Naming lookup needs a getClassloader permission

[anil.saldhana]

Scott, from the following stacktrace, we see that the JNP layer needs to have a "getClassloader" permission. Should a privileged operation go in naming? If not, user applications who do any JNDI lookup will need to be assigned the "getClassloader" perm.

EJBException:; nested exception is: javax.ejb.EJBException: javax.naming.NamingException: Could not dereference object [Root exception is javax.naming.NamingException: Could not dereference object [Root exception is java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)]]

java.rmi.ServerException: EJBException:; nested exception is:
 javax.ejb.EJBException: javax.naming.NamingException: Could not dereference object [Root exception is javax.naming.NamingException: Could not dereference object [Root exception is java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)]]
 at org.jboss.ejb.plugins.LogInterceptor.handleException(LogInterceptor.java:365)
 at org.jboss.ejb.plugins.LogInterceptor.invoke(LogInterceptor.java:209)
 at org.jboss.ejb.plugins.ProxyFactoryFinderInterceptor.invoke(ProxyFactoryFinderInterceptor.java:138)
 at org.jboss.ejb.SessionContainer.internalInvoke(SessionContainer.java:650)
 at org.jboss.ejb.Container.invoke(Container.java:1029)
 at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:157)
 at org.jboss.mx.server.Invocation.dispatch(Invocation.java:96)
 at org.jboss.mx.server.Invocation.invoke(Invocation.java:88)
 at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
 at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:668)
 at org.jboss.invocation.unified.server.UnifiedInvoker.invoke(UnifiedInvoker.java:232)
 at org.jboss.remoting.ServerInvoker.invoke(ServerInvoker.java:908)
 at org.jboss.remoting.transport.socket.ServerThread.completeInvocation(ServerThread.java:742)
 at org.jboss.remoting.transport.socket.ServerThread.processInvocation(ServerThread.java:695)
 at org.jboss.remoting.transport.socket.ServerThread.dorun(ServerThread.java:549)
 at org.jboss.remoting.transport.socket.ServerThread.run(ServerThread.java:230)
Caused by: javax.ejb.EJBException: javax.naming.NamingException: Could not dereference object [Root exception is javax.naming.NamingException: Could not dereference object [Root exception is java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)]]
 at org.jboss.test.cmp2.audit.beans.AuditSessionBean.createCheck(AuditSessionBean.java:408)
 at org.jboss.test.cmp2.audit.beans.AuditSessionBean.createAuditMappedCheck(AuditSessionBean.java:330)
 at org.jboss.invocation.Invocation.performCall(Invocation.java:386)
 at org.jboss.ejb.StatelessSessionContainer$ContainerInterceptor.invoke(StatelessSessionContainer.java:228)
 at org.jboss.resource.connectionmanager.CachedConnectionInterceptor.invoke(CachedConnectionInterceptor.java:156)
 at org.jboss.ejb.plugins.StatelessSessionInstanceInterceptor.invoke(StatelessSessionInstanceInterceptor.java:173)
 at org.jboss.ejb.plugins.CallValidationInterceptor.invoke(CallValidationInterceptor.java:63)
 at org.jboss.ejb.plugins.AbstractTxInterceptor.invokeNext(AbstractTxInterceptor.java:121)
 at org.jboss.ejb.plugins.TxInterceptorCMT.runWithTransactions(TxInterceptorCMT.java:350)
 at org.jboss.ejb.plugins.TxInterceptorCMT.invoke(TxInterceptorCMT.java:181)
 at org.jboss.ejb.plugins.SecurityInterceptor.process(SecurityInterceptor.java:228)
 at org.jboss.ejb.plugins.SecurityInterceptor.invoke(SecurityInterceptor.java:211)
 at org.jboss.ejb.plugins.security.PreSecurityInterceptor.process(PreSecurityInterceptor.java:97)
 at org.jboss.ejb.plugins.security.PreSecurityInterceptor.invoke(PreSecurityInterceptor.java:81)
 at org.jboss.ejb.plugins.LogInterceptor.invoke(LogInterceptor.java:205)
 at org.jboss.ejb.plugins.ProxyFactoryFinderInterceptor.invoke(ProxyFactoryFinderInterceptor.java:138)
 at org.jboss.ejb.SessionContainer.internalInvoke(SessionContainer.java:650)
 at org.jboss.ejb.Container.invoke(Container.java:1029)
 at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:157)
 at org.jboss.mx.server.Invocation.dispatch(Invocation.java:96)
 at org.jboss.mx.server.Invocation.invoke(Invocation.java:88)
 at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
 at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:668)
 at org.jboss.invocation.unified.server.UnifiedInvoker.invoke(UnifiedInvoker.java:232)
 at org.jboss.remoting.ServerInvoker.invoke(ServerInvoker.java:908)
 at org.jboss.remoting.transport.socket.ServerThread.completeInvocation(ServerThread.java:742)
 at org.jboss.remoting.transport.socket.ServerThread.processInvocation(ServerThread.java:695)
 at org.jboss.remoting.transport.socket.ServerThread.dorun(ServerThread.java:549)
 at org.jboss.remoting.transport.socket.ServerThread.run(ServerThread.java:230)
 at org.jboss.remoting.MicroRemoteClientInvoker.invoke(MicroRemoteClientInvoker.java:206)
 at org.jboss.remoting.Client.invoke(Client.java:1708)
 at org.jboss.remoting.Client.invoke(Client.java:612)
 at org.jboss.invocation.unified.interfaces.UnifiedInvokerProxy.invoke(UnifiedInvokerProxy.java:184)
 at org.jboss.invocation.InvokerInterceptor.invokeInvoker(InvokerInterceptor.java:365)
 at org.jboss.invocation.InvokerInterceptor.invoke(InvokerInterceptor.java:197)
 at org.jboss.proxy.TransactionInterceptor.invoke(TransactionInterceptor.java:61)
 at org.jboss.proxy.SecurityInterceptor.invoke(SecurityInterceptor.java:87)
 at org.jboss.proxy.ejb.StatelessSessionInterceptor.invoke(StatelessSessionInterceptor.java:112)
 at org.jboss.proxy.ClientContainer.invoke(ClientContainer.java:101)
 at $Proxy3.createAuditMappedCheck(Unknown Source)
 at org.jboss.test.cmp2.audit.test.AuditUnitTestCase.testUpdateAuditMappedChangedFields(AuditUnitTestCase.java:170)
 at junit.extensions.TestDecorator.basicRun(TestDecorator.java:24)
 at junit.extensions.TestSetup$1.protect(TestSetup.java:21)
 at junit.extensions.TestSetup.run(TestSetup.java:25)
Caused by: javax.naming.NamingException: Could not dereference object [Root exception is javax.naming.NamingException: Could not dereference object [Root exception is java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)]]
 at org.jnp.interfaces.NamingContext.resolveLink(NamingContext.java:1339)
 at org.jnp.interfaces.NamingContext.lookup(NamingContext.java:804)
 at org.jnp.interfaces.NamingContext.lookup(NamingContext.java:820)
 at org.jnp.interfaces.NamingContext.lookup(NamingContext.java:673)
 at javax.naming.InitialContext.lookup(InitialContext.java:351)
 at org.jboss.test.cmp2.audit.beans.AuditSessionBean.getDataSource(AuditSessionBean.java:539)
 at org.jboss.test.cmp2.audit.beans.AuditSessionBean.getAuditData(AuditSessionBean.java:454)
 at org.jboss.test.cmp2.audit.beans.AuditSessionBean.createCheck(AuditSessionBean.java:398)
 at org.jboss.test.cmp2.audit.beans.AuditSessionBean.createAuditMappedCheck(AuditSessionBean.java:330)
 at org.jboss.invocation.Invocation.performCall(Invocation.java:386)
 at org.jboss.ejb.StatelessSessionContainer$ContainerInterceptor.invoke(StatelessSessionContainer.java:228)
 at org.jboss.resource.connectionmanager.CachedConnectionInterceptor.invoke(CachedConnectionInterceptor.java:156)
 at org.jboss.ejb.plugins.StatelessSessionInstanceInterceptor.invoke(StatelessSessionInstanceInterceptor.java:173)
 at org.jboss.ejb.plugins.CallValidationInterceptor.invoke(CallValidationInterceptor.java:63)
 at org.jboss.ejb.plugins.AbstractTxInterceptor.invokeNext(AbstractTxInterceptor.java:121)
 at org.jboss.ejb.plugins.TxInterceptorCMT.runWithTransactions(TxInterceptorCMT.java:350)
 at org.jboss.ejb.plugins.TxInterceptorCMT.invoke(TxInterceptorCMT.java:181)
 at org.jboss.ejb.plugins.SecurityInterceptor.process(SecurityInterceptor.java:228)
 at org.jboss.ejb.plugins.SecurityInterceptor.invoke(SecurityInterceptor.java:211)
 at org.jboss.ejb.plugins.security.PreSecurityInterceptor.process(PreSecurityInterceptor.java:97)
 at org.jboss.ejb.plugins.security.PreSecurityInterceptor.invoke(PreSecurityInterceptor.java:81)
 at org.jboss.ejb.plugins.LogInterceptor.invoke(LogInterceptor.java:205)
 at org.jboss.ejb.plugins.ProxyFactoryFinderInterceptor.invoke(ProxyFactoryFinderInterceptor.java:138)
 at org.jboss.ejb.SessionContainer.internalInvoke(SessionContainer.java:650)
 at org.jboss.ejb.Container.invoke(Container.java:1029)
 at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:157)
 at org.jboss.mx.server.Invocation.dispatch(Invocation.java:96)
 at org.jboss.mx.server.Invocation.invoke(Invocation.java:88)
 at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
 at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:668)
 at org.jboss.invocation.unified.server.UnifiedInvoker.invoke(UnifiedInvoker.java:232)
 at org.jboss.remoting.ServerInvoker.invoke(ServerInvoker.java:908)
 at org.jboss.remoting.transport.socket.ServerThread.completeInvocation(ServerThread.java:742)
 at org.jboss.remoting.transport.socket.ServerThread.processInvocation(ServerThread.java:695)
 at org.jboss.remoting.transport.socket.ServerThread.dorun(ServerThread.java:549)
 at org.jboss.remoting.transport.socket.ServerThread.run(ServerThread.java:230)
Caused by: javax.naming.NamingException: Could not dereference object [Root exception is java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)]
 at org.jnp.interfaces.NamingContext.getObjectInstanceWrapFailure(NamingContext.java:1463)
 at org.jnp.interfaces.NamingContext.lookup(NamingContext.java:809)
 at org.jnp.interfaces.NamingContext.lookup(NamingContext.java:673)
 at javax.naming.InitialContext.lookup(InitialContext.java:351)
 at org.jnp.interfaces.NamingContext.resolveLink(NamingContext.java:1333)
Caused by: java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
 at java.security.AccessControlContext.checkPermission(AccessControlContext.java:264)
 at java.security.AccessController.checkPermission(AccessController.java:427)
 at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
 at java.lang.ClassLoader.getParent(ClassLoader.java:1224)
 at org.jboss.util.loading.DelegatingClassLoader.loadClass(DelegatingClassLoader.java:92)
 at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
 at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:319)
 at java.lang.Class.forName0(Native Method)
 at java.lang.Class.forName(Class.java:242)
 at com.sun.naming.internal.VersionHelper12.loadClass(VersionHelper12.java:42)
 at javax.naming.spi.NamingManager.getObjectFactoryFromReference(NamingManager.java:129)
 at javax.naming.spi.NamingManager.getObjectInstance(NamingManager.java:302)
 at org.jnp.interfaces.NamingContext.getObjectInstance(NamingContext.java:1438)
 at org.jnp.interfaces.NamingContext.getObjectInstanceWrapFailure(NamingContext.java:1455)

[starksm64]

Its not naming that is causing this, its the org.jboss.util.loading.DelegatingClassLoader calling getParent() outside of a privileged block. The naming layer has obtained the TCCL in a privileged, and its a DelegatingClassLoader.

[anil.saldhana]

https://jira.jboss.org/jira/browse/JBCOMMON-75

[anil.saldhana]

Suddenly I have turned into a Santa Claus who brings JIRA issues. It is still November.

From the stack trace:

2008-11-18 13:52:53,897 ERROR [STDERR] (WorkerThread#3[127.0.0.1:40887]) access: domain that failed ProtectionDomain (null <no signer certificates>)
 org.jboss.proxy.compiler.Runtime@56683a8d
 <no principals>
 java.security.Permissions@8465aab (
 (javax.management.MBeanServerPermission findMBeanServer)
 (javax.management.MBeanPermission org.jboss.mx.modelmbean.XMBean#*[JMImplementation:type=MBeanRegistry] *)
 (javax.management.MBeanPermission org.jboss.security.plugins.JaasSecurityManagerService#*[jboss.security:service=JaasSecurityManager] invoke)
....

java.lang.IllegalStateException: java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
 at org.jboss.security.plugins.JBossSecurityContext.getUtil(JBossSecurityContext.java:201)
 at org.jboss.ejb.plugins.cmp.jdbc.bridge.JDBCCMRFieldBridge.invokeGetRelatedId(JDBCCMRFieldBridge.java:1156)
 at org.jboss.ejb.plugins.cmp.jdbc.bridge.JDBCCMRFieldBridge.createRelationLinks(JDBCCMRFieldBridge.java:988)

....
Caused by: java.security.AccessControlException: access denied (java.lang.RuntimePermission getClassLoader)
 at java.security.AccessControlContext.checkPermission(AccessControlContext.java:264)
 at java.security.AccessController.checkPermission(AccessController.java:427)
 at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
 at java.lang.ClassLoader.getParent(ClassLoader.java:1224)
 at org.jboss.classloading.spi.DelegatingClassLoader.loadClass(DelegatingClassLoader.java:84)
 at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
 at org.jboss.util.loading.DelegatingClassLoader.loadClass(DelegatingClassLoader.java:97)
 at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
 at org.jboss.security.SecurityContextFactory.getContextClass(SecurityContextFactory.java:142)
 at org.jboss.security.SecurityContextFactory.createUtil(SecurityContextFactory.java:118)
 at org.jboss.security.plugins.JBossSecurityContext.getUtil(JBossSecurityContext.java:197)
 ... 82 more

Currently I feel that the offending class is the (surrogate) DelegatingClassLoader that sits in the "integration" project at:
http://anonsvn.jboss.org/repos/jbossas/projects/integration/trunk/jboss-classloading-spi/src/main/java/org/jboss/classloading/spi/DelegatingClassLoader.java

Here calls to getParent() and super.loadClass need to be shielded with priv blocks?

This is because for the users of CL, getting the classloader is a privileged operation, but loading the class is not.

Also I am wondering why the protection domain is null. Is it because we are in the bootstrap zone when the perm check is done?

[starksm64]

Same issue with getParent(). Only that should be in the privileged block, loadClass() should not. I guess the domain is null because its the java.lang.ClassLoader.getParent code that is making the permission check call.

[anil.saldhana]

Where do JIRA issues for "integration" go? I cannot find a project for it.

[dimitris]

I don't think we have one.

[anil.saldhana]

I don't think we have one.

I will create (and fix) a jira issue in JBAS for this integration issue.

In the meantime, Dimitris, I am going to release common-core 2.2.10 right now. I assigned it to myself because I have the workspace handy.

[anil.saldhana]

DelegatingClassLoader (both the common and integration versions) needed to have the priv block for the getParent() call.

After the updated common and integration projects, I see the sec mgr tests flowing smoothly in my local workspace.

I need to *brock* Adrian for not having a JIRA project for integration.