3 Replies Latest reply on May 24, 2018 2:17 AM by anand.babu1

Unexpected permission check failure (permission ... in code source "(null <no signer certificates>)" of ... )

adrian.boangiu Dec 5, 2016 10:48 AM

We have an application that is running successfully under the Security Manager and I am trying to deploy an open source application (bimserver.war, BIMServer from http://bimserver.org/) together with our application as we are currently trying to integrate BIM functionalities in our application.

I get the following security error:

09:55:21,083 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) org.bimserver.shared.exceptions.PluginException: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.util.PropertyPermission" "sun.arch.data.model" "read")" in code source "(null <no signer certificates>)" of "org.bimserver.plugins.classloaders.FileJarClassLoader@512df629")

09:55:21,083 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.ifcopenshell.IfcOpenShellEnginePlugin.init(IfcOpenShellEnginePlugin.java:119)

09:55:21,083 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.plugins.PluginManager.loadPlugin(PluginManager.java:1325)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.plugins.PluginManager.install(PluginManager.java:1425)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.database.actions.InstallPluginBundle.execute(InstallPluginBundle.java:44)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.database.actions.InstallPluginBundle.execute(InstallPluginBundle.java:18)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.database.DatabaseSession.executeAndCommitAction(DatabaseSession.java:698)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.database.DatabaseSession.executeAndCommitAction(DatabaseSession.java:690)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.webservices.impl.PluginServiceImpl.installPluginBundle(PluginServiceImpl.java:1453)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.generated.PluginInterfaceReflector1.callMethod(PluginInterfaceReflector1.java)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.shared.meta.SMethod.invoke(SMethod.java:213)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.JsonHandler.processSingleRequest(JsonHandler.java:137)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.JsonHandler.execute(JsonHandler.java:60)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.servlets.JsonApiServlet.service(JsonApiServlet.java:70)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.bimserver.servlets.RootServlet.service(RootServlet.java:136)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.websockets.jsr.JsrWebSocketFilter.doFilter(JsrWebSocketFilter.java:130)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

09:55:21,099 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.api.LegacyThreadSetupActionWrapper$1.call(LegacyThreadSetupActionWrapper.java:44)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletInitialHandler$1$1.run(ServletInitialHandler.java:110)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at java.security.AccessController.doPrivileged(Native Method)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:107)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:805)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at java.lang.Thread.run(Thread.java:745)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) Caused by: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.util.PropertyPermission" "sun.arch.data.model" "read")" in code source "(null <no signer certificates>)" of "org.bimserver.plugins.classloaders.FileJarClassLoader@512df629")

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:273)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.wildfly.security.manager.WildFlySecurityManager.checkPropertyAccess(WildFlySecurityManager.java:496)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at java.lang.System.getProperty(System.java:717)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) at org.ifcopenshell.IfcOpenShellEnginePlugin.init(IfcOpenShellEnginePlugin.java:83)

09:55:21,115 ERROR [stderr] (org.bimserver.PluginInterface.installPluginBundle) ... 58 more

although I have given java.security.AllPermission via permissions.xml to bimserver.war and to individual jars contained in bimserver.war that I could find on the stack, via jboss-permissions.xml. Additionally, the minimum-set of deployment-permissions in standalone.xml contains

Why I cannot get the code source that fails the security check? I usually get the name of the jar failing the security check and not "(null <no signer certificates>)".

Is there something I can do to fix this error?

Thank you in advance for your help.

1. Re: Unexpected permission check failure (permission ... in code source "(null <no signer certificates>)" of ... )

dmlloyd Dec 5, 2016 11:34 AM (in response to adrian.boangiu)

It looks like the "org.bimserver" code is creating a custom class loader, but that class loader is not defining or inheriting any protection domain from the deployment. Furthermore, the code has no code source, meaning it is impossible to define permissions for it.

I'd file a bug with the owners of that code (FileJarClassLoader) because they need to establish the protection domain of the custom code somehow in order for the security manager to be able to secure it.
Actions
2. Re: Unexpected permission check failure (permission ... in code source "(null <no signer certificates>)" of ... )

anand.babu1 May 21, 2018 2:35 AM (in response to dmlloyd)

Hi David,

We are creating a custom classloader as well in our deployment.

As you said, the custom classloader should define or inherit protection domain from deployment.

Do you have documentation or further input on how to do that?

It will be very helpful in proceeding further.

Thanks in Advance,
Anand
Actions
3. Re: Unexpected permission check failure (permission ... in code source "(null <no signer certificates>)" of ... )

anand.babu1 May 24, 2018 2:17 AM (in response to anand.babu1)

Hi David

We are able to find the solution.

Our custom class loader was extending URLClassLoader. Our custom class loader class is being created by JBOSS ModuleClassLoader and so we were able to access ModuleClassLoader using Thread.currentThread().getContextClassLoader();
ModuleClassLoader has getModule() method and Module has getPermissionCollection method and this returns the modules' configured permissions.
URLClassLoader has getPermission method. We override this method and return module's permission.
Now we are able to deploy our application and classes loaded by custom class loader has required permission.

One disadvantage with this approach is our application is now tightly coupled with JBOSS and not easily portable to other EE servers.
Is their a better approach?

Thanks
Anand
Actions

Go to original post