Red Hat Summit이 콘텐츠는 선택한 언어로 제공되지 않습니다.
14.3. Writing Security Policy for JBoss Enterprise Application Platform
The included file
jboss-as/bin/server.policy.cert is an example security policy for JBoss Enterprise Application Platform. You can use this file as the basis for your own security policy.
The
policytool application, included with the JDK, provides a graphical tool for editing and writing security policy.
Important
Carefully consider what permissions you grant. Be particularly cautious about granting
java.security.AllPermission : you can potentially allow changes to the system binary, including the JVM runtime environment.
For a general treatment of security policy files and Java permissions refer to the official Java documentation at http://docs.oracle.com/javase/6/docs/technotes/guides/security/PolicyFiles.html . JBoss-specific
java.lang.RuntimePermissions are described below.
JBoss-specific Runtime Permissions
org.jboss.security.SecurityAssociation.getPrincipalInfo- Provides access to the
org.jboss.security.SecurityAssociation getPrincipal()andgetCredential()methods. The risk involved with using this runtime permission is the ability to see the current thread caller and credentials. org.jboss.security.SecurityAssociation.getSubject- Provides access to the
org.jboss.security.SecurityAssociation getSubject()method. org.jboss.security.SecurityAssociation.setPrincipalInfo- Provides access to the
org.jboss.security.SecurityAssociation setPrincipal(),setCredential(),setSubject(),pushSubjectContext(), andpopSubjectContext()methods. The risk involved with using this runtime permission is the ability to set the current thread caller and credentials. org.jboss.security.SecurityAssociation.setServer- Provides access to the
org.jboss.security.SecurityAssociation setServermethod. The risk involved with using this runtime permission is the ability to enable or disable multi-thread storage of the caller principal and credential. org.jboss.security.SecurityAssociation.setRunAsRole- Provides access to the
org.jboss.security.SecurityAssociation pushRunAsRoleandpopRunAsRole,pushRunAsIdentityandpopRunAsIdentitymethods. The risk involved with using this runtime permission is the ability to change the current caller run-as role principal. org.jboss.security.SecurityAssociation.accessContextInfo- Provides access to the
org.jboss.security.SecurityAssociation accessContextInfo, "Get"andaccessContextInfo, "Set"methods, allowing you to both set and get the current security context info. org.jboss.naming.JndiPermission- Provides special permissions to files and directories in a specified JNDI tree path, or recursively to all files and subdirectories. A JndiPermission consists of a pathname and a set of valid permissions related to the file or directory.The available permissions include:
bind,rebind,unbind,lookup,list,listBindings,createSubcontext, andall.Pathnames ending in/*indicate the specified permissions apply to all files and directories of the pathname. Pathnames ending in/-indicate recursive permissions to all files and subdirectories of the pathname. Pathnames consisting of the special token<<ALL BINDINGS>>matches any file in any directory. org.jboss.security.srp.SRPPermission- A custom permission class for protecting access to sensitive SRP information like the private session key and private key. This permission does not have any actions defined. The getSessionKey target provides access to the private session key resulting from the SRP negotiation. Access to this key will allow you to encrypt and decrypt messages that have been encrypted with the session key.
org.hibernate.secure.HibernatePermission- This permission class provides basic permissions to secure Hibernate sessions. The target for this property is the entity name. The available actions include: insert , delete , update , read , * (all).
org.jboss.metadata.spi.stack.MetaDataStackPermission- Provides a custom permission class for controlling how callers interact with the metadata stack. The available permissions are:
modify(push/pop onto the stack),peek(peek onto the stack), and*(all). org.jboss.config.spi.ConfigurationPermission- Secures setting of configuration properties. Defines only permission target names, and no actions. The targets for this property include: <property name> - property which code has permission to set; * - all properties.
org.jboss.kernel.KernelPermission- Secures access to the kernel configuration. Defines only permission target names and no actions. The targets for this property include: access - access the kernel configuration; configure - configure the kernel (access is implied); * - all of the above.
org.jboss.kernel.plugins.util.KernelLocatorPermission- Secures access to the kernel. Defines only permission target names and no actions. The targets for this property include: kernel - access the kernel; * - access all areas.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}