security - 在启用安全管理器的情况下使用 tomcat 时安全连接失败

Question

我已经在启用 SSL 的 tomcat 6 上部署了一个 Web 应用程序 (example.war)。

当我在没有安全管理器的情况下启动 tomcat 并尝试使用 url: "https://localhost:8443/example" 连接到服务器时，它成功连接并且并显示 index.jsp 文件(欢迎文件)的内容。

但是当我使用安全管理器启动 tomcat 时，它在浏览器 (firefox) 上针对相同的 url 显示以下错误。

Secure Connection Failed

An error occurred during a connection to localhost:8443.
Peer reports it experienced an internal error.
(Error code: ssl_error_internal_error_alert)

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.

这里是catalina.policy中提供的权限

grant {
    permission java.util.PropertyPermission "java.home", "read";
    permission java.util.PropertyPermission "java.naming.*", "read";
    permission java.util.PropertyPermission "javax.sql.*", "read";

    // OS Specific properties to allow read access
    permission java.util.PropertyPermission "os.name", "read";
    permission java.util.PropertyPermission "os.version", "read";
    permission java.util.PropertyPermission "os.arch", "read";
    permission java.util.PropertyPermission "file.separator", "read";
    permission java.util.PropertyPermission "path.separator", "read";
    permission java.util.PropertyPermission "line.separator", "read";

    // JVM properties to allow read access
    permission java.util.PropertyPermission "java.version", "read";
    permission java.util.PropertyPermission "java.vendor", "read";
    permission java.util.PropertyPermission "java.vendor.url", "read";
    permission java.util.PropertyPermission "java.class.version", "read";
    permission java.util.PropertyPermission "java.specification.version", "read";
    permission java.util.PropertyPermission "java.specification.vendor", "read";
    permission java.util.PropertyPermission "java.specification.name", "read";

    permission java.util.PropertyPermission "java.vm.specification.version", "read";
    permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
    permission java.util.PropertyPermission "java.vm.specification.name", "read";
    permission java.util.PropertyPermission "java.vm.version", "read";
    permission java.util.PropertyPermission "java.vm.vendor", "read";
    permission java.util.PropertyPermission "java.vm.name", "read";

    // Required for OpenJMX
    permission java.lang.RuntimePermission "getAttribute";

    // Allow read of JAXP compliant XML parser debug
    permission java.util.PropertyPermission "jaxp.debug", "read";

    // Precompiled JSPs need access to these packages.
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
    permission java.lang.RuntimePermission "accessClassInPackage.sun.security.util";
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*";

    // Precompiled JSPs need access to these system properties.
    permission java.util.PropertyPermission
     "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
    permission java.util.PropertyPermission "org.apache.el.parser.COERCE_TO_ZERO", "read";
};

grant codeBase "file:${catalina.base}/webapps/example/-" {
    permission java.security.AllPermission;
};

当我提供以下所有权限时它工作正常:

grant {
    permission java.security.AllPermission;
};

grant codeBase "file:${catalina.base}/webapps/example/-" {
    permission java.security.AllPermission;
};

我想知道应该添加哪些特定权限才能在不提供 AllPermission 的情况下运行？

Answer 1

问题终于解决了。我启动 tomcat 时将环境变量“CATALINA_OPTS”设置为值“-Djava.security.debug=access”，它记录了有关的详细信息访问权限，我发现了一些 AccessControlExceptions - 访问被拒绝。

添加以下权限解决了问题:

permission java.util.PropertyPermission "sun.security.pkcs11.allowSingleThreadedModules", "read";

permission java.lang.RuntimePermission "accessClassInPackage.sun.util.logging.resources";
permission java.lang.RuntimePermission "accessClassInPackage.com.sun.xml.internal.bind.v2.runtime.reflect";
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.util";
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.action";
permission java.lang.RuntimePermission "accessClassInPackage.sun.util.logging.resources";
permission java.lang.RuntimePermission "loadLibrary.j2pkcs11";
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.ec";
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.internal.spec";
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.internal.interfaces";
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.rsa";

permission java.security.SecurityPermission "putProviderProperty.SunJCE";
permission java.security.SecurityPermission "putProviderProperty.SunPKCS11-NSS";

permission java.io.FilePermission "/usr/lib/jvm/java-7-openjdk-i386/jre/lib/security/nss.cfg", "read";
permission java.io.FilePermission "/usr/lib/jvm/java-7-openjdk-common/jre/lib/ext/i386/libj2pkcs11.so", "read";
permission  java.io.FilePermission "/usr/lib/jvm/java-7-openjdk-common/jre/lib/ext/libj2pkcs11.so", "read";

permission java.io.FilePermission "/usr/share/java/i386/libj2pkcs11.so", "read";
permission java.io.FilePermission "/usr/share/java/libj2pkcs11.so", "read";

permission java.io.FilePermission "/usr/lib/i386-linux-gnu/jni/i386/libj2pkcs11.so", "read";
permission java.io.FilePermission "/usr/lib/i386-linux-gnu/jni/libj2pkcs11.so", "read";

但我不确定添加具有库绝对路径的文件权限是否是个好主意(最后 7 个条目)。对此有何建议？