WildFly 17 secmgr Permissions

[davidrogers]

Hello,

I'm trying to setup WildFly 17 on Windows 10 to use the security manager without permission restrictions.  The plan is to allow all permissions initially, and then lock the system down later.

I have successfully enabled the security manager using -secmgr.  I have also set the permissions in the standalone.xml as follows:

<subsystem xmlns="urn:jboss:domain:security-manager:1.0">

     <deployment-permissions>

          <maximum-set>

               <permission class="java.security.AllPermission" />

          </maximum-set>

     </deployment-permissions>

</subsystem>

However, deployments are still failing with permission messages such as this:

java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.util.PropertyPermission" "user.dir" "read")" in code source "(vfs:/C:/path/to/my.war/WEB-INF/classes <no signer certificates>)" of "ModuleClassLoader for Module "deployment.my.war" from Service Module Loader")

Further, I have tried setting the minimum permissions as follows, with no change to the error messages:

<minimum-set>

     <permission class="java.util.PropertyPermission" name="*" actions="read,write" />

</minimum-set>

Why am I still seeing permission issues if everything is given java.security.AllPermission?

[davidrogers]

I was able to get around most of the issues by including the permissions.xml file with AllPermission into each of my wars.  However, one of my wars is still seeing the issue.  This particular war happens to be from a third party.  My best guess is that there are permissions being set somewhere within the war.  Besides the permissions.xml and the security-manager subsystem in the standalone.xml, are there other places that someone can define permissions?

[smarlow]

Are these standalone WAR deployments or are they contained in an EAR?  As for an EAR, the permissions.xml should be specified at EAR (META-INF/permissions.xml) level.

Regarding the issue with java.security.AllPermission not doing what you expect, I'm not sure why that it is happening.