Tomcat 6 --- 你很少使用的安全管理SecurityManager

试想一下，如果你的JSP页面中包含一句代码“System.exit(1);”，你的web应用访问到该JSP时，会发生什么？

一般使用tomcat可能都没有注意到这个问题，本篇主要讲述tomcat 6中SecurityManager的管理机制，尽量使用简单明了的图片表示其中关系。

其他知识参考tomcat文档翻译。如有错误，请予指正。

// default permissions granted to all domains grant {  // Allows any thread to stop itself using the java.lang.Thread.stop()  // method that takes no argument.  // Note that this permission is granted by default only to remain  // backwards compatible.  // It is strongly recommended that you either remove this permission  // from this policy file or further restrict it to code sources  // that you specify, because Thread.stop() is potentially unsafe.  // See the API specification of java.lang.Thread.stop() for more  // information.  permission java.lang.RuntimePermission "stopThread";  // allows anyone to listen on dynamic ports  permission java.net.SocketPermission "localhost:0", "listen";  // "standard" properies that can be read by anyone  permission java.util.PropertyPermission "java.version", "read";  permission java.util.PropertyPermission "java.vendor", "read";  permission java.util.PropertyPermission "java.vendor.url", "read";  permission java.util.PropertyPermission "java.class.version", "read";  permission java.util.PropertyPermission "os.name", "read";  permission java.util.PropertyPermission "os.version", "read";  permission java.util.PropertyPermission "os.arch", "read";  permission java.util.PropertyPermission "file.separator", "read";  permission java.util.PropertyPermission "path.separator", "read";  permission java.util.PropertyPermission "line.separator", "read";  permission java.util.PropertyPermission "java.specification.version", "read";  permission java.util.PropertyPermission "java.specification.vendor", "read";  permission java.util.PropertyPermission "java.specification.name", "read";  permission java.util.PropertyPermission "java.vm.specification.version", "read";  permission java.util.PropertyPermission "java.vm.specification.vendor", "read";  permission java.util.PropertyPermission "java.vm.specification.name", "read";  permission java.util.PropertyPermission "java.vm.version", "read";  permission java.util.PropertyPermission "java.vm.vendor", "read";  permission java.util.PropertyPermission "java.vm.name", "read"; }; 

// Licensed to the Apache Software Foundation (ASF) under one or more // contributor license agreements.  See the NOTICE file distributed with // this work for additional information regarding copyright ownership. // The ASF licenses this file to You under the Apache License, Version 2.0 // (the "License"); you may not use this file except in compliance with // the License.  You may obtain a copy of the License at // //  http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. // ============================================================================ // catalina.policy - Security Policy Permissions for Tomcat 6 // // This file contains a default set of security policies to be enforced (by the // JVM) when Catalina is executed with the "-security" option.  In addition // to the permissions granted here, the following additional permissions are // granted to the codebase specific to each web application: // // * Read access to its document root directory // * Read, write and delete access to its working directory // ============================================================================ // ========== SYSTEM CODE PERMISSIONS ========================================= // These permissions apply to javac grant codeBase "file:${java.home}/lib/-" {   permission java.security.AllPermission; }; // These permissions apply to all shared system extensions grant codeBase "file:${java.home}/jre/lib/ext/-" {   permission java.security.AllPermission; }; // These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre grant codeBase "file:${java.home}/../lib/-" {   permission java.security.AllPermission; }; // These permissions apply to all shared system extensions when // ${java.home} points at $JAVA_HOME/jre grant codeBase "file:${java.home}/lib/ext/-" {   permission java.security.AllPermission; }; // ========== CATALINA CODE PERMISSIONS ======================================= // These permissions apply to the daemon code grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {   permission java.security.AllPermission; }; // These permissions apply to the logging API // Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home}, // update this section accordingly. //  grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..} grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {   permission java.io.FilePermission    "${java.home}${file.separator}lib${file.separator}logging.properties", "read";    permission java.io.FilePermission    "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";   permission java.io.FilePermission    "${catalina.base}${file.separator}logs", "read, write";   permission java.io.FilePermission    "${catalina.base}${file.separator}logs${file.separator}*", "read, write";   permission java.lang.RuntimePermission "shutdownHooks";   permission java.lang.RuntimePermission "getClassLoader";   permission java.lang.RuntimePermission "setContextClassLoader";   permission java.util.logging.LoggingPermission "control";   permission java.util.PropertyPermission "java.util.logging.config.class", "read";   permission java.util.PropertyPermission "java.util.logging.config.file", "read";   permission java.util.PropertyPermission "catalina.base", "read";   // Note: To enable per context logging configuration, permit read access to   // the appropriate file. Be sure that the logging configuration is   // secure before enabling such access.   // E.g. for the examples web application (uncomment and unwrap   // the following to be on a single line):   // permission java.io.FilePermission "${catalina.base}${file.separator}   //  webapps${file.separator}examples${file.separator}WEB-INF   //  ${file.separator}classes${file.separator}logging.properties", "read"; }; // These permissions apply to the server startup code grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {   permission java.security.AllPermission; }; // These permissions apply to the servlet API classes // and those that are shared across all class loaders // located in the "lib" directory grant codeBase "file:${catalina.home}/lib/-" {   permission java.security.AllPermission; }; // If using a per instance lib directory, i.e. ${catalina.base}/lib, // then the following permission will need to be uncommented // grant codeBase "file:${catalina.base}/lib/-" { //   permission java.security.AllPermission; // }; // ========== WEB APPLICATION PERMISSIONS ===================================== // These permissions are granted by default to all web applications // In addition, a web application will be given a read FilePermission // and JndiPermission for all files and directories in its document root. grant {   // Required for JNDI lookup of named JDBC DataSource's and  // javamail named MimePart DataSource used to send mail  permission java.util.PropertyPermission "java.home", "read";  permission java.util.PropertyPermission "java.naming.*", "read";  permission java.util.PropertyPermission "javax.sql.*", "read";  // OS Specific properties to allow read access  permission java.util.PropertyPermission "os.name", "read";  permission java.util.PropertyPermission "os.version", "read";  permission java.util.PropertyPermission "os.arch", "read";  permission java.util.PropertyPermission "file.separator", "read";  permission java.util.PropertyPermission "path.separator", "read";  permission java.util.PropertyPermission "line.separator", "read";  // JVM properties to allow read access  permission java.util.PropertyPermission "java.version", "read";  permission java.util.PropertyPermission "java.vendor", "read";  permission java.util.PropertyPermission "java.vendor.url", "read";  permission java.util.PropertyPermission "java.class.version", "read";  permission java.util.PropertyPermission "java.specification.version", "read";  permission java.util.PropertyPermission "java.specification.vendor", "read";  permission java.util.PropertyPermission "java.specification.name", "read";  permission java.util.PropertyPermission "java.vm.specification.version", "read";  permission java.util.PropertyPermission "java.vm.specification.vendor", "read";  permission java.util.PropertyPermission "java.vm.specification.name", "read";  permission java.util.PropertyPermission "java.vm.version", "read";  permission java.util.PropertyPermission "java.vm.vendor", "read";  permission java.util.PropertyPermission "java.vm.name", "read";  // Required for OpenJMX  permission java.lang.RuntimePermission "getAttribute";  // Allow read of JAXP compliant XML parser debug  permission java.util.PropertyPermission "jaxp.debug", "read";  // Precompiled JSPs need access to these packages.  permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";  permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";  permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*";  // Precompiled JSPs need access to these system properties.  permission java.util.PropertyPermission   "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";  permission java.util.PropertyPermission "org.apache.el.parser.COERCE_TO_ZERO", "read"; }; // The Manager application needs access to the following packages to support the // session display functionality. These settings support the following // configurations: // - default CATALINA_HOME == CATALINA_BASE // - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE // - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME grant codeBase "file:${catalina.base}/webapps/manager/-" {  permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";  permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";  permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util"; }; grant codeBase "file:${catalina.home}/webapps/manager/-" {  permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";  permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";  permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util"; }; // You can assign additional permissions to particular web applications by // adding additional "grant" entries here, based on the code base for that // application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. // // Different permissions can be granted to JSP pages, classes loaded from // the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/ // directory, or even to individual jar files in the /WEB-INF/lib/ directory. // // For instance, assume that the standard "examples" application // included a JDBC driver that needed to establish a network connection to the // corresponding database and used the scrape taglib to get the weather from // the NOAA web server.  You might create a "grant" entries like this: // // The permissions granted to the context root directory apply to JSP pages. // grant codeBase "file:${catalina.base}/webapps/examples/-" { //   permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; //   permission java.net.SocketPermission "*.noaa.gov:80", "connect"; // }; // // The permissions granted to the context WEB-INF/classes directory // grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" { // }; // // The permission granted to your JDBC driver // grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" { //   permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; // }; // The permission granted to the scrape taglib // grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { //   permission java.net.SocketPermission "*.noaa.gov:80", "connect"; // }; 

<%@ page language="java" contentType="text/html; charset=utf-8"  import="java.net.*,java.io.*"  pageEncoding="utf-8"%> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>security Test</title> </head> <body>  <h1>security Test</h1>  <hr>  <%!  String txt2String(File file){   String result = "";   try{    BufferedReader br = new BufferedReader(new FileReader(file));//构造一个BufferedReader类来读取文件    String s = null;    while((s = br.readLine())!=null){//使用readLine方法，一次读一行     result = result + "/n" +s;    }    br.close();    }catch(Exception e){    e.printStackTrace();   }   return result;  }  %>  <%  //是否启用了security，如果没有启用会输入null。  System.out.println("SecurityManager: " + System.getSecurityManager());  File file = new File("C:/Users/Administrator/Desktop/test.txt");  //执行文件读操作,即java.io.FilePermission  System.out.println(txt2String(file));  //执行获取文件属性操作，即java.util.PropertyPermission  System.out.println(System.getProperty("file.encoding"));  %> </body> </html>