The Apache Jakarta Tomcat 5 Servlet/JSP Container

Security Manager HOW-TO

Java的SecurityManager允许浏览器在它可执行的范围内运行，这样可以防止不可靠的程序读写用户在局部文件系统里的文件，或者未经授权进行网络连接，等等。同样，SecurityManager可用来防止不可靠的程序在你的浏览器上运行，在运行Tomcat时使用SecurityManager可以保护你的服务器不受到类似于木马的servlets, JSPs, JSP beans 和 tag libraries的影响，或者发生错误。

试想某个被允许在你的网站上发表JSPs的人不慎包括了以下的语句在他们的JSP里：

	<%System.exit(1);%>

每次Tomcat运行该JSP都会导致Tomcat中断。使用Java SecurityManager如同多了一层防护，可以让服务器更加安全可靠。

警告——虽然Tomcat 5的程序通过了安全检查，最重要的程序包都已被保护，新的安全机制也已实施，但在允许用户发表网络程序，JSPs, servlets, beans, 或 tag libraries之前，你还是有必要确保SecurityManager的各项配置符合你的要求。当然，有SecurityManager绝对比没有它要安全的多。

Permission类是用来定义Tomcat载入的类所拥有的权限。Java本身包括了一些Permission类，你也可以在你的网络应用中加入你自己的Permission类。这两种技术在Tomcat 5里都被应用。

标准许可权限

这里简单总结了标准系统中适用于Tomcat的SecurityManager Permission 类。更多信息请参看http://java.sun.com/security/。 java.util.PropertyPermission - 控制读/写Java虚拟器的属性，如java.home 。  java.home java.lang.RuntimePermission - 控制使用一些系统/运行时(System/Runtime)的功能，如exit() 和 exec()。它也控制包(package)的访问/定义。 java.io.FilePermission - 控制对文件和目录的读/写/执行操作。 java.net.SocketPermission - 控制使用网路sockets连接。 java.net.NetPermission - 控制使用multicast网路连接。 java.lang.reflect.ReflectPermission - 控制使用reflection来对类进行检视。 java.security.SecurityPermission - 控制对安全方法的访问。 java.security.AllPermission - 给予所有访问权限，就如你运行一个没有SecurityManager的Tomcat 。

Tomcat用户特有权限

Tomcat利用一个叫做org.apache.naming.JndiPermission 客户许可类。它用来控制以JNDI命名的文件资源的可读权限。该许可的名称是以JNDI来表达，没有命令。在给予许可时，"*"的结尾可以用来以wild card方式映射JNDI命名的文件资源。例如，你可以在你的政策(policy)文件加入以下一行： permission org.apache.naming.JndiPermission "jndi://localhost/examples/*"; 一个象这样的许可(Permission)会在部署网络程序时被自动产生，允许它读取它自己的静态资源，但不允许它使用文件访问权来读取其它文件(除非你明确地给出访问那些文件的许可). 并且, Tomcat 总是自动产生以下文件许可: permission java.io.FilePermission "** your application context**", "read"; 这里**your application context**代表那个拥有你的应用程序的文件夹(或者是WAR文件)。

政策文件的格式

由Java SecurityManager实现的安全政策被配置存放在$CATALINA_HOME/conf/catalina.policy 文件里。这个文件完全替代了JDK系统目录里的java.policy文件。这个catalina.policy 文件可以手动修改，或者使用Java 1.2 及其后版本的policytool程序修改。

catalina.policy 文件中的条文使用了标准的java.policy文件格式，如下：

	// Example policy file entry grant [signedBy <signer>,] [codeBase <code source>] { permission <class> [<name> [, <action list>]]; };

其中signedBy 和 codeBase是选择项。注释行是以"//"开始，直到该行结束。codeBase是URL的格式，文件的URL中可用如${java.home}和${catalina.home}等属性(这些属性会被扩展到由环境变量JAVA_HOME 和 CATALINA_HOME为他们定义的目录路径)。

缺省政策文件

缺省$CATALINA_HOME/conf/catalina.policy 文件看起来象这样：

	// ============================================================================ // catalina.corepolicy - Security Policy Permissions for Tomcat 5 // // This file contains a default set of security policies to be enforced (by the // JVM) when Catalina is executed with the "-security" option. In addition // to the permissions granted here, the following additional permissions are // granted to the codebase specific to each web application: // // * Read access to the document root directory // // $Id: security-manager-howto.xml,v 1.5 2003/01/15 03:40:43 glenn Exp $ // ============================================================================ // ========== SYSTEM CODE PERMISSIONS ========================================= // These permissions apply to javac grant codeBase "file:${java.home}/lib/-" { permission java.security.AllPermission; }; // These permissions apply to all shared system extensions grant codeBase "file:${java.home}/jre/lib/ext/-" { permission java.security.AllPermission; }; // These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre grant codeBase "file:${java.home}/../lib/-" { permission java.security.AllPermission; }; // These permissions apply to all shared system extensions when // ${java.home} points at $JAVA_HOME/jre grant codeBase "file:${java.home}/lib/ext/-" { permission java.security.AllPermission; }; // ========== CATALINA CODE PERMISSIONS ======================================= // These permissions apply to the launcher code grant codeBase "file:${catalina.home}/bin/commons-launcher.jar" { permission java.security.AllPermission; }; // These permissions apply to the server startup code grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { permission java.security.AllPermission; }; // These permissions apply to the servlet API classes // and those that are shared across all class loaders // located in the "common" directory grant codeBase "file:${catalina.home}/common/-" { permission java.security.AllPermission; }; // These permissions apply to the container's core code, plus any additional // libraries installed in the "server" directory grant codeBase "file:${catalina.home}/server/-" { permission java.security.AllPermission; }; // ========== WEB APPLICATION PERMISSIONS ===================================== // These permissions are granted by default to all web applications // In addition, a web application will be given a read FilePermission // and JndiPermission for all files and directories in its document root. grant { // Required for JNDI lookup of named JDBC DataSource's and // javamail named MimePart DataSource used to send mail permission java.util.PropertyPermission "java.home", "read"; permission java.util.PropertyPermission "java.naming.*", "read"; permission java.util.PropertyPermission "javax.sql.*", "read"; // OS Specific properties to allow read access permission java.util.PropertyPermission "os.name", "read"; permission java.util.PropertyPermission "os.version", "read"; permission java.util.PropertyPermission "os.arch", "read"; permission java.util.PropertyPermission "file.separator", "read"; permission java.util.PropertyPermission "path.separator", "read"; permission java.util.PropertyPermission "line.separator", "read"; // JVM properties to allow read access permission java.util.PropertyPermission "java.version", "read"; permission java.util.PropertyPermission "java.vendor", "read"; permission java.util.PropertyPermission "java.vendor.url", "read"; permission java.util.PropertyPermission "java.class.version", "read"; permission java.util.PropertyPermission "java.specification.version", "read"; permission java.util.PropertyPermission "java.specification.vendor", "read"; permission java.util.PropertyPermission "java.specification.name", "read"; permission java.util.PropertyPermission "java.vm.specification.version", "read"; permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; permission java.util.PropertyPermission "java.vm.specification.name", "read"; permission java.util.PropertyPermission "java.vm.version", "read"; permission java.util.PropertyPermission "java.vm.vendor", "read"; permission java.util.PropertyPermission "java.vm.name", "read"; // Required for getting BeanInfo permission java.lang.RuntimePermission "accessClassInPackage.sun.beans.*"; // Required for OpenJMX permission java.lang.RuntimePermission "getAttribute"; // Allow read of JAXP compliant XML parser debug permission java.util.PropertyPermission "jaxp.debug", "read"; }; // You can assign additional permissions to particular web applications by // adding additional "grant" entries here, based on the code base for that // application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. // // Different permissions can be granted to JSP pages, classes loaded from // the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/ // directory, or even to individual jar files in the /WEB-INF/lib/ directory. // // For instance, assume that the standard "examples" application // included a JDBC driver that needed to establish a network connection to the // corresponding database and used the scrape taglib to get the weather from // the NOAA web server. You might create a "grant" entries like this: // // The permissions granted to the context root directory apply to JSP pages. // grant codeBase "file:${catalina.home}/webapps/examples/-" { // permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; // permission java.net.SocketPermission "*.noaa.gov:80", "connect"; // }; // // The permissions granted to the context WEB-INF/classes directory // grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/classes/-" { // }; // // The permission granted to your JDBC driver // grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/driver.jar!/-" { // permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; // }; // The permission granted to the scrape taglib // grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { // permission java.net.SocketPermission "*.noaa.gov:80", "connect"; // };

启动附带SecurityManager的Tomcat

在你配置好与SecurityManager一起使用的catalina.policy文件之后，你可以使用"-security"选项来启动Tomcat。

	$CATALINA_HOME/bin/catalina.sh start -security (Unix) %CATALINA_HOME%bincatalina start -security (Windows)

从Tomcat 5开始，现在可以配置Tomcat内部包的许可。更多信息请参看http://java.sun.com/security/seccodeguide.html 。

警告：删除缺省的包保护，可能打开一个安全漏洞。

缺省的属性文件

缺省的$CATALINA_HOME/conf/catalina.properties 文件看起来象这样：

	# # List of comma-separated packages that start with or equal this string # will cause a security exception to be thrown when # passed to checkPackageAccess unless the # corresponding RuntimePermission ("accessClassInPackage."+package) has # been granted. package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat., org.apache.jasper. # # List of comma-separated packages that start with or equal this string # will cause a security exception to be thrown when # passed to checkPackageDefinition unless the # corresponding RuntimePermission ("defineClassInPackage."+package) has # been granted. # # by default, no packages are restricted for definition, and none of # the class loaders supplied with the JDK call checkPackageDefinition. # package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote., org.apache.tomcat.,org.apache.jasper.

当你完成配置SecurityManager所需的catalina.properties 文件，记住要重新启动Tomcat。

如果你的网络应用程序试图执行没有许可而被阻止的操作，SecurityManager探查出这样的违规后，就会抛出一个AccessControLException 或 SecurityException 。 要查出究竟缺少哪个许可往往非常困难，一个方法是打印执行过程中的所有关于安全决定的排错信息。这可以在启动Tomcat之前通过设置系统属性来实现。最简单的办法是修改CATALINA_OPTS 环境变量。在启动Tomcat之前，执行下面这个命令：

	export CATALINA_OPTS=-Djava.security.debug=all (Unix) set CATALINA_OPTS=-Djava.security.debug=all (Windows)

（在启动Tomcat之前）。

警告——这会产生很多megabytes的输出。不过，通过查找"FAILED"这个词可以帮助你搜索问题所在，并确定哪个许可是要找的问题。请参看Java安全文档资料，那里有你可指定的更多选项。