Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
4653b12
commit 8f64dc2
Showing
60 changed files
with
12,032 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,33 @@ | ||
/target/ | ||
!.mvn/wrapper/maven-wrapper.jar | ||
|
||
### STS ### | ||
.apt_generated | ||
.classpath | ||
.factorypath | ||
.project | ||
.settings | ||
.springBeans | ||
.sts4-cache | ||
|
||
### IntelliJ IDEA ### | ||
.idea | ||
*.iws | ||
*.iml | ||
*.ipr | ||
|
||
### NetBeans ### | ||
/nbproject/private/ | ||
/build/ | ||
/nbbuild/ | ||
/dist/ | ||
/nbdist/ | ||
/.nb-gradle/ | ||
|
||
*.class | ||
|
||
# Emacs | ||
*~ | ||
/.metadata/ | ||
|
||
/.metadata/ |
257 changes: 257 additions & 0 deletions
257
Servers/Pivotal tc Server Developer Edition v4.0-config/catalina.policy
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,257 @@ | ||
// Licensed to the Apache Software Foundation (ASF) under one or more | ||
// contributor license agreements. See the NOTICE file distributed with | ||
// this work for additional information regarding copyright ownership. | ||
// The ASF licenses this file to You under the Apache License, Version 2.0 | ||
// (the "License"); you may not use this file except in compliance with | ||
// the License. You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
// ============================================================================ | ||
// catalina.policy - Security Policy Permissions for tc Server Runtime 8.0 | ||
// | ||
// This file contains a default set of security policies to be enforced (by the | ||
// JVM) when Catalina is executed with the "-security" option. In addition | ||
// to the permissions granted here, the following additional permissions are | ||
// granted to each web application: | ||
// | ||
// * Read access to its document root directory | ||
// * Read, write and delete access to its working directory | ||
// ============================================================================ | ||
|
||
|
||
// ========== SYSTEM CODE PERMISSIONS ========================================= | ||
|
||
|
||
// These permissions apply to javac | ||
grant codeBase "file:${java.home}/lib/-" { | ||
permission java.security.AllPermission; | ||
}; | ||
|
||
// These permissions apply to all shared system extensions | ||
grant codeBase "file:${java.home}/jre/lib/ext/-" { | ||
permission java.security.AllPermission; | ||
}; | ||
|
||
// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre | ||
grant codeBase "file:${java.home}/../lib/-" { | ||
permission java.security.AllPermission; | ||
}; | ||
|
||
// These permissions apply to all shared system extensions when | ||
// ${java.home} points at $JAVA_HOME/jre | ||
grant codeBase "file:${java.home}/lib/ext/-" { | ||
permission java.security.AllPermission; | ||
}; | ||
|
||
// ========== tc Server Service Wrapper Permissions =========================== | ||
|
||
grant codeBase "file:${catalina.base}/bin/winx86_64/-" { | ||
permission java.security.AllPermission; | ||
}; | ||
grant codeBase "file:${catalina.base}/bin/win32/-" { | ||
permission java.security.AllPermission; | ||
}; | ||
|
||
// ========== CATALINA CODE PERMISSIONS ======================================= | ||
|
||
|
||
// These permissions apply to the daemon code | ||
grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { | ||
permission java.security.AllPermission; | ||
}; | ||
|
||
// These permissions apply to the logging API | ||
// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home}, | ||
// update this section accordingly. | ||
// grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..} | ||
grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { | ||
permission java.io.FilePermission | ||
"${java.home}${file.separator}lib${file.separator}logging.properties", "read"; | ||
|
||
permission java.io.FilePermission | ||
"${catalina.base}${file.separator}conf${file.separator}logging.properties", "read"; | ||
permission java.io.FilePermission | ||
"${catalina.base}${file.separator}logs", "read, write"; | ||
permission java.io.FilePermission | ||
"${catalina.base}${file.separator}logs${file.separator}*", "read, write"; | ||
|
||
permission java.lang.RuntimePermission "shutdownHooks"; | ||
permission java.lang.RuntimePermission "getClassLoader"; | ||
permission java.lang.RuntimePermission "setContextClassLoader"; | ||
|
||
permission java.lang.management.ManagementPermission "monitor"; | ||
|
||
permission java.util.logging.LoggingPermission "control"; | ||
|
||
permission java.util.PropertyPermission "java.util.logging.config.class", "read"; | ||
permission java.util.PropertyPermission "java.util.logging.config.file", "read"; | ||
permission java.util.PropertyPermission "org.apache.juli.AsyncLoggerPollInterval", "read"; | ||
permission java.util.PropertyPermission "org.apache.juli.AsyncMaxRecordCount", "read"; | ||
permission java.util.PropertyPermission "org.apache.juli.AsyncOverflowDropType", "read"; | ||
permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read"; | ||
permission java.util.PropertyPermission "catalina.base", "read"; | ||
|
||
// tc Server specific permissions | ||
permission java.util.PropertyPermission "com.springsource.tcserver.serviceability.logging.jmxdelay", "read"; | ||
permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; | ||
permission javax.management.MBeanServerPermission "createMBeanServer"; | ||
permission javax.management.MBeanPermission "com.springsource.tcserver.serviceability.logging.TcServerLogManager#-[tcServer:name=LoggingManager,type=Serviceability]", "registerMBean"; | ||
permission javax.management.MBeanTrustPermission "register"; | ||
|
||
// Note: To enable per context logging configuration, permit read access to | ||
// the appropriate file. Be sure that the logging configuration is | ||
// secure before enabling such access. | ||
// E.g. for the examples web application (uncomment and unwrap | ||
// the following to be on a single line): | ||
// permission java.io.FilePermission "${catalina.base}${file.separator} | ||
// webapps${file.separator}examples${file.separator}WEB-INF | ||
// ${file.separator}classes${file.separator}logging.properties", "read"; | ||
}; | ||
|
||
// These permissions apply to the server startup code | ||
grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { | ||
permission java.security.AllPermission; | ||
}; | ||
|
||
// These permissions apply to the servlet API classes | ||
// and those that are shared across all class loaders | ||
// located in the "lib" directory | ||
grant codeBase "file:${catalina.home}/lib/-" { | ||
permission java.security.AllPermission; | ||
}; | ||
|
||
|
||
// If using a per instance lib directory, i.e. ${catalina.base}/lib, | ||
// then the following permission will need to be uncommented | ||
// grant codeBase "file:${catalina.base}/lib/-" { | ||
// permission java.security.AllPermission; | ||
// }; | ||
|
||
|
||
// ========== WEB APPLICATION PERMISSIONS ===================================== | ||
|
||
|
||
// These permissions are granted by default to all web applications | ||
// In addition, a web application will be given a read FilePermission | ||
// for all files and directories in its document root. | ||
grant { | ||
// Required for JNDI lookup of named JDBC DataSource's and | ||
// javamail named MimePart DataSource used to send mail | ||
permission java.util.PropertyPermission "java.home", "read"; | ||
permission java.util.PropertyPermission "java.naming.*", "read"; | ||
permission java.util.PropertyPermission "javax.sql.*", "read"; | ||
|
||
// OS Specific properties to allow read access | ||
permission java.util.PropertyPermission "os.name", "read"; | ||
permission java.util.PropertyPermission "os.version", "read"; | ||
permission java.util.PropertyPermission "os.arch", "read"; | ||
permission java.util.PropertyPermission "file.separator", "read"; | ||
permission java.util.PropertyPermission "path.separator", "read"; | ||
permission java.util.PropertyPermission "line.separator", "read"; | ||
|
||
// JVM properties to allow read access | ||
permission java.util.PropertyPermission "java.version", "read"; | ||
permission java.util.PropertyPermission "java.vendor", "read"; | ||
permission java.util.PropertyPermission "java.vendor.url", "read"; | ||
permission java.util.PropertyPermission "java.class.version", "read"; | ||
permission java.util.PropertyPermission "java.specification.version", "read"; | ||
permission java.util.PropertyPermission "java.specification.vendor", "read"; | ||
permission java.util.PropertyPermission "java.specification.name", "read"; | ||
|
||
permission java.util.PropertyPermission "java.vm.specification.version", "read"; | ||
permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; | ||
permission java.util.PropertyPermission "java.vm.specification.name", "read"; | ||
permission java.util.PropertyPermission "java.vm.version", "read"; | ||
permission java.util.PropertyPermission "java.vm.vendor", "read"; | ||
permission java.util.PropertyPermission "java.vm.name", "read"; | ||
|
||
// Required for OpenJMX | ||
permission java.lang.RuntimePermission "getAttribute"; | ||
|
||
// Allow read of JAXP compliant XML parser debug | ||
permission java.util.PropertyPermission "jaxp.debug", "read"; | ||
|
||
// All JSPs need to be able to read this package | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat"; | ||
|
||
// Precompiled JSPs need access to these packages. | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el"; | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime"; | ||
permission java.lang.RuntimePermission | ||
"accessClassInPackage.org.apache.jasper.runtime.*"; | ||
|
||
// Precompiled JSPs need access to these system properties. | ||
permission java.util.PropertyPermission | ||
"org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read"; | ||
permission java.util.PropertyPermission | ||
"org.apache.el.parser.COERCE_TO_ZERO", "read"; | ||
|
||
// The cookie code needs these. | ||
permission java.util.PropertyPermission | ||
"org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read"; | ||
permission java.util.PropertyPermission | ||
"org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read"; | ||
permission java.util.PropertyPermission | ||
"org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read"; | ||
|
||
// Applications using Comet need to be able to access this package | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.comet"; | ||
|
||
// Applications using WebSocket need to be able to access these packages | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket"; | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server"; | ||
}; | ||
|
||
|
||
// The Manager application needs access to the following packages to support the | ||
// session display functionality | ||
// Note: If the manager web application used by this instance is located outside | ||
// of the webapps directory then the codeBase in the grant below will need | ||
// to be updated accordingly | ||
grant codeBase "file:${catalina.base}/webapps/manager/-" { | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina"; | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session"; | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager"; | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util"; | ||
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util"; | ||
}; | ||
|
||
// You can assign additional permissions to particular web applications by | ||
// adding additional "grant" entries here, based on the code base for that | ||
// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. | ||
// | ||
// Different permissions can be granted to JSP pages, classes loaded from | ||
// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/ | ||
// directory, or even to individual jar files in the /WEB-INF/lib/ directory. | ||
// | ||
// For instance, assume that the standard "examples" application | ||
// included a JDBC driver that needed to establish a network connection to the | ||
// corresponding database and used the scrape taglib to get the weather from | ||
// the NOAA web server. You might create a "grant" entries like this: | ||
// | ||
// The permissions granted to the context root directory apply to JSP pages. | ||
// grant codeBase "file:${catalina.base}/webapps/examples/-" { | ||
// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; | ||
// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; | ||
// }; | ||
// | ||
// The permissions granted to the context WEB-INF/classes directory | ||
// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" { | ||
// }; | ||
// | ||
// The permission granted to your JDBC driver | ||
// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" { | ||
// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; | ||
// }; | ||
// The permission granted to the scrape taglib | ||
// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { | ||
// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; | ||
// }; | ||
|
Oops, something went wrong.