[ mx4j-Bugs-969175 ] low privileged demon cannot delegate high privileged user

Bugs item #969175, was opened at 2004-06-08 22:07
Message generated for change (Comment added) made by biorn_steedom
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=450647&aid=969175&group_id=47745

Category: RMI Adaptor/Connector
Group: Release 2.0.1
Status: Open
Resolution: None
Priority: 5
Submitted By: Ron V (ron_vered)
Assigned to: Nobody/Anonymous (nobody)
Summary: low privileged demon cannot delegate high privileged user

Initial Comment:
Current implementation constricts the set of permissions 
a delegate have to the permission intersection (minimum 
of) { JMX jars, context at start(), permissions of 
connection establisher Subject, delegate Subject }.
Even if this security model does not work for us, there is 
no way to escape it. In fact, it is hard coded.

The following security model is not possible:
Low-privileged daemon server is running with just 
enough permissions to do what it needs to on a regular 
basis, whereas, a well-privileged (authenticated) user 
can make the server take sensitive actions (which the 
daemon cannot do otherwise).

Moreover, if a low-privileged deamon created a 
connection, there is no way a more privileged user can 
make use of this connection to do its actions; the 
current implementation hard-codes the above minimal 
intersection.

The model in which the creator of a connection has to 
have permission to anything that a delegate may want 
to do is similar to the person having keys to the white-
house also having permission to launch ICBMs.

For the same reason, the entity which start()-ed the 
connector server need not have permssion to do a 
specific operation on a specific MBean.


----------------------------------------------------------------------

>Comment By: Simone Bordet (biorn_steedom)
Date: 2004-06-13 00:22

Message:
Logged In: YES 
user_id=128193

I have probably understood what you're saying, but to be
100% sure it would be better if you post code and policy files.

What are you trying to achieve that the current
implementation does not allow you to do ?

Running the server with a minimal set of permissions may not
be as simple as one can think, given the Java security model.

As I've said, I probably have an idea of your problem and (I
think) a very simple solution for it, but I definitely need
more details.

Regards

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=450647&aid=969175&group_id=47745


-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the
one installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504