demo site
Blaine Simpson <[email protected]>
| Newsgroups | gmane.comp.java.mx4j.devel |
|---|---|
| Message-ID | <[email protected]> |
I have a demo site for an application of mine (unrelated to Jmx or MX4J), and it's been very successful at bringing new users in. Instead of reading about what a product can do, or following a list of instructions to run samples, they just go to the site and run a working installation. I wanted to do this for my http/html adaptor, and the same exact thing could be used to exemplify the MX4J adaptors, as well as letting people actually use the example MBeans in the Guide (well... those that work). The MX4J home page, the Guide, and possibly package/overview pages of API, could have links to the demo site. The problem is, security. For a generally useful adaptor, it must have object instantiation capabilities. With my adaptor, a user can instantiate any MBean as long as the adaptor can handle the input parameter types. I'm thinking that it wouldn't be very difficult for somebody to instantiate a remote object loader (of any type) that happens to be an MBean. They could then load their own classes into the demo JVM. Does anybody know a "simple" way to run either a standalone or servlet-containerized adaptor which will somehow prohibit all remote loading? I think it's probably possible to set this up right using class-loading restrictions in JVM security property files, but, not having done anything like that before, I don't want to waste my time trying to get this working without input by somebody more experienced in this area. (I'd bet lotsa money that this can be accomplished just using the main Java API, but I want a "simple" solution). ... What about other risks? Even if remote loading is prohibited, if a user found an MBean wrapper for FileInputStream, for example, they could read files on the server (those which the process owner has access to). -- ICF: 703-934-3692 Cell: 703-944-9317 ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click