API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Oct 27th, 2016
62
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 16.82 KB | None | 0 0
raw download clone embed print report
  1. // Licensed to the Apache Software Foundation (ASF) under one or more
  2. // contributor license agreements. See the NOTICE file distributed with
  3. // this work for additional information regarding copyright ownership.
  4. // The ASF licenses this file to You under the Apache License, Version 2.0
  5. // (the "License"); you may not use this file except in compliance with
  6. // the License. You may obtain a copy of the License at
  7. //
  8. // http://www.apache.org/licenses/LICENSE-2.0
  9. //
  10. // Unless required by applicable law or agreed to in writing, software
  11. // distributed under the License is distributed on an "AS IS" BASIS,
  12. // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13. // See the License for the specific language governing permissions and
  14. // limitations under the License.
  15.  
  16. // ============================================================================
  17. // catalina.policy - Security Policy Permissions for Tomcat 7
  18. //
  19. // This file contains a default set of security policies to be enforced (by the
  20. // JVM) when Catalina is executed with the "-security" option. In addition
  21. // to the permissions granted here, the following additional permissions are
  22. // granted to each web application:
  23. //
  24. // * Read access to the web application's document root directory
  25. // * Read, write and delete access to the web application's working directory
  26. //
  27. // $Id: catalina.policy 1220297 2011-12-17 22:55:28Z markt $
  28. // ============================================================================
  29.  
  30. // ========== Changes to the original policy file =============================
  31. // Following sections must be updated synchronously
  32. // WARNING: This is different from Tomcat's default policy
  33.  
  34. // These permissions apply to the shared code, plus any additional libraries installed in the "${catalina.base}/lib" directory
  35. grant codeBase "file:${catalina.base}/lib/-" {
  36. permission java.security.SecurityPermission "*";
  37. permission javax.security.auth.AuthPermission "*";
  38. permission javax.security.auth.PrivateCredentialPermission "* * \"*\"", "read";
  39. permission java.lang.RuntimePermission "*";
  40. permission java.lang.reflect.ReflectPermission "*";
  41. permission java.util.PropertyPermission "*", "read,write";
  42. permission java.net.SocketPermission "*", "accept,connect,listen,resolve";
  43. permission java.net.NetPermission "*";
  44. permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete,execute";
  45. permission java.io.SerializablePermission "*";
  46. permission java.util.logging.LoggingPermission "control";
  47. //permission java.awt.AWTPermission "*";
  48. };
  49.  
  50. // These permissions apply to the shared code, plus any additional libraries installed in the "SIUHOME/lib" directory
  51. grant codeBase "file:${SIUHOME}/lib/-" {
  52. permission java.security.SecurityPermission "*";
  53. permission javax.security.auth.AuthPermission "*";
  54. permission javax.security.auth.PrivateCredentialPermission "* * \"*\"", "read";
  55. permission java.lang.RuntimePermission "*";
  56. permission java.lang.reflect.ReflectPermission "*";
  57. permission java.util.PropertyPermission "*", "read,write";
  58. permission java.net.SocketPermission "*", "accept,connect,listen,resolve";
  59. permission java.net.NetPermission "*";
  60. permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete,execute";
  61. permission java.io.SerializablePermission "*";
  62. permission java.util.logging.LoggingPermission "control";
  63. permission com.hp.usage.security.ssl.SharedKeyStorePermission "default", "read,write";
  64. //permission java.awt.AWTPermission "*";
  65. };
  66.  
  67. // following is for running from webapps
  68. grant codeBase "file:${catalina.base}/webapps/-" {
  69. permission java.security.SecurityPermission "*";
  70. permission javax.security.auth.AuthPermission "*";
  71. permission javax.security.auth.PrivateCredentialPermission "* * \"*\"", "read";
  72. permission java.lang.RuntimePermission "*";
  73. permission java.lang.reflect.ReflectPermission "*";
  74. permission java.util.PropertyPermission "*", "read,write";
  75. permission java.net.SocketPermission "*", "accept,connect,listen,resolve";
  76. permission java.net.NetPermission "*";
  77. permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete,execute";
  78. permission java.io.SerializablePermission "*";
  79. permission java.util.logging.LoggingPermission "control";
  80. //permission java.awt.AWTPermission "*";
  81. };
  82.  
  83. // following is for running from war (wars are exploded to work/Catalina/localhost)
  84. grant codeBase "file:${catalina.base}/work/Catalina/localhost/-" {
  85. permission java.security.SecurityPermission "*";
  86. permission javax.security.auth.AuthPermission "*";
  87. permission javax.security.auth.PrivateCredentialPermission "* * \"*\"", "read";
  88. permission java.lang.RuntimePermission "*";
  89. permission java.lang.reflect.ReflectPermission "*";
  90. permission java.util.PropertyPermission "*", "read,write";
  91. permission java.net.SocketPermission "*", "accept,connect,listen,resolve";
  92. permission java.net.NetPermission "*";
  93. permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete,execute";
  94. permission java.io.SerializablePermission "*";
  95. permission java.util.logging.LoggingPermission "control";
  96. permission javax.management.MBeanServerPermission "*";
  97. permission javax.management.MBeanPermission "*", "*";
  98. permission javax.management.MBeanTrustPermission "*";
  99. permission com.hp.usage.security.ssl.SharedKeyStorePermission "default", "read,write";
  100. //permission java.awt.AWTPermission "*";
  101. };
  102.  
  103. // following is for debugging from command line
  104. grant codeBase "file:${catalina.base}/../docroot/WEB-INF/-" {
  105. permission java.security.SecurityPermission "*";
  106. permission javax.security.auth.AuthPermission "*";
  107. permission javax.security.auth.PrivateCredentialPermission "* * \"*\"", "read";
  108. permission java.lang.RuntimePermission "*";
  109. permission java.lang.reflect.ReflectPermission "*";
  110. permission java.util.PropertyPermission "*", "read,write";
  111. permission java.net.SocketPermission "*", "accept,connect,listen,resolve";
  112. permission java.net.NetPermission "*";
  113. permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete,execute";
  114. permission java.io.SerializablePermission "*";
  115. permission java.util.logging.LoggingPermission "control";
  116. //permission java.awt.AWTPermission "*";
  117. };
  118. // ============================================================================
  119.  
  120. // ========== SYSTEM CODE PERMISSIONS =========================================
  121.  
  122.  
  123. // These permissions apply to javac
  124. grant codeBase "file:${java.home}/lib/-" {
  125. permission java.security.AllPermission;
  126. };
  127.  
  128. // These permissions apply to all shared system extensions
  129. grant codeBase "file:${java.home}/jre/lib/ext/-" {
  130. permission java.security.AllPermission;
  131. };
  132.  
  133. // These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
  134. grant codeBase "file:${java.home}/../lib/-" {
  135. permission java.security.AllPermission;
  136. };
  137.  
  138. // These permissions apply to all shared system extensions when
  139. // ${java.home} points at $JAVA_HOME/jre
  140. grant codeBase "file:${java.home}/lib/ext/-" {
  141. permission java.security.AllPermission;
  142. };
  143.  
  144.  
  145. // ========== CATALINA CODE PERMISSIONS =======================================
  146.  
  147.  
  148. // These permissions apply to the daemon code
  149. grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
  150. permission java.security.AllPermission;
  151. };
  152.  
  153. // These permissions apply to the logging API
  154. // Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
  155. // update this section accordingly.
  156. // grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
  157. grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
  158. permission java.io.FilePermission
  159. "${java.home}${file.separator}lib${file.separator}logging.properties", "read";
  160.  
  161. permission java.io.FilePermission
  162. "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
  163. permission java.io.FilePermission
  164. "${catalina.base}${file.separator}logs", "read, write";
  165. permission java.io.FilePermission
  166. "${catalina.base}${file.separator}logs${file.separator}*", "read, write";
  167.  
  168. permission java.lang.RuntimePermission "shutdownHooks";
  169. permission java.lang.RuntimePermission "getClassLoader";
  170. permission java.lang.RuntimePermission "setContextClassLoader";
  171.  
  172. permission java.util.logging.LoggingPermission "control";
  173.  
  174. permission java.util.PropertyPermission "java.util.logging.config.class", "read";
  175. permission java.util.PropertyPermission "java.util.logging.config.file", "read";
  176. permission java.util.PropertyPermission "catalina.base", "read";
  177. permission java.util.PropertyPermission
  178. "org.apache.juli.logging.UserDataHelper.CONFIG", "read";
  179. permission java.util.PropertyPermission
  180. "org.apache.juli.logging.UserDataHelper.SUPPRESSION_TIME", "read";
  181.  
  182. // Note: To enable per context logging configuration, permit read access to
  183. // the appropriate file. Be sure that the logging configuration is
  184. // secure before enabling such access.
  185. // E.g. for the examples web application (uncomment and unwrap
  186. // the following to be on a single line):
  187. // permission java.io.FilePermission "${catalina.base}${file.separator}
  188. // webapps${file.separator}examples${file.separator}WEB-INF
  189. // ${file.separator}classes${file.separator}logging.properties", "read";
  190. };
  191.  
  192. // These permissions apply to the server startup code
  193. grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
  194. permission java.security.AllPermission;
  195. };
  196.  
  197. // These permissions apply to the servlet API classes
  198. // and those that are shared across all class loaders
  199. // located in the "lib" directory
  200. grant codeBase "file:${catalina.home}/lib/-" {
  201. permission java.security.AllPermission;
  202. };
  203.  
  204.  
  205. // If using a per instance lib directory, i.e. ${catalina.base}/lib,
  206. // then the following permission will need to be uncommented
  207. // grant codeBase "file:${catalina.base}/lib/-" {
  208. // permission java.security.AllPermission;
  209. // };
  210.  
  211.  
  212. // ========== WEB APPLICATION PERMISSIONS =====================================
  213.  
  214.  
  215. // These permissions are granted by default to all web applications
  216. // In addition, a web application will be given a read FilePermission
  217. // and JndiPermission for all files and directories in its document root.
  218. grant {
  219. // Required for JNDI lookup of named JDBC DataSource's and
  220. // javamail named MimePart DataSource used to send mail
  221. permission java.util.PropertyPermission "java.home", "read";
  222. permission java.util.PropertyPermission "java.naming.*", "read";
  223. permission java.util.PropertyPermission "javax.sql.*", "read";
  224.  
  225. // OS Specific properties to allow read access
  226. permission java.util.PropertyPermission "os.name", "read";
  227. permission java.util.PropertyPermission "os.version", "read";
  228. permission java.util.PropertyPermission "os.arch", "read";
  229. permission java.util.PropertyPermission "file.separator", "read";
  230. permission java.util.PropertyPermission "path.separator", "read";
  231. permission java.util.PropertyPermission "line.separator", "read";
  232.  
  233. // JVM properties to allow read access
  234. permission java.util.PropertyPermission "java.version", "read";
  235. permission java.util.PropertyPermission "java.vendor", "read";
  236. permission java.util.PropertyPermission "java.vendor.url", "read";
  237. permission java.util.PropertyPermission "java.class.version", "read";
  238. permission java.util.PropertyPermission "java.specification.version", "read";
  239. permission java.util.PropertyPermission "java.specification.vendor", "read";
  240. permission java.util.PropertyPermission "java.specification.name", "read";
  241.  
  242. permission java.util.PropertyPermission "java.vm.specification.version", "read";
  243. permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
  244. permission java.util.PropertyPermission "java.vm.specification.name", "read";
  245. permission java.util.PropertyPermission "java.vm.version", "read";
  246. permission java.util.PropertyPermission "java.vm.vendor", "read";
  247. permission java.util.PropertyPermission "java.vm.name", "read";
  248.  
  249. // Required for OpenJMX
  250. permission java.lang.RuntimePermission "getAttribute";
  251.  
  252. // Allow read of JAXP compliant XML parser debug
  253. permission java.util.PropertyPermission "jaxp.debug", "read";
  254.  
  255. // All JSPs need to be able to read this package
  256. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat";
  257.  
  258. // Precompiled JSPs need access to these packages.
  259. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
  260. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
  261. permission java.lang.RuntimePermission
  262. "accessClassInPackage.org.apache.jasper.runtime.*";
  263.  
  264. // Precompiled JSPs need access to these system properties.
  265. permission java.util.PropertyPermission
  266. "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
  267. permission java.util.PropertyPermission
  268. "org.apache.el.parser.COERCE_TO_ZERO", "read";
  269.  
  270. // The cookie code needs these.
  271. permission java.util.PropertyPermission
  272. "org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";
  273. permission java.util.PropertyPermission
  274. "org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read";
  275. permission java.util.PropertyPermission
  276. "org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read";
  277.  
  278. // Applications using Comet need to be able to access this package
  279. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.comet";
  280.  
  281. permission javax.security.auth.AuthPermission "*";
  282. permission javax.management.MBeanPermission "*", "*";
  283. };
  284.  
  285.  
  286. // The Manager application needs access to the following packages to support the
  287. // session display functionality. These settings support the following
  288. // configurations:
  289. // - default CATALINA_HOME == CATALINA_BASE
  290. // - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
  291. // - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
  292. grant codeBase "file:${catalina.base}/webapps/manager/-" {
  293. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
  294. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
  295. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
  296. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
  297. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
  298. };
  299. grant codeBase "file:${catalina.home}/webapps/manager/-" {
  300. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
  301. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
  302. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
  303. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
  304. permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
  305. };
  306.  
  307. // You can assign additional permissions to particular web applications by
  308. // adding additional "grant" entries here, based on the code base for that
  309. // application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
  310. //
  311. // Different permissions can be granted to JSP pages, classes loaded from
  312. // the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
  313. // directory, or even to individual jar files in the /WEB-INF/lib/ directory.
  314. //
  315. // For instance, assume that the standard "examples" application
  316. // included a JDBC driver that needed to establish a network connection to the
  317. // corresponding database and used the scrape taglib to get the weather from
  318. // the NOAA web server. You might create a "grant" entries like this:
  319. //
  320. // The permissions granted to the context root directory apply to JSP pages.
  321. // grant codeBase "file:${catalina.base}/webapps/examples/-" {
  322. // permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
  323. // permission java.net.SocketPermission "*.noaa.gov:80", "connect";
  324. // };
  325. //
  326. // The permissions granted to the context WEB-INF/classes directory
  327. // grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" {
  328. // };
  329. //
  330. // The permission granted to your JDBC driver
  331. // grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
  332. // permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
  333. // };
  334. // The permission granted to the scrape taglib
  335. // grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
  336. // permission java.net.SocketPermission "*.noaa.gov:80", "connect";
  337. // };
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!