多信息请参看 http://java.sun.com/security/seccodeguide.html 。

警告：删除缺省的包保护，可能打开一个安全漏洞。

缺省的属性文件

缺省的$CATALINA_HOME/conf/catalina.properties 文件看起来象这样： $CATALINA_HOME/conf/catalina.properties
#
# List of comma-separated packages that start with or equal this string
# will cause a security exception to be thrown when
# passed to checkPackageAccess unless the
# corresponding RuntimePermission ("accessClassInPackage."+package) has
# been granted.
package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,
org.apache.jasper.
#
# List of comma-separated packages that start with or equal this string
# will cause a security exception to be thrown when
# passed to checkPackageDefinition unless the
# corresponding RuntimePermission ("defineClassInPackage."+package) has
# been granted.
#
# by default, no packages are restricted for definition, and none of
# the class loaders supplied with the JDK call checkPackageDefinition.
#
package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,
org.apache.tomcat.,org.apache.jasper.
当你完成配置SecurityManager所需的catalina.properties 文件，记住要重新启动Tomcat。

排除故障

如果你的网络应用程序试图执行没有许可而被阻止的操作，SecurityManager探查出这样的违规后，就会抛出一个AccessControLException 或 SecurityException 。要查出究竟缺少哪个许可往往非常困难，一个方法是打印执行过程中的所有关于安全决定的排错信息。这可以在启动Tomcat之前通过设置系统属性来实现。最简单的办法是修改CATALINA_OPTS 环境变量。在启动Tomcat之前，执行下面这个命令：
export CATALINA_OPTS=-Djava.security.debug=all (Unix) 
set CATALINA_OPTS=-Djava.security.debug=all (Windows)
（在启动Tomcat之前）。

警告——这会产生很多megabytes的输出。不过，通过查找"FAILED"这个词可以帮助你搜索问题所在，并确定哪个许可是要找的问题。请参看Java安全文档资料，那里有你可指定的更多选项。