安全問題在tomcat6上運行jruby

我通過一個鶯形戰爭部署了一個jruby/rails應用程序到tomcat6。系統是Ubuntu 8，運行tomcat6。當我嘗試啓動應用程序時，我得到以下堆棧跟蹤安全問題在tomcat6上運行jruby

Sep 13, 2010 7:57:24 PM org.apache.catalina.core.ApplicationContext log 
    SEVERE: Application Error 
    java.security.AccessControlException: access denied (java.util.PropertyPermissio 
    n jruby.management.enabled read) 
     at java.security.AccessControlContext.checkPermission(AccessControlContext.java:342) 
     at java.security.AccessController.checkPermission(AccessController.java:553) 
     at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) 
     at java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1302) 
     at java.lang.System.getProperty(System.java:669) 
     at org.jruby.rack.DefaultRackApplicationFactory.setupJRubyManagement(DefaultRackApplicationFactory.java:94) 
     at org.jruby.rack.DefaultRackApplicationFactory.newRuntime(DefaultRackApplicationFactory.java:78) 
     at org.jruby.rack.DefaultRackApplicationFactory.createApplication(DefaultRackApplicationFactory.java:177) 
     at org.jruby.rack.DefaultRackApplicationFactory.newApplication(DefaultRackApplicationFactory.java:50) 
     at org.jruby.rack.DefaultRackApplicationFactory.getApplication(DefaultRackApplicationFactory.java:58) 
     at org.jruby.rack.PoolingRackApplicationFactory.getApplication(PoolingRackApplicationFactory.java:94) 
     at org.jruby.rack.servlet.DefaultServletDispatcher.process(DefaultServletDispatcher.java:36) 
     at org.jruby.rack.RackFilter.doFilter(RackFilter.java:59) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
     at java.lang.reflect.Method.invoke(Method.java:616) 
     at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:244) 
     at java.security.AccessController.doPrivileged(Native Method) 
     at javax.security.auth.Subject.doAsPrivileged(Subject.java:537) 
     at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:276) 
     at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:218) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230) 
     at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:56) 
     at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:189) 
     at java.security.AccessController.doPrivileged(Native Method) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:185) 
     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) 
     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) 
     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) 
     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) 
     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) 
     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) 
     at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845) 
     at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583) 
     at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447) 
     at java.lang.Thread.run(Thread.java:636)

tomcat通過aptitude安裝，並且處於默認配置。默認的tomcat應用程序工作正常。日誌文件被填充。

是什麼給出的？

編輯：尼克是正確的，尋找政策信息披露以下內容（這裏記錄下一個陣子誰擁有相同的愚蠢的問題）：

有一組策略配置文件在（默認安裝）下/var/lib/tomcat6/conf/policy.d。你的車是04webapps.policy。編輯它以添加jruby需要的權限。在我的情況下，他們是

// Required for jRuby 
permission java.util.PropertyPermission "jruby.*", "read"; 
permission java.util.PropertyPermission "jruby.*", "write"; 
permission java.util.PropertyPermission "java.io.tmpdir", "read"; 
permission java.util.PropertyPermission "*", "read"; 
permission java.util.PropertyPermission "*", "write"; 
permission java.lang.RuntimePermission "getClassLoader"; 
permission java.lang.RuntimePermission "getProtectionDomain"; 
permission java.lang.RuntimePermission "createClassLoader"; 
permission java.lang.RuntimePermission "getenv.*"; 
permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; 
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.coyote";

來源

2010-09-14 kolosy

您是否通過蠻力耗盡創建了該權限列表？ – 2010-09-14 15:14:54

是。被認爲只是給予所有，但那並不適合我。 – kolosy 2010-09-14 18:19:31

Tomcat在Ubuntu上的默認配置必須使用安全管理器。查看-Djava.security.manager=FILE.policy選項的配置文件，如果不需要，請將其刪除。

否則，你就必須放鬆安全策略，可能添加一節類似

grant codeBase "file:/var/lib/tomcat5.5/-" { 
    permission java.security.AllPermission; 
}

在 -Djava.security.manager參數上面提到的安全策略

。

來源

2010-09-14 01:55:25

安全問題在tomcat6上運行jruby

回答

相關問題