From 1a01dce6c42b398cdd68d405828774a3ab366456 Mon Sep 17 00:00:00 2001 From: Sven Gothel Date: Tue, 11 Jun 2013 16:25:48 +0200 Subject: Bug 752: Review Code Vulnerabilities (Permission Checks of new exposed code and privileged access) This review focuses on how we perform permission checks, or better - do we circumvent some assuming full privileges ? Some native methods do need extra permission validation, i.e. loading native libraries. Further more AccessController.doPrivileged(..) shall not cover generic code exposing a critical feature to the user. Further more .. we should rely on the SecuritManager, i.e. AccessControlContext's 'checkPermission(Permission)' code to comply w/ fine grained permission access. It is also possible to have full permission w/o having any certificates (-> policy file). +++ We remove implicit AccessController.doPrivileged(..) from within our trusted code for generic methods, like Property access, temp. files. +++ SecurityUtil: - Remove 'getCommonAccessControlContext(Class clz)', which returned a local AccessControlContext for later restriction if the passed class contains all certificates as the 'trusted' GlueGen class has. - Simply expose convenient permission check methods relying on SecurityManager / AccessControlContext. PropertyAccess: - 'protected static void addTrustedPrefix(..)' requires AllPermissions if SecurityManager is installed. - Remove implicit doPrivileged(..) triggered by passed AccessControlContext instance, only leave it for trusted prefixes. IOUtil: - Remove all doPrivileged(..) - Elevation shall be performed by caller. DynamicLinker: - 'public long openLibraryLocal(..)' and 'public long openLibraryGlobal(..)' may throw SecurityException, if a SecurityManager is installed and the dyn. link permission is not granted in the calling code. Implemented in their respective Unix, OSX and Windows manifestation. Caller has to elevate privileges via 'doPrivileged(..) {}' ! +++ Tests: - Property access - File access - Native library loading Manual Applet test (unsigned, but w/ SecurityManager and policy file): > gluegen/test/applet Applet has been tested w/ signed JAR w/ Firefox and Java7 on GNU/Linux as well. Manual Application test (unsigned, but w/ SecurityManager and policy file): com.jogamp.junit.sec.TestSecIOUtil01 - Run w/ SecurityManager and policy file: - gluegen/scripts/runtest-secmgr.sh - Run w/o SecurityManager: - gluegen/scripts/runtest.sh --- make/build-test.xml | 3 ++ make/scripts/runtest-secmgr.sh | 117 +++++++++++++++++++++++++++++++++++++++++ make/scripts/runtest.sh | 3 +- 3 files changed, 122 insertions(+), 1 deletion(-) create mode 100755 make/scripts/runtest-secmgr.sh (limited to 'make') diff --git a/make/build-test.xml b/make/build-test.xml index b700808..3c7da12 100644 --- a/make/build-test.xml +++ b/make/build-test.xml @@ -132,6 +132,9 @@ + + + diff --git a/make/scripts/runtest-secmgr.sh b/make/scripts/runtest-secmgr.sh new file mode 100755 index 0000000..24f1b58 --- /dev/null +++ b/make/scripts/runtest-secmgr.sh @@ -0,0 +1,117 @@ +#! /bin/bash + +TDIR=`pwd` +SDIR=`dirname $0` #scripts +cd $SDIR +SDIR=`pwd` #scripts +cd $TDIR +MDIR=`dirname $SDIR` #make +RDIR=`dirname $MDIR` #gluegen + +builddir=$1 +shift + +if [ -z "$builddir" ] ; then + echo Usage $0 build-dir + exit 1 +fi + +BDIR=$RDIR/`basename $builddir` + +if [ -e /opt-share/apache-ant ] ; then + ANT_PATH=/opt-share/apache-ant + PATH=$ANT_PATH/bin:$PATH + export ANT_PATH +fi +if [ -z "$ANT_PATH" ] ; then + TMP_ANT_PATH=$(dirname `which ant`)/.. + if [ -e $TMP_ANT_PATH/lib/ant.jar ] ; then + ANT_PATH=$TMP_ANT_PATH + export ANT_PATH + echo autosetting ANT_PATH to $ANT_PATH + fi +fi +if [ -z "$ANT_PATH" ] ; then + if [ -e /usr/share/ant/bin/ant -a -e /usr/share/ant/lib/ant.jar ] ; then + ANT_PATH=/usr/share/ant + export ANT_PATH + echo autosetting ANT_PATH to $ANT_PATH + fi +fi +if [ -z "$ANT_PATH" ] ; then + echo ANT_PATH does not exist, set it + print_usage + exit +fi + +ANT_JARS=$ANT_PATH/lib/ant.jar:$ANT_PATH/lib/ant-junit.jar:$ANT_PATH/lib/ant-launcher.jar + +LOG=runtest.log +rm -f $LOG + +#D_ARGS="-Djogamp.debug.ProcAddressHelper=true -Djogamp.debug.NativeLibrary=true" +#D_ARGS="-Djogamp.debug.TraceLock" +#D_ARGS="-Djogamp.debug.Platform -Djogamp.debug.NativeLibrary" +#D_ARGS="-Djogamp.debug.JarUtil" +#D_ARGS="-Djogamp.debug.TempJarCache" +#D_ARGS="-Djogamp.debug.TempFileCache" +#D_ARGS="-Djogamp.debug.IOUtil -Djogamp.debug.JNILibLoader -Djogamp.debug.TempFileCache -Djogamp.debug.JarUtil -Djava.io.tmpdir=/run/tmp" +#D_ARGS="-Djogamp.debug.IOUtil -Djogamp.debug.JNILibLoader -Djogamp.debug.TempFileCache -Djogamp.debug.JarUtil -Djogamp.debug.TempJarCache" +#D_ARGS="-Djogamp.debug.JNILibLoader -Djogamp.gluegen.UseTempJarCache=false" +#D_ARGS="-Djogamp.debug.JNILibLoader" +#D_ARGS="-Djogamp.debug.Lock" +#D_ARGS="-Djogamp.debug.Lock -Djogamp.debug.Lock.TraceLock" +#D_ARGS="-Djogamp.debug.Lock.TraceLock" +#D_ARGS="-Djogamp.debug.IOUtil" +D_ARGS="-Djogamp.debug=all" + +SPFILE=$BDIR/java.policy.secure + +echo "grant codeBase \"file:$BDIR/*\" {" > $SPFILE +echo " permission java.security.AllPermission;" >> $SPFILE +echo "};" >> $SPFILE + +function onetest() { + CLASSPATH=lib/junit.jar:$ANT_JARS:$RDIR/make/lib/TestJarsInJar.jar:$BDIR/gluegen-rt.jar:$BDIR/test/build/gluegen-test.jar + libspath=$BDIR/test/build/natives + echo LD_LIBRARY_PATH $LD_LIBRARY_PATH + echo CLASSPATH $CLASSPATH + which java + echo java -Djava.security.policy=$SPFILE -Dfile.encoding=UTF-8 -cp $CLASSPATH $D_ARGS $* + java -Djava.security.manager -Djava.security.policy=$SPFILE -Dfile.encoding=UTF-8 -cp $CLASSPATH $D_ARGS $* + echo +} +# +#onetest com.jogamp.common.GlueGenVersion 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestSystemPropsAndEnvs 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestVersionInfo 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestVersionNumber 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestIteratorIndexCORE 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.locks.TestRecursiveLock01 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.locks.TestRecursiveThreadGroupLock01 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.locks.TestSingletonServerSocket00 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.locks.TestSingletonServerSocket01 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.locks.TestSingletonServerSocket02 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestFloatStack01 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestIntegerStack01 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestArrayHashSet01 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.IntIntHashMapTest 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.IntObjectHashMapTest 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.LongIntHashMapTest 2>&1 | tee -a $LOG +#onetest com.jogamp.common.nio.TestBuffersFloatDoubleConversion 2>&1 | tee -a $LOG +#onetest com.jogamp.gluegen.PCPPTest 2>&1 | tee -a $LOG +#onetest com.jogamp.common.nio.TestPointerBufferEndian 2>&1 | tee -a $LOG +#onetest com.jogamp.common.nio.TestStructAccessorEndian 2>&1 | tee -a $LOG +#onetest com.jogamp.common.os.TestElfReader01 2>&1 | tee -a $LOG +#onetest com.jogamp.gluegen.test.junit.generation.Test1p1JavaEmitter 2>&1 | tee -a $LOG +#onetest com.jogamp.gluegen.test.junit.generation.Test1p2ProcAddressEmitter 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestPlatform01 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestRunnableTask01 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestIOUtil01 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestTempJarCache 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestJarUtil 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestValueConversion 2>&1 | tee -a $LOG +#onetest com.jogamp.common.net.AssetURLConnectionUnregisteredTest 2>&1 | tee -a $LOG +#onetest com.jogamp.common.net.AssetURLConnectionRegisteredTest 2>&1 | tee -a $LOG +#onetest com.jogamp.common.net.URLCompositionTest 2>&1 | tee -a $LOG +onetest com.jogamp.junit.sec.TestSecIOUtil01 2>&1 | tee -a $LOG diff --git a/make/scripts/runtest.sh b/make/scripts/runtest.sh index a068c90..165f64d 100755 --- a/make/scripts/runtest.sh +++ b/make/scripts/runtest.sh @@ -100,8 +100,9 @@ function onetest() { #onetest com.jogamp.common.util.TestRunnableTask01 2>&1 | tee -a $LOG #onetest com.jogamp.common.util.TestIOUtil01 2>&1 | tee -a $LOG #onetest com.jogamp.common.util.TestTempJarCache 2>&1 | tee -a $LOG -onetest com.jogamp.common.util.TestJarUtil 2>&1 | tee -a $LOG +#onetest com.jogamp.common.util.TestJarUtil 2>&1 | tee -a $LOG #onetest com.jogamp.common.util.TestValueConversion 2>&1 | tee -a $LOG #onetest com.jogamp.common.net.AssetURLConnectionUnregisteredTest 2>&1 | tee -a $LOG #onetest com.jogamp.common.net.AssetURLConnectionRegisteredTest 2>&1 | tee -a $LOG #onetest com.jogamp.common.net.URLCompositionTest 2>&1 | tee -a $LOG +onetest com.jogamp.junit.sec.TestSecIOUtil01 2>&1 | tee -a $LOG -- cgit v1.2.3