AccessControlException when running embedded Tomcat from Java Webstart

Question

For our Kunagi Java web application, we have a signed kunagi.jar file that contains our classes along with classes from the built-in Tomcat 6. This works fine when java -jar kunagi.jar .

But when starting from Java WebStart, I get an exception, while the built-in Tomcat starts up:

 java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.deploy) at java.security.AccessControlContext.checkPermission(AccessControlContext.java:393) at java.security.AccessController.checkPermission(AccessController.java:553) at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1529) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:291) at java.lang.ClassLoader.loadClass(ClassLoader.java:266) at net.sourceforge.jnlp.runtime.JNLPClassLoader.loadClass(JNLPClassLoader.java:1018) at java.lang.Class.getDeclaredMethods0(Native Method) at java.lang.Class.privateGetDeclaredMethods(Class.java:2444) at java.lang.Class.getMethod0(Class.java:2687) at java.lang.Class.getMethod(Class.java:1620) at org.apache.catalina.startup.SetPublicIdRule.begin(WebRuleSet.java:639) at org.apache.tomcat.util.digester.Digester.startElement(Digester.java:1276) ... 33 more 

Of course kunagi.jar signed, otherwise it will not even start. It seams Java WebStart allows Java Security globally, which somehow embedded Tomcat “inherits” and cannot be initialized.

Here is the JNLP file:

 <?xml version="1.0" encoding="UTF-8"?> <jnlp spec="1.0+" codebase="http://kunagi.org/webstart" href="kunagi.jnlp"> <information> <title>Kunagi</title> <vendor>Kunagi Team</vendor> <homepage href="http://kunagi.org"/> <description>SCRUM Tool</description> <description kind="short">SCRUM Tool</description> <offline-allowed/> </information> <security> <all-permissions/> </security> <resources> <j2se version="1.6+" href="http://java.sun.com/products/autodl/j2se"/> <jar href="kunagi.jar" main="true" /> </resources> <application-desc name="Kunagi" main-class="katokorbo.Katokorbo"/> <update check="always"/> </jnlp> 

Is there a way to disable security checks for Tomcat inside Java WebStart? Or how can I configure embedded Tomcat to allow access to org.apache.catalina... ?

Answer 1

I solved my problem as follows:

Disable Security Manager after WebStart has launched my application. The first line in my main() method:

 System.setSecurityManager(null); 

Tell Tomcat to use the default class loader:

 context.setLoader(new WebappLoader(getClass().getClassLoader())); 

Now Tomcat is working on WebStart: -D

Answer 2

Tomcat implements Security Manager access rules in different places. The corresponding policy definitions are in the tomcat / conf / catalina.policy file.

This will not be an error in Tomcat if a) the security manager is enabled, and b) the policy file is not applied.

Of course, Tomcat contains code in various packages, and, of course, it would be normal to use classes from these packages.

UPDATE. I have no problem running the JNLP application in my sandbox. Tomcat starts up successfully, with a few exceptions that are not related to the one you are describing. I would try to delete all previously downloaded files and try to remove any certificates from your cache.

I also suggest updating to the latest version of Tomcat 6.0.

Answer 3

@Witek: Tomcat does not include SecurityManager: The JVM must be started with SecurityManager enabled and the policy file in place. Tomcat starts long after the SecurityManager is in place.

Answer 4

The solution would be to digitally sign jars that request authorization requiring trust. Anything that is unsigned and does not require trust will need to be moved to the JNLP extension.

Answer 5

Tomcat seems to have used its permissions to change global state (here is the package.access security property). Signed banks can run in processes shared by an untrusted code. You really do not want to mix two more than necessary. Therefore, it does not seem that the Tomcat in which it is used is suitable for WebStart.

(The Oracle JRE has a security audit tracking feature - -Djava.security.debug=all , IIRC).

Answer 6

java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.deploy)

Whenever you get an AccessControlException , the part in brackets is the permission that you need to grant in your .policy file or, as you use JWS, in the deployment descriptor.

Answer 7

To be fair, this seems like a bug in Tomcat, and you should probably report it. It should not try to get class methods in another package, since this will always work under security control.

As long as the error can be fixed, can't you avoid calling " WebRuleSet "? I don’t know what it really is, but it looks like it will be called due to your Tomcat configuration. This is not something that you can remove from the config?

Answer 8

You can edit the policy file. for example, if you have a security problem when deploying admin war, you will have to edit the catalina.policy file located in the tomcat conf directory to have a low input, as shown below, to solve this problem.

 grant codeBase "file:${catalina.base}/webapps/admin/-" { permission java.security.AllPermission; };