import java.net.URL;
import java.nio.file.Files;
import java.nio.file.Path;
+import java.security.AllPermission;
import java.util.Dictionary;
import java.util.List;
import java.util.Locale;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
import javax.security.auth.login.Configuration;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
+import org.argeo.api.ArgeoLogger;
+import org.argeo.api.NodeConstants;
+import org.argeo.api.NodeDeployment;
+import org.argeo.api.NodeInstance;
+import org.argeo.api.NodeState;
import org.argeo.cms.CmsException;
-import org.argeo.node.ArgeoLogger;
-import org.argeo.node.NodeConstants;
-import org.argeo.node.NodeDeployment;
-import org.argeo.node.NodeInstance;
-import org.argeo.node.NodeState;
+import org.argeo.ident.IdentClient;
import org.argeo.util.LangUtils;
import org.ietf.jgss.GSSCredential;
import org.osgi.framework.BundleActivator;
import org.osgi.framework.BundleContext;
import org.osgi.framework.Constants;
import org.osgi.framework.ServiceReference;
+import org.osgi.service.condpermadmin.BundleLocationCondition;
+import org.osgi.service.condpermadmin.ConditionInfo;
+import org.osgi.service.condpermadmin.ConditionalPermissionAdmin;
+import org.osgi.service.condpermadmin.ConditionalPermissionInfo;
+import org.osgi.service.condpermadmin.ConditionalPermissionUpdate;
import org.osgi.service.log.LogReaderService;
+import org.osgi.service.permissionadmin.PermissionInfo;
import org.osgi.service.useradmin.UserAdmin;
import org.osgi.util.tracker.ServiceTracker;
private static Activator instance;
+ // TODO make it configurable
+ private boolean hardened = false;
+
private BundleContext bc;
private LogReaderService logReaderService;
private CmsInstance nodeInstance;
private ServiceTracker<UserAdmin, NodeUserAdmin> userAdminSt;
+ private ExecutorService internalExecutorService;
@Override
public void start(BundleContext bundleContext) throws Exception {
instance = this;
this.bc = bundleContext;
this.logReaderService = getService(LogReaderService.class);
+ this.internalExecutorService = Executors.newFixedThreadPool(Runtime.getRuntime().availableProcessors());
try {
initSecurity();
userAdminSt = new ServiceTracker<>(instance.bc, UserAdmin.class, null);
userAdminSt.open();
- log.debug("Kernel bundle started");
+ if (log.isTraceEnabled())
+ log.trace("Kernel bundle started");
} catch (Throwable e) {
log.error("## FATAL: CMS activator failed", e);
}
// explicitly load JAAS configuration
Configuration.getConfiguration();
- // ConditionalPermissionAdmin permissionAdmin = bc
- // .getService(bc.getServiceReference(ConditionalPermissionAdmin.class));
- // ConditionalPermissionUpdate update =
- // permissionAdmin.newConditionalPermissionUpdate();
- // // Self
- // update.getConditionalPermissionInfos()
- // .add(permissionAdmin.newConditionalPermissionInfo(null,
- // new ConditionInfo[] {
- // new ConditionInfo(BundleLocationCondition.class.getName(), new
- // String[] { "*" }) },
- // new PermissionInfo[] { new
- // PermissionInfo(AllPermission.class.getName(), null, null) },
- // ConditionalPermissionInfo.ALLOW));
- //
+ // code-level permissions
+ String osgiSecurity = KernelUtils.getFrameworkProp(Constants.FRAMEWORK_SECURITY);
+ if (osgiSecurity != null && Constants.FRAMEWORK_SECURITY_OSGI.equals(osgiSecurity)) {
+ // TODO rather use a tracker?
+ ConditionalPermissionAdmin permissionAdmin = bc
+ .getService(bc.getServiceReference(ConditionalPermissionAdmin.class));
+ if (!hardened) {
+ // All permissions to all bundles
+ ConditionalPermissionUpdate update = permissionAdmin.newConditionalPermissionUpdate();
+ update.getConditionalPermissionInfos().add(permissionAdmin.newConditionalPermissionInfo(null,
+ new ConditionInfo[] {
+ new ConditionInfo(BundleLocationCondition.class.getName(), new String[] { "*" }) },
+ new PermissionInfo[] { new PermissionInfo(AllPermission.class.getName(), null, null) },
+ ConditionalPermissionInfo.ALLOW));
+ // TODO data admin permission
+// PermissionInfo dataAdminPerm = new PermissionInfo(AuthPermission.class.getName(),
+// "createLoginContext." + NodeConstants.LOGIN_CONTEXT_DATA_ADMIN, null);
+// update.getConditionalPermissionInfos().add(permissionAdmin.newConditionalPermissionInfo(null,
+// new ConditionInfo[] {
+// new ConditionInfo(BundleLocationCondition.class.getName(), new String[] { "*" }) },
+// new PermissionInfo[] { dataAdminPerm }, ConditionalPermissionInfo.DENY));
+// update.getConditionalPermissionInfos().add(permissionAdmin.newConditionalPermissionInfo(null,
+// new ConditionInfo[] {
+// new ConditionInfo(BundleSignerCondition.class.getName(), new String[] { "CN=\"Eclipse.org Foundation, Inc.\", OU=IT, O=\"Eclipse.org Foundation, Inc.\", L=Nepean, ST=Ontario, C=CA" }) },
+// new PermissionInfo[] { dataAdminPerm }, ConditionalPermissionInfo.ALLOW));
+ update.commit();
+ } else {
+ SecurityProfile securityProfile = new SecurityProfile() {
+ };
+ securityProfile.applySystemPermissions(permissionAdmin);
+ }
+ }
+
}
private void initArgeoLogger() {
if (userAdminSt != null)
userAdminSt.close();
+ internalExecutorService.shutdown();
instance = null;
this.bc = null;
this.logReaderService = null;
return (UserAdmin) getNodeUserAdmin();
}
+ public static String getHttpProxySslHeader() {
+ return KernelUtils.getFrameworkProp(NodeConstants.HTTP_PROXY_SSL_DN);
+ }
+
+ public static IdentClient getIdentClient(String remoteAddr) {
+ if (!IdentClient.isDefaultAuthdPassphraseFileAvailable())
+ return null;
+ // TODO make passphrase more configurable
+ return new IdentClient(remoteAddr);
+ }
+
private static NodeUserAdmin getNodeUserAdmin() {
NodeUserAdmin res;
try {
}
+ static ExecutorService getInternalExecutorService() {
+ return instance.internalExecutorService;
+ }
+
// static CmsSecurity getCmsSecurity() {
// return instance.nodeSecurity;
// }