8.0.0.Aplha2 java.security.AccessControlException: access denied ("java.util.logging.LoggingPermission" "control")

[suikast42]

Hi,

I need to set a SecurityManager for my tests. If I do this then I get an Exception shown below;

11:13:13,395 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 57) MSC000001: Failed to start service jboss.persistenceunit."wms-wan-ear.ear#WMSDS": org.jboss.msc.service.StartException in service jboss.persistenceunit."wms-wan-ear.ear#WMSDS": org.hibernate.boot.registry.selector.spi.StrategySelectionException: Could not instantiate named strategy class [com.siemag.components.server.updating.DomainInterceptor]
    at org.jboss.as.jpa.service.PersistenceUnitServiceImpl$1.run(PersistenceUnitServiceImpl.java:112)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_17]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_17]
    at java.lang.Thread.run(Thread.java:722) [rt.jar:1.7.0_17]
    at org.jboss.threads.JBossThread.run(JBossThread.java:122) [jboss-threads-2.1.0.Final.jar:2.1.0.Final]
Caused by: org.hibernate.boot.registry.selector.spi.StrategySelectionException: Could not instantiate named strategy class [com.siemag.components.server.updating.DomainInterceptor]
    at org.hibernate.boot.registry.selector.internal.StrategySelectorImpl.resolveDefaultableStrategy(StrategySelectorImpl.java:162)
    at org.hibernate.boot.registry.selector.internal.StrategySelectorImpl.resolveStrategy(StrategySelectorImpl.java:136)
    at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.processProperties(EntityManagerFactoryBuilderImpl.java:895)
    at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:826)
    at org.hibernate.jpa.HibernatePersistenceProvider.createContainerEntityManagerFactory(HibernatePersistenceProvider.java:142)
    at org.jboss.as.jpa.service.PersistenceUnitServiceImpl.createContainerEntityManagerFactory(PersistenceUnitServiceImpl.java:214)
    at org.jboss.as.jpa.service.PersistenceUnitServiceImpl.access$800(PersistenceUnitServiceImpl.java:59)
    at org.jboss.as.jpa.service.PersistenceUnitServiceImpl$1.run(PersistenceUnitServiceImpl.java:108)
    ... 4 more
Caused by: java.security.AccessControlException: access denied ("java.util.logging.LoggingPermission" "control")
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366) [rt.jar:1.7.0_17]
    at java.security.AccessController.checkPermission(AccessController.java:560) [rt.jar:1.7.0_17]
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) [rt.jar:1.7.0_17]
    at org.jboss.logmanager.LogContext.checkSecurityAccess(LogContext.java:345) [jboss-logmanager-1.4.1.Final.jar:1.4.1.Final]
    at org.jboss.logmanager.Logger.attachIfAbsent(Logger.java:198) [jboss-logmanager-1.4.1.Final.jar:1.4.1.Final]
    at org.apache.log4j.JBossAppenderHandler.createAndAttach(JBossAppenderHandler.java:43)
    at org.apache.log4j.JBossLogManagerFacade.getJBossLogger(JBossLogManagerFacade.java:39)
    at org.apache.log4j.JBossLogManagerFacade.getJBossRootLogger(JBossLogManagerFacade.java:98)
    at org.apache.log4j.JBossLogManagerFacade.getLoggerRepository(JBossLogManagerFacade.java:49)
    at org.apache.log4j.LogManager.getLoggerRepository(LogManager.java:49)
    at com.siemag.components.logging.WMSLoggerFactory.getDefaultRepository(WMSLoggerFactory.java:53)
    at com.siemag.components.logging.WMSLoggerFactory.getLogger(WMSLoggerFactory.java:85)
    at com.siemag.components.logging.WMSLoggerFactory.getLogger(WMSLoggerFactory.java:96)
    at com.siemag.components.server.updating.DomainInterceptor.<init>(DomainInterceptor.java:11)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) [rt.jar:1.7.0_17]
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57) [rt.jar:1.7.0_17]
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) [rt.jar:1.7.0_17]
    at java.lang.reflect.Constructor.newInstance(Constructor.java:525) [rt.jar:1.7.0_17]
    at java.lang.Class.newInstance0(Class.java:374) [rt.jar:1.7.0_17]
    at java.lang.Class.newInstance(Class.java:327) [rt.jar:1.7.0_17]
    at org.hibernate.boot.registry.selector.internal.StrategySelectorImpl.resolveDefaultableStrategy(StrategySelectorImpl.java:159)
    ... 11 more

My Policy file:

grant{

  permission java.security.AllPermission;

};

I try to set the LoggingPermission"control" with codebase but I had no luck with that. The same stuff is running under 7.2.0.Final.

[jamezp]

I'm guessing that com.siemag.components.logging.WMSLoggerFactory is an internal logging factory you use. You might need to use a privileged action to retrieve the logger.

--

James R. Perkins

[suikast42]

Hi James,

that's right. We use a custon logmanager. But we had no problem with that at the past. What's changed that I get this security excpetion. If I grant all rights in my java.policy file thats not work too, Can you provide a simple example please ?

[suikast42]

Hi it's me agian ;-),

I try to grant codebase permission to my jar which contains my LoggerRepo.

grant codeBase "file:F:/IDE/wildfly-8.0.0.Alpha2/standalone/deployments/wms-wan-ear.ear/lib/wms-base-components-3.0.0-SNAPSHOT.jar" {

permission java.util.logging.LoggingPermission "control";

};

Even that doesn't help.

[jamezp]

I'm far from a security expert and I know even less about the SecurityManager. I know there was some changes to use a new SecurityManager project, but I haven't had a chance to really dig into it. Maybe someone will come along and give an answer before I have a change to dig in

--

James R. Perkins

[suikast42]

So let's wait for 8.0.0.Alpha3 ;-)

[dmlloyd]

In the WildFly container, the best option is to configure the security manager subsystem which should be in the Alpha2 release.  This will install the module-aware security manager, which does not use policy files.  Instead it uses Java EE 7 permissions.xml deployment descriptors which define deployment permissions.

[suikast42]

Hi David,

thats realy new information for me. Can you provide an example please?

[ctomc]

Sample configuration,

<subsystem xmlns="urn:jboss:domain:security-manager:1.0">
    <deployment-permissions>
        <minimum-set>
            <permission class="java.io.FilePermission" name="/tmp" actions="read,write"/>
            <permission class="java.io.FilePermission" name="/opt" actions="read"/>
            <permission class="java.lang.RuntimePermission" name="createClassLoader"/>
        </minimum-set>
        <maximum-set>
            <permission class="java.security.AllPermission"/>
        </maximum-set>
    </deployment-permissions>
</subsystem>

also take a look at EE7 permissions.xml https://blogs.oracle.com/SecuritEE/entry/java_ee_7_permission_declarations

Hope it can help you.

[suikast42]

Hi Tomaz. That approach is realy new ;-). Ok I'll try it out as soon as possible. Thanks.

[dmlloyd]

When using this subsystem, do not manually enable the default security manager.  WildFly will install its own.

[suikast42]

Hi David,

do you mean to start wildfly with -Djava-securitymanager stuff right ?

[dmlloyd]

I mean add the extension and subsystem to your configuration only.  Do not pass any security manager-related -D parameters.

[suikast42]

Hi Tomaz,

if I add your suggestion to  my server config then I get the exception shown below:

10:32:18,160 ERROR [org.jboss.as.server] (Controller Boot Thread) JBAS015956: Caught exception during boot: org.jboss.as.controller.persistence.ConfigurationPersistenceException: JBAS014676: Failed to parse configuration

    at org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:112) [wildfly-controller-8.0.0.Alpha2.jar:8.0.0.Alpha2]

    at org.jboss.as.server.ServerService.boot(ServerService.java:316) [wildfly-server-8.0.0.Alpha2.jar:8.0.0.Alpha2]

    at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:189) [wildfly-controller-8.0.0.Alpha2.jar:8.0.0.Alpha2]

    at java.lang.Thread.run(Thread.java:722) [rt.jar:1.7.0_17]

Caused by: javax.xml.stream.XMLStreamException: ParseError at [row,col]:[1217,60]

Message: Unexpected element '{urn:jboss:domain:security-manager:1.0}subsystem'

    at org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:108) [staxmapper-1.1.0.Final.jar:1.1.0.Final]

    at org.jboss.staxmapper.XMLExtendedStreamReaderImpl.handleAny(XMLExtendedStreamReaderImpl.java:69) [staxmapper-1.1.0.Final.jar:1.1.0.Final]

    at org.jboss.as.server.parsing.StandaloneXml.parseServerProfile(StandaloneXml.java:1040) [wildfly-server-8.0.0.Alpha2.jar:8.0.0.Alpha2]

    at org.jboss.as.server.parsing.StandaloneXml.readServerElement_1_4(StandaloneXml.java:455) [wildfly-server-8.0.0.Alpha2.jar:8.0.0.Alpha2]

    at org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:141) [wildfly-server-8.0.0.Alpha2.jar:8.0.0.Alpha2]

    at org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:103) [wildfly-server-8.0.0.Alpha2.jar:8.0.0.Alpha2]

    at org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:110) [staxmapper-1.1.0.Final.jar:1.1.0.Final]

    at org.jboss.staxmapper.XMLMapperImpl.parseDocument(XMLMapperImpl.java:69) [staxmapper-1.1.0.Final.jar:1.1.0.Final]

    at org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:104) [wildfly-controller-8.0.0.Alpha2.jar:8.0.0.Alpha2]

[jaikiran]

Please attach that configuration xml.