Re: RE: mx4j-Bugs-969175: Security and delegation

Simone,

I think the solution I just described in a message to Ron Vered 
addresses these scenarios adequately.  Let me know what you think.

-- 
Éamonn


Bordet, Simone wrote:
> Hi, 
> 
> 
>>jmxconnectorserver.jar creates a connector server with a 
>>JMXAuthenticator that always returns a Subject containing "eraser". 
> 
> 
> Do you grant any permission to principal "eraser" ?
> If no, it can do nothing.
> If so, then you allow someone with the right privileges to erase your disk.
> 
> 
>>Then it, or an outside party, connects to the connector 
>>server through RMI and accesses the EraserMBean as "eraser".
> 
> 
> You need a lot of permission for this. 
> You grant these permissions because you trust "eraser.jar" ?
> 
> 
>>Since you don't check the permissions of the creator of the 
>>connector server, this attempt works. 
> 
> 
> I think I have understood.
> Let me rewords it:
> You have an MBean packaged in "fullytrusted.jar", and you want to give it AllPermission.
> You have a "jmxconnectorserver.jar" which is of dubious provenience, and your reasoning is: since "jmxconnectorserver.jar" will allow to call FullyTrustedMBean, I must give AllPermission also to "jmxconnectorserver.jar". Better I call that guys that handed me "jmxconnectorserver.jar" and say "no way", I'll write my own.
> 
> MX4J default behavior and RJMXRI will follow this pattern.
> 
> Now I give you another scenario where you trust "jmxconnectorserver.jar" to return only authenticated subject, but someone asks you to add services to an existing MBeanServer, in form of MBeans (say "service1.jar").
> With the alternate implementation you just go to the policy file, you add a grant block for principal "service1" with the permissions you want, and off you go.
> With the default implementation, you should grant to "jmxconnectorserver.jar" also the permissions needed by "service1.jar" (and "service2.jar", and so on). At this point, since "jmxconnectorserver.jar" is trusted, better give it AllPermission.
> 
> In a yet another scenario where you don't trust nor "jmxconnectorserver.jar", not "service1.jar", there is a problem, since the default behavior forces you to grant some permissions to "service1.jar", and with it, grant additional permissions to "jmxconnectorserver.jar".
> With the alternate implementation, you can specify separately the needed permissions.
> 
> Simon
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by BEA Weblogic Workshop
> FREE Java Enterprise J2EE developer tools!
> Get your free copy of BEA WebLogic Workshop 8.1 today.
> http://ads.osdn.com/?ad_idP47&alloc_id808&opÌk
> _______________________________________________
> Mx4j-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mx4j-devel
> 


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_idP47&alloc_id808&op=click