From ab6830f3e16691797a3b63aaa3be6ebb79bf6396 Mon Sep 17 00:00:00 2001
From: Endi Sukma Dewata <edewata@redhat.com>
Date: Tue, 2 Oct 2012 11:40:35 -0500
Subject: [PATCH] Enabled Tomcat security manager.

The tomcat.conf and pkideployment.cfg have been modified to enable
the security manager. The catalina.policy has been updated with
more specific permissions for PKI.

Ticket #223
---
 base/common/shared/conf/catalina.policy | 54 +++++++++++++++++++++++++++++++--
 base/common/shared/conf/tomcat.conf     |  2 +-
 base/deploy/config/pkideployment.cfg    |  2 +-
 3 files changed, 53 insertions(+), 5 deletions(-)

diff --git a/base/common/shared/conf/catalina.policy b/base/common/shared/conf/catalina.policy
index 02c1eea0a46d439990642207f941dfdcad990a84..4baf17ec7586361f571c0a545c2fd7c52265fd14 100644
--- a/base/common/shared/conf/catalina.policy
+++ b/base/common/shared/conf/catalina.policy
@@ -121,9 +121,9 @@ grant codeBase "file:${catalina.home}/lib/-" {
 
 // If using a per instance lib directory, i.e. ${catalina.base}/lib,
 // then the following permission will need to be uncommented
-// grant codeBase "file:${catalina.base}/lib/-" {
-//         permission java.security.AllPermission;
-// };
+grant codeBase "file:${catalina.base}/lib/-" {
+        permission java.security.AllPermission;
+};
 
 
 // ========== WEB APPLICATION PERMISSIONS =====================================
@@ -192,6 +192,54 @@ grant {
     permission java.util.PropertyPermission
      "org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read";
 
+    // PKI
+    permission java.lang.RuntimePermission "accessDeclaredMembers";
+    permission java.lang.RuntimePermission "accessClassInPackage.com.sun.xml.*";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.*";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.coyote";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.coyote.*";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.*";
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.util.logging.*";
+    permission java.lang.RuntimePermission "charsetProvider";
+    permission java.lang.RuntimePermission "defineClassInPackage.org.apache.catalina.*";
+    permission java.lang.RuntimePermission "getClassLoader";
+    permission java.lang.RuntimePermission "loadLibrary.*";
+    permission java.lang.RuntimePermission "shutdownHooks";
+    permission java.lang.RuntimePermission "writeFileDescriptor";
+
+    permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
+
+    permission java.security.SecurityPermission "insertProvider.CMS";
+    permission java.security.SecurityPermission "insertProvider.Mozilla-JSS";
+    permission java.security.SecurityPermission "putProviderProperty.CMS";
+    permission java.security.SecurityPermission "putProviderProperty.Mozilla-JSS";
+
+    permission java.util.PropertyPermission "catalina.*", "read";
+    permission java.util.PropertyPermission "user.home", "read";
+    permission java.util.PropertyPermission "user.dir", "read";
+    permission java.util.PropertyPermission "java.util.logging.*", "read";
+    permission java.util.PropertyPermission "javax.net.ssl.*", "read";
+    permission java.util.PropertyPermission "xerces.debug", "read";
+    permission java.util.PropertyPermission "dtm.debug", "read";
+    permission java.util.PropertyPermission "com.sun.xml.*", "read";
+    permission java.util.PropertyPermission "jvmRoute", "read";
+    permission java.util.PropertyPermission "log4j.*", "read";
+    permission java.util.PropertyPermission "mapAnyUriToUri", "read";
+    permission java.util.PropertyPermission "com.netscape.ldap.*", "read";
+    permission java.util.PropertyPermission "org.apache.catalina.*", "read";
+    permission java.util.PropertyPermission "org.apache.commons.logging.*", "read";
+    permission java.util.PropertyPermission "org.apache.xerces.xni.parser.*", "read";
+
+    permission java.net.NetPermission "getNetworkInformation";
+
+    permission javax.management.MBeanServerPermission "findMBeanServer";
+    permission javax.management.MBeanPermission "*", "registerMBean";
+
+    // File and socket permissions are controlled by SELinux policy
+    permission java.io.FilePermission "<<ALL FILES>>", "read,write,execute,delete,readlink";
+    permission java.net.SocketPermission "*", "accept,connect,listen,resolve";
+
     // Applications using Comet need to be able to access this package
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.comet";
 };
diff --git a/base/common/shared/conf/tomcat.conf b/base/common/shared/conf/tomcat.conf
index 9c1a81bb7506bd72d8418b2d3175d2fcb34985e7..54d67e4b4b0a9579f6b4222c0fa654cfd6535911 100644
--- a/base/common/shared/conf/tomcat.conf
+++ b/base/common/shared/conf/tomcat.conf
@@ -39,7 +39,7 @@ TOMCAT_USER="[PKI_USER]"
 #LANG="en_US"
 
 # Run tomcat under the Java Security Manager
-#SECURITY_MANAGER="[PKI_SECURITY_MANAGER]"
+SECURITY_MANAGER="[PKI_SECURITY_MANAGER]"
 
 # Time to wait in seconds, before killing process
 #SHUTDOWN_WAIT="30"
diff --git a/base/deploy/config/pkideployment.cfg b/base/deploy/config/pkideployment.cfg
index a7e61ccb8186a06d005c5f2e91fc3c809fe558eb..b4a20dc2dba2c39c043bca47173126b265387bba 100644
--- a/base/deploy/config/pkideployment.cfg
+++ b/base/deploy/config/pkideployment.cfg
@@ -118,7 +118,7 @@ pki_https_port=8443
 pki_instance_name=pki-tomcat
 pki_proxy_http_port=80
 pki_proxy_https_port=443
-pki_security_manager=false
+pki_security_manager=true
 pki_tomcat_server_port=8005
 ###############################################################################
 ##  'CA' Data:                                                               ##
-- 
1.7.11.4

