Java 2 security WebSphere 7 AccessControlException in OSGILauncher

Java 2 security WebSphere 7 AccessControlException in OSGILauncher 
 
On startup of a WebSphere application containing BIRT with Java 2 security enabled AccessControlExceptions occur. 
 
 
config.ini contains an entry for eclipse.security as follows. 
eclipse.security=java.security.Policy 
 
The behaviour of the application does not change for different values for eclipse.security. 
A different AccessControlException occurs if it does not exist in this file 
 
 
was.policy contents for the webComponent section includes 
permission java.security.SecurityPermission "setPolicy"; 
 
 
The application logs include the following stacktrace: 
 
[11/22/11 10:55:20:432 GMT] 0000000a SecurityManag W SECJ0314W: Current Java 2 Security policy reported a potential violation of Java 2 Security Permission. Refer to the InfoCenter for further information. 
 
Permission: 
 
setPolicy : Access denied (java.security.SecurityPermission setPolicy) 
 
 
Code: 
 
org.eclipse.birt.core.framework.osgi.OSGILauncher in {file:/var/WebSphere7/profiles/Dev1Profile/installedApps/Dev1Cell/example.ear/example.war/WEB-INF/lib/core-api-2.6.0.jar} 
 
 
 
Stack Trace: 
 
java.security.AccessControlException: Access denied (java.security.SecurityPermission setPolicy) 
at java.security.AccessController.checkPermission(AccessController.java:108) 
at java.lang.SecurityManager.checkPermission(SecurityManager.java:544) 
at com.ibm.ws.security.core.SecurityManager.checkPermission(SecurityManager.java:206) 
at java.security.Policy.checkSecurityPermission(Policy.java:245) 
at java.security.Policy.setPolicy(Policy.java:537) 
at org.eclipse.birt.core.framework.osgi.OSGILauncher.setupSecurityPolicy(OSGILauncher.java:725) 
at org.eclipse.birt.core.framework.osgi.OSGILauncher.doStartup(OSGILauncher.java:163) 
at org.eclipse.birt.core.framework.osgi.OSGILauncher.access$0(OSGILauncher.java:94) 
at org.eclipse.birt.core.framework.osgi.OSGILauncher$1.run(OSGILauncher.java:79) 
at java.security.AccessController.doPrivileged(AccessController.java:251) 
at org.eclipse.birt.core.framework.osgi.OSGILauncher.startup(OSGILauncher.java:75) 
at org.eclipse.birt.core.framework.Platform.startup(Platform.java:79) 
at com.example.reporting.engine.ReportGenerator.<init>(ReportGenerator.java:103) 
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:56) 
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:39) 
 
 
2011-11-22 10:55:20,538 [Reporting] SEVERE The BIRT Report Platform threw an error: Can not startup the OSGI framework 
2011-11-22 10:55:20,539 [Reporting] FINER THROW org.eclipse.birt.core.exception.BirtException: Can not startup the OSGI framework 
at org.eclipse.birt.core.framework.Platform.startup(Platform.java:91) 
at com.example.reporting.engine.ReportGenerator.<init>(ReportGenerator.java:103) 
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:56) 
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:39) 
at java.lang.reflect.Constructor.newInstance(Constructor.java:527) 
at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:100) 
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:87) 
at org.springframework.beans.factory.support.ConstructorResolver.autowireConstructor(ConstructorResolver.java:248) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireConstructor(AbstractAutowireCapableBeanFactory.java:925) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:835) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:440) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory$1.run(AbstractAutowireCapableBeanFactory.java:409) 
at java.security.AccessController.doPrivileged(AccessController.java:224) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:380) 
at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:264) 
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:206) 
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:261) 
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:185) 
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:164) 
at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:269) 
at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:104) 
at org.springframework.beans.factory.support.ConstructorResolver.resolveConstructorArguments(ConstructorResolver.java:479) 
at org.springframework.beans.factory.support.ConstructorResolver.autowireConstructor(ConstructorResolver.java:162) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireConstructor(AbstractAutowireCapableBeanFactory.java:925) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:835) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:440) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory$1.run(AbstractAutowireCapableBeanFactory.java:409) 
at java.security.AccessController.doPrivileged(AccessController.java:224) 
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:380) 
at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:264) 
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:206) 
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:261) 
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:185) 
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:164) 
at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:429) 
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:728) 
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:380) 
at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:255) 
at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:199) 
at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:45) 
at com.ibm.ws.webcontainer.webapp.WebApp.notifyServletContextCreated(WebApp.java:1707) 
at com.ibm.ws.webcontainer.webapp.WebApp.commonInitializationFinish(WebApp.java:380) 
at com.ibm.ws.webcontainer.webapp.WebAppImpl.initialize(WebAppImpl.java:299) 
at com.ibm.ws.webcontainer.webapp.WebGroupImpl.addWebApplication(WebGroupImpl.java:100) 
at com.ibm.ws.webcontainer.VirtualHostImpl.addWebApplication(VirtualHostImpl.java:166) 
at com.ibm.ws.webcontainer.WSWebContainer.addWebApp(WSWebContainer.java:731) 
at com.ibm.ws.webcontainer.WSWebContainer.addWebApplication(WSWebContainer.java:616) 
at com.ibm.ws.webcontainer.component.WebContainerImpl.install(WebContainerImpl.java:376) 
at com.ibm.ws.webcontainer.component.WebContainerImpl.start(WebContainerImpl.java:668) 
at com.ibm.ws.runtime.component.ApplicationMgrImpl.start(ApplicationMgrImpl.java:1123) 
at com.ibm.ws.runtime.component.DeployedApplicationImpl.fireDeployedObjectStart(DeployedApplicationImpl.java:1319) 
at com.ibm.ws.runtime.component.DeployedModuleImpl.start(DeployedModuleImpl.java:610) 
at com.ibm.ws.runtime.component.DeployedApplicationImpl.start(DeployedApplicationImpl.java:944) 
at com.ibm.ws.runtime.component.ApplicationMgrImpl.startApplication(ApplicationMgrImpl.java:726) 
at com.ibm.ws.runtime.component.ApplicationMgrImpl.start(ApplicationMgrImpl.java:2048) 
at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.start(CompositionUnitMgrImpl.java:441) 
at com.ibm.ws.runtime.component.CompositionUnitImpl.start(CompositionUnitImpl.java:123) 
at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.start(CompositionUnitMgrImpl.java:384) 
at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.access$300(CompositionUnitMgrImpl.java:112) 
at com.ibm.ws.runtime.component.CompositionUnitMgrImpl$CUInitializer.run(CompositionUnitMgrImpl.java:951) 
at com.ibm.wsspi.runtime.component.WsComponentImpl$_AsynchInitializer.run(WsComponentImpl.java:349) 
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1604) 
Caused by: org.eclipse.birt.core.exception.CoreException: org.eclipse.birt.core.framework.FrameworkException: Can not start up OSGI - Access denied (java.security.SecurityPermission setPolicy) 
at org.eclipse.birt.core.framework.osgi.OSGILauncher.startup(OSGILauncher.java:90) 
at org.eclipse.birt.core.framework.Platform.startup(Platform.java:79) 
... 62 more 
 
 
Adding 
permission java.security.AllPermission; 
to the webComponent section of was.policy allows the application to start successfully. 
 
This implies that the permission java.security.SecurityPermission "setPolicy"; entry in was.policy was ignored but that permission java.security.AllPermission; worked. 
 
Can anyone explain this behaviour? 
 
What are the correct values for config.ini to allow deployment of a web application which includes BIRT to be deployed in WebSphere 7 with Java 2 security enabled and a was.policy with fine grained security permissions? 
 
Thanks 
 
Ian

Find more posts tagged with

Comments

JasonW

have you read over this bugzilla entry?
https://bugs.eclipse.org/bugs/show_bug.cgi?id=182161

Jason

idp

Jason

Thanks for the reply. I have looked at the bugzilla entry. These links were also useful

http://log.illsley.org/2010/11/29/osgi-java-security-manager-and-keeping-things-simple/
http://publib.boulder.ibm.com/infocenter/wasinfo/fep/index.jsp?topic=/com.ibm.websphere.osgifep.multiplatform.doc/topics/ca_java2sec.html

http://publib.boulder.ibm.com/infocenter/wasinfo/fep/index.jsp?topic=/com.ibm.websphere.osgifep.multiplatform.doc/topics/thread_ta_dev_deployapp.html

This looks like an OSGI/WAS permissions issue. AllPermission is not accepted for a production deployment.
I am going to restructure the deployment to use an EBA asset and grant permissions through permission.perm in OSGI-INF

Thanks for your help

Regards

Ian

JasonW

Ian,

It would be great if an update on how that approach works when you finish.

Jason