https://bugzilla.redhat.com/show_bug.cgi?id=1347835
Bug ID: 1347835
Summary: The security manager doesn't work correctly (JSPs
cannot be compiled)
Product: Fedora
Version: 23
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net,
tomcat-qe(a)redhat.com, trick(a)vanstaveren.us
Depends On: 1347774, 927930
Blocks: 1347142, 1347144, 1347146, 1347778
+++ This bug was initially created as a clone of Bug #1347774 +++
Description of problem:
When using the security manager for the tomcat service, JSPs are inaccessible
(they won't compile) because of access permissions.
+++
HTTP Status 500 - access denied ("java.lang.RuntimePermission"
"accessClassInPackage.org.apache.jasper")
type Exception report
message access denied ("java.lang.RuntimePermission"
"accessClassInPackage.org.apache.jasper")
description The server encountered an internal error that prevented it from
fulfilling this request.
exception
java.security.AccessControlException: access denied
("java.lang.RuntimePermission"
"accessClassInPackage.org.apache.jasper")
java.security.AccessControlContext.checkPermission(AccessControlContext.java:474)
java.security.AccessController.checkPermission(AccessController.java:685)
java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1525)
sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:305)
java.lang.ClassLoader.loadClass(ClassLoader.java:412)
java.lang.ClassLoader.loadClass(ClassLoader.java:358)
org.apache.jasper.servlet.JspServletWrapper.<init>(JspServletWrapper.java:120)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:382)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:334)
javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277)
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274)
java.security.AccessController.doPrivileged(Native Method)
javax.security.auth.Subject.doAsPrivileged(Subject.java:536)
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:169)
java.security.AccessController.doPrivileged(Native Method)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277)
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274)
java.security.AccessController.doPrivileged(Native Method)
javax.security.auth.Subject.doAsPrivileged(Subject.java:536)
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:249)
+++
Version-Release number of selected component (if applicable):
tomcat-8.0.32-5.fc23.noarch
How reproducible:
Every time :(
Steps to Reproduce:
1. yum install tomcat
2. echo "SECURITY_MANAGER=\"true\"" >> /etc/sysconfig/tomcat
3. cp reproducer.tar /usr/share/tomcat/webapps/
4. service tomcat start
5. curl -is
http://localhost:8080/reproducer/
Actual results:
JSP compilation fails and an error is observed
Expected results:
JSP compiles and displays correctly.
Additional info:
It looks like the java policy in use (catalina.policy) doesn't allow for use of
jars from /usr/share/java
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=927930
[Bug 927930] java.security.AccessControlException: access denied on tomcat6
rpm running with security manager
https://bugzilla.redhat.com/show_bug.cgi?id=1347774
[Bug 1347774] The security manager doesn't work correctly (JSPs cannot be
compiled)
https://bugzilla.redhat.com/show_bug.cgi?id=1347778
[Bug 1347778] The security manager doesn't work correctly
--
You are receiving this mail because:
You are on the CC list for the bug.