Skip to main content


Eclipse Community Forums
Forum Search:

Search      Help    Register    Login    Home
Home » Eclipse Projects » Equinox » Java Security with Equinox OSGi(using custom java.policy with Equinox)
Java Security with Equinox OSGi [message #493560] Mon, 26 October 2009 22:10 Go to next message
Tom H is currently offline Tom HFriend
Messages: 18
Registered: July 2009
Junior Member
I am thinking about using standard java.policy in order to secure an OSGi application that can load custom java code.

My setup is like this:

custom java code is at <customDir>
OSGi fwk bundles are in <eclipse/plugins>

if custom java code from <customDir> starts using a socket or read write to arbitrary directory. I'd like to block it.

hence my java.policy file looks like:
grant codeBase "file:/<eclipse/plugins" {
java.security.AllPermissions;
}

Now the problem is that I have not granted any permission. So should the OSGi application loaded from the trusted loc <eclipse/plugins> will have limited permission when making calls to the custom java class from <customDir>?

I have tried some code that suggests otherwise.

Any pointer if java security is currently working correctly with equinox fwk?

Thanks,
Tom
Re: Java Security with Equinox OSGi [message #493754 is a reply to message #493560] Tue, 27 October 2009 20:23 Go to previous messageGo to next message
Bruce Kelly is currently offline Bruce KellyFriend
Messages: 63
Registered: July 2009
Member
Have you installed a SecurityManager via System.setSecurityManager() ?

My understanding is that a SecurityManager is automatically installed for
applets,
but for other applications you need to do it yourself.

Namaste, Bruce

<tomhsu@gmail.com> wrote in message news:hc56pe$653$1@build.eclipse.org...
>I am thinking about using standard java.policy in order to secure an OSGi
>application that can load custom java code.
>
> My setup is like this:
>
> custom java code is at <customDir>
> OSGi fwk bundles are in <eclipse/plugins>
>
> if custom java code from <customDir> starts using a socket or read write
> to arbitrary directory. I'd like to block it.
>
> hence my java.policy file looks like:
> grant codeBase "file:/<eclipse/plugins" {
> java.security.AllPermissions;
> }
>
> Now the problem is that I have not granted any permission. So should the
> OSGi application loaded from the trusted loc <eclipse/plugins> will have
> limited permission when making calls to the custom java class from
> <customDir>?
>
> I have tried some code that suggests otherwise.
>
> Any pointer if java security is currently working correctly with equinox
> fwk?
>
> Thanks,
> Tom
Re: Java Security with Equinox OSGi [message #493778 is a reply to message #493754] Tue, 27 October 2009 23:29 Go to previous messageGo to next message
Tom H is currently offline Tom HFriend
Messages: 18
Registered: July 2009
Junior Member
I have launched the osgi code like the following:
java -cp org.eclipse.equinox.launcher_1.0.101.R34x_v20080819.jar -Djava.security.manager -Djava.security.policy=C:\java_policy\beacon_policy.txt" org.eclipse.core.launcher.Main -application my.commandLine.application

I granted <eclipse\plugins> directories all permissions:
grant codeBase "file:C:/eclipse/plugins/-" {
permission java.security.AllPermission;
};

My application will install a new bundle from a separate location <customDir> outside of the <eclipse/plugins> dir.
As you can see, that code from customDir should not have any privilege at all to create sockets or read write files.

However, I have been able to inject code in <customDir> that writes a directory.

How do I make a bundle loaded by the Equinox OSGi framework to apply security in my case?

Regards,
Tom
Re: Java Security with Equinox OSGi [message #494038 is a reply to message #493778] Wed, 28 October 2009 20:59 Go to previous messageGo to next message
Bruce Kelly is currently offline Bruce KellyFriend
Messages: 63
Registered: July 2009
Member
I did a small test using an Eclipse application and accessing a System
property and could do so even though the plug-in was not installed in the
eclipse/plugins directory.

I guess it has something to do with the way the classes are loaded by the
bundle class loader.

I also tried running with no special permisssions and then granting each one
selectively.
There are a lot of permissions required and one of them was to create a
SecurityManager.
This maybe specific to Eclipse rather than Equinox, but it also might
explain the behaviour.

As an alternative, have you looked at the OSGi specs on security?

Namaste, Bruce

<tomhsu@gmail.com> wrote in message news:hc7vpk$a91$1@build.eclipse.org...
>I have launched the osgi code like the following:
> java -cp
> org.eclipse.equinox.launcher_1.0.101.R34x_v20080819.jar -Djava.security.manager
> -Djava.security.policy=C:\java_policy\beacon_policy.txt"
> org.eclipse.core.launcher.Main -application my.commandLine.application
>
> I granted <eclipse\plugins> directories all permissions:
> grant codeBase "file:C:/eclipse/plugins/-" {
> permission java.security.AllPermission;
> };
>
> My application will install a new bundle from a separate location
> <customDir> outside of the <eclipse/plugins> dir.
> As you can see, that code from customDir should not have any privilege at
> all to create sockets or read write files.
>
> However, I have been able to inject code in <customDir> that writes a
> directory.
>
> How do I make a bundle loaded by the Equinox OSGi framework to apply
> security in my case?
>
> Regards,
> Tom
Re: Java Security with Equinox OSGi [message #494042 is a reply to message #494038] Wed, 28 October 2009 21:50 Go to previous message
Tom H is currently offline Tom HFriend
Messages: 18
Registered: July 2009
Junior Member
I have read further on OSGi's specification on security, and found the service names like Admin Permission Services and Conditinal Permission services that is supposed to provide security restrictions on bundles in the fwk.

Can anyone provide some quickstart/documentation on how to enable to control of security on bundles in equinox?

It looks by default that all bundles started by equinox will get all permissions.

Regards,
Tom
Previous Topic:p2.inf in build.properties
Next Topic:DS and Jetty
Goto Forum:
  


Current Time: Fri Mar 29 06:42:20 GMT 2024

Powered by FUDForum. Page generated in 0.02314 seconds
.:: Contact :: Home ::.

Powered by: FUDforum 3.0.2.
Copyright ©2001-2010 FUDforum Bulletin Board Software

Back to the top