Start working again on hardening.

[lgpl/argeo-commons.git] / org.argeo.cms / src / org / argeo / cms / internal / kernel / SecurityProfile.java

diff --git a/org.argeo.cms/src/org/argeo/cms/internal/kernel/SecurityProfile.java b/org.argeo.cms/src/org/argeo/cms/internal/kernel/SecurityProfile.java
index 358b212b1cbaf765690f44afbcfea7df399944b3..e2683af678ff2b030d4df4409cff7aa029f7eb98 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/internal/kernel/SecurityProfile.java
+++ b/org.argeo.cms/src/org/argeo/cms/internal/kernel/SecurityProfile.java
@@ -6,9 +6,6 @@ import java.net.SocketPermission;
 import java.security.AllPermission;
 import java.util.PropertyPermission;
 
-import javax.management.MBeanPermission;
-import javax.management.MBeanServerPermission;
-import javax.management.MBeanTrustPermission;
 import javax.security.auth.AuthPermission;
 
 import org.osgi.framework.AdminPermission;
@@ -22,10 +19,10 @@ import org.osgi.service.condpermadmin.ConditionInfo;
 import org.osgi.service.condpermadmin.ConditionalPermissionAdmin;
 import org.osgi.service.condpermadmin.ConditionalPermissionInfo;
 import org.osgi.service.condpermadmin.ConditionalPermissionUpdate;
+import org.osgi.service.permissionadmin.PermissionAdmin;
 import org.osgi.service.permissionadmin.PermissionInfo;
 
-import bitronix.tm.BitronixTransactionManager;
-
+/** Security profile based on OSGi {@link PermissionAdmin}. */
 public interface SecurityProfile {
        BundleContext bc = FrameworkUtil.getBundle(SecurityProfile.class).getBundleContext();
 
@@ -107,15 +104,15 @@ public interface SecurityProfile {
 //                             ConditionalPermissionInfo.ALLOW));
 
                // Bitronix
-               update.getConditionalPermissionInfos().add(permissionAdmin.newConditionalPermissionInfo(null,
-                               new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
-                                               new String[] { locate(BitronixTransactionManager.class) }) },
-                               new PermissionInfo[] { new PermissionInfo(PropertyPermission.class.getName(), "bitronix.tm.*", "read"),
-                                               new PermissionInfo(RuntimePermission.class.getName(), "getClassLoader", null),
-                                               new PermissionInfo(MBeanServerPermission.class.getName(), "createMBeanServer", null),
-                                               new PermissionInfo(MBeanPermission.class.getName(), "bitronix.tm.*", "registerMBean"),
-                                               new PermissionInfo(MBeanTrustPermission.class.getName(), "register", null) },
-                               ConditionalPermissionInfo.ALLOW));
+//             update.getConditionalPermissionInfos().add(permissionAdmin.newConditionalPermissionInfo(null,
+//                             new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
+//                                             new String[] { locate(BitronixTransactionManager.class) }) },
+//                             new PermissionInfo[] { new PermissionInfo(PropertyPermission.class.getName(), "bitronix.tm.*", "read"),
+//                                             new PermissionInfo(RuntimePermission.class.getName(), "getClassLoader", null),
+//                                             new PermissionInfo(MBeanServerPermission.class.getName(), "createMBeanServer", null),
+//                                             new PermissionInfo(MBeanPermission.class.getName(), "bitronix.tm.*", "registerMBean"),
+//                                             new PermissionInfo(MBeanTrustPermission.class.getName(), "register", null) },
+//                             ConditionalPermissionInfo.ALLOW));
 
                // DS
                Bundle dsBundle = findBundle("org.eclipse.equinox.ds");
@@ -135,7 +132,7 @@ public interface SecurityProfile {
                                ConditionalPermissionInfo.ALLOW));
 
                // Jetty
-               Bundle jettyUtilBundle = findBundle("org.eclipse.equinox.http.jetty");
+               // Bundle jettyUtilBundle = findBundle("org.eclipse.equinox.http.jetty");
                update.getConditionalPermissionInfos().add(permissionAdmin.newConditionalPermissionInfo(null,
                                new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
                                                new String[] { "*/org.eclipse.jetty.*" }) },
@@ -144,42 +141,42 @@ public interface SecurityProfile {
                                ConditionalPermissionInfo.ALLOW));
 
                // Blueprint
-               Bundle blueprintBundle = findBundle("org.eclipse.gemini.blueprint.core");
-               update.getConditionalPermissionInfos()
-                               .add(permissionAdmin.newConditionalPermissionInfo(null,
-                                               new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
-                                                               new String[] { blueprintBundle.getLocation() }) },
-                                               new PermissionInfo[] { new PermissionInfo(RuntimePermission.class.getName(), "*", null),
-                                                               new PermissionInfo(AdminPermission.class.getName(), "*", "*"), },
-                                               ConditionalPermissionInfo.ALLOW));
-               Bundle blueprintExtenderBundle = findBundle("org.eclipse.gemini.blueprint.extender");
-               update.getConditionalPermissionInfos()
-                               .add(permissionAdmin
-                                               .newConditionalPermissionInfo(null,
-                                                               new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
-                                                                               new String[] { blueprintExtenderBundle.getLocation() }) },
-                                                               new PermissionInfo[] { new PermissionInfo(RuntimePermission.class.getName(), "*", null),
-                                                                               new PermissionInfo(PropertyPermission.class.getName(), "org.eclipse.gemini.*",
-                                                                                               "read"),
-                                                                               new PermissionInfo(AdminPermission.class.getName(), "*", "*"),
-                                                                               new PermissionInfo(ServicePermission.class.getName(), "*", "register"), },
-                                                               ConditionalPermissionInfo.ALLOW));
-               Bundle springCoreBundle = findBundle("org.springframework.core");
-               update.getConditionalPermissionInfos()
-                               .add(permissionAdmin.newConditionalPermissionInfo(null,
-                                               new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
-                                                               new String[] { springCoreBundle.getLocation() }) },
-                                               new PermissionInfo[] { new PermissionInfo(RuntimePermission.class.getName(), "*", null),
-                                                               new PermissionInfo(AdminPermission.class.getName(), "*", "*"), },
-                                               ConditionalPermissionInfo.ALLOW));
-               Bundle blueprintIoBundle = findBundle("org.eclipse.gemini.blueprint.io");
-               update.getConditionalPermissionInfos()
-                               .add(permissionAdmin.newConditionalPermissionInfo(null,
-                                               new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
-                                                               new String[] { blueprintIoBundle.getLocation() }) },
-                                               new PermissionInfo[] { new PermissionInfo(RuntimePermission.class.getName(), "*", null),
-                                                               new PermissionInfo(AdminPermission.class.getName(), "*", "*"), },
-                                               ConditionalPermissionInfo.ALLOW));
+//             Bundle blueprintBundle = findBundle("org.eclipse.gemini.blueprint.core");
+//             update.getConditionalPermissionInfos()
+//                             .add(permissionAdmin.newConditionalPermissionInfo(null,
+//                                             new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
+//                                                             new String[] { blueprintBundle.getLocation() }) },
+//                                             new PermissionInfo[] { new PermissionInfo(RuntimePermission.class.getName(), "*", null),
+//                                                             new PermissionInfo(AdminPermission.class.getName(), "*", "*"), },
+//                                             ConditionalPermissionInfo.ALLOW));
+//             Bundle blueprintExtenderBundle = findBundle("org.eclipse.gemini.blueprint.extender");
+//             update.getConditionalPermissionInfos()
+//                             .add(permissionAdmin
+//                                             .newConditionalPermissionInfo(null,
+//                                                             new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
+//                                                                             new String[] { blueprintExtenderBundle.getLocation() }) },
+//                                                             new PermissionInfo[] { new PermissionInfo(RuntimePermission.class.getName(), "*", null),
+//                                                                             new PermissionInfo(PropertyPermission.class.getName(), "org.eclipse.gemini.*",
+//                                                                                             "read"),
+//                                                                             new PermissionInfo(AdminPermission.class.getName(), "*", "*"),
+//                                                                             new PermissionInfo(ServicePermission.class.getName(), "*", "register"), },
+//                                                             ConditionalPermissionInfo.ALLOW));
+//             Bundle springCoreBundle = findBundle("org.springframework.core");
+//             update.getConditionalPermissionInfos()
+//                             .add(permissionAdmin.newConditionalPermissionInfo(null,
+//                                             new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
+//                                                             new String[] { springCoreBundle.getLocation() }) },
+//                                             new PermissionInfo[] { new PermissionInfo(RuntimePermission.class.getName(), "*", null),
+//                                                             new PermissionInfo(AdminPermission.class.getName(), "*", "*"), },
+//                                             ConditionalPermissionInfo.ALLOW));
+//             Bundle blueprintIoBundle = findBundle("org.eclipse.gemini.blueprint.io");
+//             update.getConditionalPermissionInfos()
+//                             .add(permissionAdmin.newConditionalPermissionInfo(null,
+//                                             new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
+//                                                             new String[] { blueprintIoBundle.getLocation() }) },
+//                                             new PermissionInfo[] { new PermissionInfo(RuntimePermission.class.getName(), "*", null),
+//                                                             new PermissionInfo(AdminPermission.class.getName(), "*", "*"), },
+//                                             ConditionalPermissionInfo.ALLOW));
 
                // Equinox
                Bundle registryBundle = findBundle("org.eclipse.equinox.registry");
@@ -257,16 +254,14 @@ public interface SecurityProfile {
                                                                new PermissionInfo(AdminPermission.class.getName(), "*", "*") },
                                                ConditionalPermissionInfo.ALLOW));
                Bundle luceneBundle = findBundle("org.apache.lucene");
-               update.getConditionalPermissionInfos()
-                               .add(permissionAdmin.newConditionalPermissionInfo(null,
-                                               new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
-                                                               new String[] { luceneBundle.getLocation() }) },
-                                               new PermissionInfo[] {
-                                                               new PermissionInfo(FilePermission.class.getName(), "<<ALL FILES>>",
-                                                                               "read,write,delete"),
-                                                               new PermissionInfo(PropertyPermission.class.getName(), "*", "read"),
-                                                               new PermissionInfo(AdminPermission.class.getName(), "*", "*") },
-                                               ConditionalPermissionInfo.ALLOW));
+               update.getConditionalPermissionInfos().add(permissionAdmin.newConditionalPermissionInfo(null,
+                               new ConditionInfo[] { new ConditionInfo(BundleLocationCondition.class.getName(),
+                                               new String[] { luceneBundle.getLocation() }) },
+                               new PermissionInfo[] {
+                                               new PermissionInfo(FilePermission.class.getName(), "<<ALL FILES>>", "read,write,delete"),
+                                               new PermissionInfo(PropertyPermission.class.getName(), "*", "read"),
+                                               new PermissionInfo(AdminPermission.class.getName(), "*", "*") },
+                               ConditionalPermissionInfo.ALLOW));
 
                // COMMIT
                update.commit();