Re: access problems related to xml libs?

Bordet, Simone wrote:
> Hi,
> 
> 
>>So, I added
>>
>>     permission java.util.FilePermission "<<ALL FILES>>", "read";
>>
>>to every code base and the default code base, and it still 
>>fails.  I then added
>>
>>     permission java.util.FilePermission
>>         "/home/blaine/mx4jsa/lib/xercesImpl.jar", "read";
>>     permission java.util.FilePermission
>>         "/home/blaine/mx4jsa/lib/xalan.jar", "read";
>>     permission java.util.FilePermission
>>         "/usr/java/j2sdk1.4.2_02/jre/lib/rt.jar", "read";
>>
>>for every code base and the default, but it STILL fails with
>>
>>balder$ grep deni stderr.txt
>>access: access denied (java.io.FilePermission 
>>/usr/java/j2sdk1.4.2_02/jre/lib/ja
>>xp.properties read)
> 
> 
> Well, some of these failures may be handled gracefully (for example, look for a file, if any exception use some defaults).

How would I do that?  I am just trying to run an HttpAdaptor with an
XSLTProcessor.  (1) XSLTProcessor is not going to work without some
XSL library.  If I fall back to not doing the transformation then the
whole exercise is pointless.  (2) I'm not going to perform surgery
on copies of all of the underlying classes just to run it under a
security manager (it isn't my class that is trying to access these
XML libraries, it's existing mx4j code).

The only workable solution that I know of is to satisfy the
security manager by means of the policy file (which you discuss
below).

> To help you I need to have the stack trace of the AccessControlException: access denied, and the protection domain that failed (printed on System.err when -Djava.security.debug=access.failure) (along with its permissions and stack trace).
> 
> Zipping the output and posting it may be less work for you, I'll try to find some time to look at it.
> 
> It's a long walk to fine tune the permissions, but it's a good start knowing that AllPermission makes your app work correctly. Then it's only a matter of setting java.security.debug and have a lot of patience.

> Simon

I notice that sometimes it reports about the domain and sometimes it doesn't.
Here's one occurrence where everything is logged.  (POSTNOTE:  Could the
problem have to due with "unresolved"s in the
"unresolved java.util.FilePermission"s?)

access: access allowed (java.io.FilePermission /usr/local/mx4j-2.0b1/lib/mx4j-to
ols.jar read)
access: domain that failed ProtectionDomain 
(file:/usr/local/mx4j-2.0b1/lib/mx4j-tools.jar <no certificates>)
  sun.misc.Launcher$AppClassLoader@1855af5
  <no principals>
  java.security.Permissions@1a918d5 (
  (java.io.FilePermission /usr/local/mx4j-2.0b1/lib/mx4j-tools.jar read)
  (java.net.SocketPermission * connect,listen,accept,resolve)
  (java.util.PropertyPermission * read)
  (unresolved javax.management.MBeanTrustPermission register null)
  (unresolved javax.management.MBeanPermission * queryMBeans, getMBeanInfo)
  (unresolved java.util.FilePermission /usr/java/j2sdk1.4.2_02/jre/lib/rt.jar read)
  (unresolved java.util.FilePermission /home/blaine/mx4jsa/lib/xalan.jar read)
  (unresolved java.util.FilePermission /home/blaine/mx4jsa/lib/xercesImpl.jar read)
  (unresolved java.util.FilePermission /usr/java/j2sdk1.4.2_02/jre/lib/rt.jar read)
  (unresolved java.util.FilePermission /home/blaine/mx4jsa/lib/xalan.jar read)
  (unresolved java.util.FilePermission /home/blaine/mx4jsa/lib/xercesImpl.jar read)
  (java.lang.RuntimePermission exitVM)
)


access: access denied (java.io.FilePermission 
/home/blaine/mx4jsa/lib/xercesImpl.jar read)
java.lang.Exception: Stack trace
	at java.lang.Thread.dumpStack(Thread.java:1064)
	at 
java.security.AccessControlContext.checkPermission(AccessControlContext.java:258)
	at java.security.AccessController.checkPermission(AccessController.java:401)
	at java.lang.SecurityManager.checkPermission(SecurityManager.java:524)
	at java.lang.SecurityManager.checkRead(SecurityManager.java:863)
	at sun.misc.URLClassPath.check(URLClassPath.java:403)
	at sun.misc.URLClassPath.checkURL(URLClassPath.java:377)
	at java.net.URLClassLoader.findResource(URLClassLoader.java:356)
	at java.lang.ClassLoader.getResource(ClassLoader.java:787)
	at java.lang.ClassLoader.getResourceAsStream(ClassLoader.java:969)
	at javax.xml.parsers.FactoryFinder.find(FactoryFinder.java:160)
	at 
javax.xml.parsers.DocumentBuilderFactory.newInstance(DocumentBuilderFactory.java:93)
	at mx4j.tools.adaptor.http.HttpAdaptor.buildCommands(HttpAdaptor.java:688)
	at mx4j.tools.adaptor.http.HttpAdaptor.preRegister(HttpAdaptor.java:610)
	at 
mx4j.server.interceptor.InvokerMBeanServerInterceptor.registration(InvokerMBeanServerInterceptor.java:161)
)
	at 
mx4j.server.interceptor.DefaultMBeanServerInterceptor.registration(DefaultMBeanServerInterceptor.java:111)
	at 
mx4j.server.interceptor.SecurityMBeanServerInterceptor.registration(SecurityMBeanServerInterceptor.java:135)
	at 
mx4j.server.interceptor.DefaultMBeanServerInterceptor.registration(DefaultMBeanServerInterceptor.java:111)
	at 
mx4j.server.interceptor.DefaultMBeanServerInterceptor.registration(DefaultMBeanServerInterceptor.java:111)
	at 
mx4j.server.interceptor.ContextClassLoaderMBeanServerInterceptor.registration(ContextClassLoaderMBeanServerInterceptor.java:161)
	at mx4j.server.MX4JMBeanServer.registerImpl(MX4JMBeanServer.java:801)
	at mx4j.server.MX4JMBeanServer.registerMBeanImpl(MX4JMBeanServer.java:745)
	at mx4j.server.MX4JMBeanServer.registerMBean(MX4JMBeanServer.java:729)
	at MxX.main(MxX.java:16)


(This specific error seems to be due to access failure for .../xercesImpl.jar.
I have
     permission java.util.FilePermission
       "/home/blaine/mx4jsa/lib/xercesImpl.jar", "read";
in every codebase block).

-- 
Don't pray in my school, and I won't think in your church.
ICF:  703-934-3692       Cell:  703-944-9317


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click