Skip to content

Commit 4815b50

Browse files
committed
add lesson 13
1 parent 5cfff5b commit 4815b50

File tree

19 files changed

+5828
-0
lines changed

19 files changed

+5828
-0
lines changed
Binary file not shown.
Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one or more
2+
// contributor license agreements. See the NOTICE file distributed with
3+
// this work for additional information regarding copyright ownership.
4+
// The ASF licenses this file to You under the Apache License, Version 2.0
5+
// (the "License"); you may not use this file except in compliance with
6+
// the License. You may obtain a copy of the License at
7+
//
8+
// http://www.apache.org/licenses/LICENSE-2.0
9+
//
10+
// Unless required by applicable law or agreed to in writing, software
11+
// distributed under the License is distributed on an "AS IS" BASIS,
12+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
// See the License for the specific language governing permissions and
14+
// limitations under the License.
15+
16+
// ============================================================================
17+
// catalina.policy - Security Policy Permissions for Tomcat 7
18+
//
19+
// This file contains a default set of security policies to be enforced (by the
20+
// JVM) when Catalina is executed with the "-security" option. In addition
21+
// to the permissions granted here, the following additional permissions are
22+
// granted to each web application:
23+
//
24+
// * Read access to the web application's document root directory
25+
// * Read, write and delete access to the web application's working directory
26+
// ============================================================================
27+
28+
29+
// ========== SYSTEM CODE PERMISSIONS =========================================
30+
31+
32+
// These permissions apply to javac
33+
grant codeBase "file:${java.home}/lib/-" {
34+
permission java.security.AllPermission;
35+
};
36+
37+
// These permissions apply to all shared system extensions
38+
grant codeBase "file:${java.home}/jre/lib/ext/-" {
39+
permission java.security.AllPermission;
40+
};
41+
42+
// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
43+
grant codeBase "file:${java.home}/../lib/-" {
44+
permission java.security.AllPermission;
45+
};
46+
47+
// These permissions apply to all shared system extensions when
48+
// ${java.home} points at $JAVA_HOME/jre
49+
grant codeBase "file:${java.home}/lib/ext/-" {
50+
permission java.security.AllPermission;
51+
};
52+
53+
54+
// ========== CATALINA CODE PERMISSIONS =======================================
55+
56+
57+
// These permissions apply to the daemon code
58+
grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
59+
permission java.security.AllPermission;
60+
};
61+
62+
// These permissions apply to the logging API
63+
// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
64+
// update this section accordingly.
65+
// grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
66+
grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
67+
permission java.io.FilePermission
68+
"${java.home}${file.separator}lib${file.separator}logging.properties", "read";
69+
70+
permission java.io.FilePermission
71+
"${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
72+
permission java.io.FilePermission
73+
"${catalina.base}${file.separator}logs", "read, write";
74+
permission java.io.FilePermission
75+
"${catalina.base}${file.separator}logs${file.separator}*", "read, write";
76+
77+
permission java.lang.RuntimePermission "shutdownHooks";
78+
permission java.lang.RuntimePermission "getClassLoader";
79+
permission java.lang.RuntimePermission "setContextClassLoader";
80+
81+
permission java.util.logging.LoggingPermission "control";
82+
83+
permission java.util.PropertyPermission "java.util.logging.config.class", "read";
84+
permission java.util.PropertyPermission "java.util.logging.config.file", "read";
85+
permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read";
86+
permission java.util.PropertyPermission "catalina.base", "read";
87+
88+
// Note: To enable per context logging configuration, permit read access to
89+
// the appropriate file. Be sure that the logging configuration is
90+
// secure before enabling such access.
91+
// E.g. for the examples web application (uncomment and unwrap
92+
// the following to be on a single line):
93+
// permission java.io.FilePermission "${catalina.base}${file.separator}
94+
// webapps${file.separator}examples${file.separator}WEB-INF
95+
// ${file.separator}classes${file.separator}logging.properties", "read";
96+
};
97+
98+
// These permissions apply to the server startup code
99+
grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
100+
permission java.security.AllPermission;
101+
};
102+
103+
// These permissions apply to the servlet API classes
104+
// and those that are shared across all class loaders
105+
// located in the "lib" directory
106+
grant codeBase "file:${catalina.home}/lib/-" {
107+
permission java.security.AllPermission;
108+
};
109+
110+
111+
// If using a per instance lib directory, i.e. ${catalina.base}/lib,
112+
// then the following permission will need to be uncommented
113+
// grant codeBase "file:${catalina.base}/lib/-" {
114+
// permission java.security.AllPermission;
115+
// };
116+
117+
118+
// ========== WEB APPLICATION PERMISSIONS =====================================
119+
120+
121+
// These permissions are granted by default to all web applications
122+
// In addition, a web application will be given a read FilePermission
123+
// and JndiPermission for all files and directories in its document root.
124+
grant {
125+
// Required for JNDI lookup of named JDBC DataSource's and
126+
// javamail named MimePart DataSource used to send mail
127+
permission java.util.PropertyPermission "java.home", "read";
128+
permission java.util.PropertyPermission "java.naming.*", "read";
129+
permission java.util.PropertyPermission "javax.sql.*", "read";
130+
131+
// OS Specific properties to allow read access
132+
permission java.util.PropertyPermission "os.name", "read";
133+
permission java.util.PropertyPermission "os.version", "read";
134+
permission java.util.PropertyPermission "os.arch", "read";
135+
permission java.util.PropertyPermission "file.separator", "read";
136+
permission java.util.PropertyPermission "path.separator", "read";
137+
permission java.util.PropertyPermission "line.separator", "read";
138+
139+
// JVM properties to allow read access
140+
permission java.util.PropertyPermission "java.version", "read";
141+
permission java.util.PropertyPermission "java.vendor", "read";
142+
permission java.util.PropertyPermission "java.vendor.url", "read";
143+
permission java.util.PropertyPermission "java.class.version", "read";
144+
permission java.util.PropertyPermission "java.specification.version", "read";
145+
permission java.util.PropertyPermission "java.specification.vendor", "read";
146+
permission java.util.PropertyPermission "java.specification.name", "read";
147+
148+
permission java.util.PropertyPermission "java.vm.specification.version", "read";
149+
permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
150+
permission java.util.PropertyPermission "java.vm.specification.name", "read";
151+
permission java.util.PropertyPermission "java.vm.version", "read";
152+
permission java.util.PropertyPermission "java.vm.vendor", "read";
153+
permission java.util.PropertyPermission "java.vm.name", "read";
154+
155+
// Required for OpenJMX
156+
permission java.lang.RuntimePermission "getAttribute";
157+
158+
// Allow read of JAXP compliant XML parser debug
159+
permission java.util.PropertyPermission "jaxp.debug", "read";
160+
161+
// All JSPs need to be able to read this package
162+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat";
163+
164+
// Precompiled JSPs need access to these packages.
165+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
166+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
167+
permission java.lang.RuntimePermission
168+
"accessClassInPackage.org.apache.jasper.runtime.*";
169+
170+
// Precompiled JSPs need access to these system properties.
171+
permission java.util.PropertyPermission
172+
"org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
173+
permission java.util.PropertyPermission
174+
"org.apache.el.parser.COERCE_TO_ZERO", "read";
175+
176+
// The cookie code needs these.
177+
permission java.util.PropertyPermission
178+
"org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";
179+
permission java.util.PropertyPermission
180+
"org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read";
181+
permission java.util.PropertyPermission
182+
"org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR", "read";
183+
184+
// Applications using Comet need to be able to access this package
185+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.comet";
186+
187+
// Applications using the legacy WebSocket implementation need to be able to access this package
188+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.websocket";
189+
190+
// Applications using the JSR-356 WebSocket implementation need to be able to access these packages
191+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket";
192+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server";
193+
};
194+
195+
196+
// The Manager application needs access to the following packages to support the
197+
// session display functionality. These settings support the following
198+
// configurations:
199+
// - default CATALINA_HOME == CATALINA_BASE
200+
// - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
201+
// - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
202+
grant codeBase "file:${catalina.base}/webapps/manager/-" {
203+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
204+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
205+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
206+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
207+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
208+
};
209+
grant codeBase "file:${catalina.home}/webapps/manager/-" {
210+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
211+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
212+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
213+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
214+
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
215+
};
216+
217+
// You can assign additional permissions to particular web applications by
218+
// adding additional "grant" entries here, based on the code base for that
219+
// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
220+
//
221+
// Different permissions can be granted to JSP pages, classes loaded from
222+
// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
223+
// directory, or even to individual jar files in the /WEB-INF/lib/ directory.
224+
//
225+
// For instance, assume that the standard "examples" application
226+
// included a JDBC driver that needed to establish a network connection to the
227+
// corresponding database and used the scrape taglib to get the weather from
228+
// the NOAA web server. You might create a "grant" entries like this:
229+
//
230+
// The permissions granted to the context root directory apply to JSP pages.
231+
// grant codeBase "file:${catalina.base}/webapps/examples/-" {
232+
// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
233+
// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
234+
// };
235+
//
236+
// The permissions granted to the context WEB-INF/classes directory
237+
// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" {
238+
// };
239+
//
240+
// The permission granted to your JDBC driver
241+
// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
242+
// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
243+
// };
244+
// The permission granted to the scrape taglib
245+
// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
246+
// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
247+
// };
248+
Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache License, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
#
17+
# List of comma-separated packages that start with or equal this string
18+
# will cause a security exception to be thrown when
19+
# passed to checkPackageAccess unless the
20+
# corresponding RuntimePermission ("accessClassInPackage."+package) has
21+
# been granted.
22+
package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.jasper.,\
23+
org.apache.naming.resources.,org.apache.tomcat.
24+
#
25+
# List of comma-separated packages that start with or equal this string
26+
# will cause a security exception to be thrown when
27+
# passed to checkPackageDefinition unless the
28+
# corresponding RuntimePermission ("defineClassInPackage."+package) has
29+
# been granted.
30+
#
31+
# by default, no packages are restricted for definition, and none of
32+
# the class loaders supplied with the JDK call checkPackageDefinition.
33+
#
34+
package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,\
35+
org.apache.jasper.,org.apache.naming.,org.apache.tomcat.
36+
37+
#
38+
#
39+
# List of comma-separated paths defining the contents of the "common"
40+
# classloader. Prefixes should be used to define what is the repository type.
41+
# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute.
42+
# If left as blank,the JVM system loader will be used as Catalina's "common"
43+
# loader.
44+
# Examples:
45+
# "foo": Add this folder as a class repository
46+
# "foo/*.jar": Add all the JARs of the specified folder as class
47+
# repositories
48+
# "foo/bar.jar": Add bar.jar as a class repository
49+
common.loader=${catalina.base}/lib,${catalina.base}/lib/*.jar,${catalina.home}/lib,${catalina.home}/lib/*.jar
50+
51+
#
52+
# List of comma-separated paths defining the contents of the "server"
53+
# classloader. Prefixes should be used to define what is the repository type.
54+
# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute.
55+
# If left as blank, the "common" loader will be used as Catalina's "server"
56+
# loader.
57+
# Examples:
58+
# "foo": Add this folder as a class repository
59+
# "foo/*.jar": Add all the JARs of the specified folder as class
60+
# repositories
61+
# "foo/bar.jar": Add bar.jar as a class repository
62+
server.loader=
63+
64+
#
65+
# List of comma-separated paths defining the contents of the "shared"
66+
# classloader. Prefixes should be used to define what is the repository type.
67+
# Path may be relative to the CATALINA_BASE path or absolute. If left as blank,
68+
# the "common" loader will be used as Catalina's "shared" loader.
69+
# Examples:
70+
# "foo": Add this folder as a class repository
71+
# "foo/*.jar": Add all the JARs of the specified folder as class
72+
# repositories
73+
# "foo/bar.jar": Add bar.jar as a class repository
74+
# Please note that for single jars, e.g. bar.jar, you need the URL form
75+
# starting with file:.
76+
shared.loader=
77+
78+
# List of JAR files that should not be scanned using the JarScanner
79+
# functionality. This is typically used to scan JARs for configuration
80+
# information. JARs that do not contain such information may be excluded from
81+
# the scan to speed up the scanning process. This is the default list. JARs on
82+
# this list are excluded from all scans. Scan specific lists (to exclude JARs
83+
# from individual scans) follow this. The list must be a comma separated list of
84+
# JAR file names.
85+
# The JARs listed below include:
86+
# - Tomcat Bootstrap JARs
87+
# - Tomcat API JARs
88+
# - Catalina JARs
89+
# - Jasper JARs
90+
# - Tomcat JARs
91+
# - Common non-Tomcat JARs
92+
# - Test JARs (JUnit, Cobertura and dependencies)
93+
tomcat.util.scan.DefaultJarScanner.jarsToSkip=\
94+
bootstrap.jar,commons-daemon.jar,tomcat-juli.jar,\
95+
annotations-api.jar,el-api.jar,jsp-api.jar,servlet-api.jar,websocket-api.jar,\
96+
catalina.jar,catalina-ant.jar,catalina-ha.jar,catalina-tribes.jar,\
97+
jasper.jar,jasper-el.jar,ecj-*.jar,\
98+
tomcat-api.jar,tomcat-util.jar,tomcat-coyote.jar,tomcat-dbcp.jar,\
99+
tomcat-jni.jar,tomcat-spdy.jar,\
100+
tomcat-i18n-en.jar,tomcat-i18n-es.jar,tomcat-i18n-fr.jar,tomcat-i18n-ja.jar,\
101+
tomcat-juli-adapters.jar,catalina-jmx-remote.jar,catalina-ws.jar,\
102+
tomcat-jdbc.jar,\
103+
tools.jar,\
104+
commons-beanutils*.jar,commons-codec*.jar,commons-collections*.jar,\
105+
commons-dbcp*.jar,commons-digester*.jar,commons-fileupload*.jar,\
106+
commons-httpclient*.jar,commons-io*.jar,commons-lang*.jar,commons-logging*.jar,\
107+
commons-math*.jar,commons-pool*.jar,\
108+
jstl.jar,taglibs-standard-spec-*.jar,\
109+
geronimo-spec-jaxrpc*.jar,wsdl4j*.jar,\
110+
ant.jar,ant-junit*.jar,aspectj*.jar,jmx.jar,h2*.jar,hibernate*.jar,httpclient*.jar,\
111+
jmx-tools.jar,jta*.jar,log4j.jar,log4j-1*.jar,mail*.jar,slf4j*.jar,\
112+
xercesImpl.jar,xmlParserAPIs.jar,xml-apis.jar,\
113+
junit.jar,junit-*.jar,hamcrest*.jar,org.hamcrest*.jar,ant-launcher.jar,\
114+
cobertura-*.jar,asm-*.jar,dom4j-*.jar,icu4j-*.jar,jaxen-*.jar,jdom-*.jar,\
115+
jetty-*.jar,oro-*.jar,servlet-api-*.jar,tagsoup-*.jar,xmlParserAPIs-*.jar,\
116+
xom-*.jar
117+
118+
# Additional JARs (over and above the default JARs listed above) to skip when
119+
# scanning for Servlet 3.0 pluggability features. These features include web
120+
# fragments, annotations, SCIs and classes that match @HandlesTypes. The list
121+
# must be a comma separated list of JAR file names.
122+
org.apache.catalina.startup.ContextConfig.jarsToSkip=
123+
124+
# Additional JARs (over and above the default JARs listed above) to skip when
125+
# scanning for TLDs. The list must be a comma separated list of JAR file names.
126+
org.apache.catalina.startup.TldConfig.jarsToSkip=tomcat7-websocket.jar
127+
128+
#
129+
# String cache configuration.
130+
tomcat.util.buf.StringCache.byte.enabled=true
131+
#tomcat.util.buf.StringCache.char.enabled=true
132+
#tomcat.util.buf.StringCache.trainThreshold=500000
133+
#tomcat.util.buf.StringCache.cacheSize=5000

0 commit comments

Comments
 (0)