Server-side CLI scripts secured in master

Lukas Krejci lkrejci at redhat.com
Tue Jan 3 14:37:28 UTC 2012


I just pushed a series of security fixes to the RHQ server that disallow the 
CLI scripts running on the server (i.e. the alert scripts) from doing local 
JNDI lookups (other than through the "blessed" interface provided to the 
scripts using the *Manager predefined variables).

This prevents the scripts from accessing the RHQ server's internals like local 
SLSBs, entity manager, raw database connection, etc.

If you see any unexpected security exceptions while running the master build, 
shout at me :) 

The only time you should see a security exception is when your alert script 
tries to do something illegal (exit JVM, do a JNDI lookup inside the RHQ 
server, ...). You should NEVER see a security exception nor any change in 
functionality if the alert scripts are not involved.

Lukas



More information about the rhq-devel mailing list