RE: RE: [Mx4j-user] RE: mx4j-Bugs-969175: Security and delegation

Hi Eamonn, 

> Ron,
> 
> Well, don't give up that easily! :-)

Ron, I agree with Eamonn here. We've had almost endless discussions, but we ended up with the best solution in all cases.

> I am not saying this can't be changed in a future version of 
> the API.  I am simply saying that the proposed change in the 
> semantics of the existing implementations is insecure and 
> cannot be made.
> 
> You are right that the situation where the creator of a 
> connector server must have all the permissions that any 
> client of the server will need is suboptimal.  It should be 
> possible to give the creator just the permissions it needs to 
> create the connector server.

I still haven't understood if you think the alternative implementation has a security hole or not. I think it has not.

Eamonn, I have understood your example where a connector can return non-authenticated users. But I think it does not demonstrate any security hole, and I am still not convinced.

Also, I'm seeing the issue more from the point of view of the person that has to make the system work.
The assumption is that the system must allow a certain principal to delete files.
The assumption is that no codebase is trusted: it must have the least set of permissions possible.

The only policy file that allow a non-trusted "jmxconnectorserver.jar" to delete files is the first, the default implementation.
The proposed solution buys nothing for one more permission.

But sure we must discuss this better.

In almost-policy-file-syntax:

Current implementation:
~~~~~~~~~~~~~~~~~~~~~~~

grant codebase "jmxconnectorserver.jar"
{
   permission SocketPermission "localhost","listen";
   permission SocketPermission "*:1024-","accept";

   permission FilePermission "<<ALL FILES>>","delete";
};

grant principal "eraser"
{
   permission MBeanPermission "com.acme.Eraser","invoke";
   permission FilePermission "<<ALL FILES>>","delete";
};


Alternate implementation:
~~~~~~~~~~~~~~~~~~~~~~~~~

grant codebase "jmxconnectorserver.jar"
{
   permission SocketPermission "localhost","listen";
   permission SocketPermission "*:1024-","accept";
};

grant principal "eraser"
{
   permission MBeanPermission "com.acme.Eraser","invoke";
   permission FilePermission "<<ALL FILES>>","delete";
};

Proposed implementation:
~~~~~~~~~~~~~~~~~~~~~~~~

grant codebase "jmxconnectorserver.jar"
{
   permission SocketPermission "localhost","listen";
   permission SocketPermission "*:1024-","accept";

   permission SubjectDelegationPermission "eraser";
};

grant principal "eraser"
{
   permission MBeanPermission "com.acme.Eraser","invoke";
   permission FilePermission "<<ALL FILES>>","delete";
};


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_idP47&alloc_id808&op=click