Question

我们运行一个spring-boot应用程序，它将在/ tmp文件夹中动态下载一些jar，并在这些jar中执行一些功能。

现在，我们已启用java.security.manager并在security.policy文件中提供了以下策略。

下面是security.policy文件中指定的策略

// These permissions apply to javac
grant codeBase "file:${java.home}/lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions
grant codeBase "file:${java.home}/jre/lib/ext/-" {
        permission java.security.AllPermission;
};

// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/../lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions when
// ${java.home} points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/lib/ext/-" {
        permission java.security.AllPermission;
};

// aml jar permission
grant codeBase "file:/app.jar"{
        permission java.security.AllPermission;
};

grant codeBase "file:/tmp/-"{
           permission java.io.FilePermission "/tmp/*", "read,write";
           permission java.lang.RunTimePermission "createClassLoader";
           permission java.lang.RunTimePermission "getClassLoader";
           permission java.lang.RunTimePermission "setContextClassLoader";
           permission java.lang.RunTimePermission "enableContextClassLoaderOverride";
           permission java.lang.RunTimePermission "createSecurityManager";
           permission java.lang.RunTimePermission "setSecurityManager";
               permission java.lang.RunTimePermission "getProtectionDomain";
               permission java.lang.RunTimePermission "readFileDescriptor";
               permission java.lang.RunTimePermission "writeFileDescriptor";
               permission java.lang.RunTimePermission "loadLibrary.libraryName";
               permission java.lang.RunTimePermission "setFactory";
               permission java.lang.RunTimePermission "setIO";
               permission java.lang.RunTimePermission "loadLibrary.*";
};


// ========== WEB APPLICATION PERMISSIONS =====================================


// These permissions are granted by default to all web applications
// In addition, a web application will be given a read FilePermission
// and JndiPermission for all files and directories in its document root.
grant {
    // Required for JNDI lookup of named JDBC DataSource's and
    // javamail named MimePart DataSource used to send mail
    permission java.util.PropertyPermission "java.home", "read";
    permission java.util.PropertyPermission "java.naming.*", "read";
    permission java.util.PropertyPermission "javax.sql.*", "read";

    // OS Specific properties to allow read access
    permission java.util.PropertyPermission "os.name", "read";
    permission java.util.PropertyPermission "os.version", "read";
    permission java.util.PropertyPermission "os.arch", "read";
    permission java.util.PropertyPermission "file.separator", "read";
    permission java.util.PropertyPermission "path.separator", "read";
    permission java.util.PropertyPermission "line.separator", "read";

    // JVM properties to allow read access
    permission java.util.PropertyPermission "java.version", "read";
    permission java.util.PropertyPermission "java.vendor", "read";
    permission java.util.PropertyPermission "java.vendor.url", "read";
    permission java.util.PropertyPermission "java.class.version", "read";
    permission java.util.PropertyPermission "java.specification.version", "read";
    permission java.util.PropertyPermission "java.specification.vendor", "read";
    permission java.util.PropertyPermission "java.specification.name", "read";

    permission java.util.PropertyPermission "java.vm.specification.version", "read";
    permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
    permission java.util.PropertyPermission "java.vm.specification.name", "read";
    permission java.util.PropertyPermission "java.vm.version", "read";
    permission java.util.PropertyPermission "java.vm.vendor", "read";
    permission java.util.PropertyPermission "java.vm.name", "read";


};

和一些jar在内部将另一个jar加载到/ tmp文件夹中。有了这些政策，我们将无法加载这些罐子。

有人可以帮助我们

Answer 1

我认为这可能对您有帮助...

https://www.ibm.com/support/knowledgecenter/en/SSEQTP_9.0.0/com.ibm.websphere.base.doc/ae/rsec_javapolicy.html

java.security.AccessControlException：访问被拒绝（java.io.FilePermission C：\ WebSphere \ AppServer \ java \ jre \ lib \ ext \ mail.jar读取）

未在启用了java.security.manager的情况下加载jar

1 个答案: