1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28 package net.sf.jguard.core.authorization.policy;
29
30 import java.security.AccessController;
31 import java.security.Permission;
32 import java.security.PermissionCollection;
33 import java.security.Permissions;
34 import java.security.PrivilegedAction;
35 import java.security.ProtectionDomain;
36 import java.util.Enumeration;
37 import java.util.Map;
38
39 import java.util.logging.Level;
40 import net.sf.ehcache.CacheException;
41 import net.sf.jguard.core.CoreConstants;
42 import net.sf.jguard.core.PolicyEnforcementPointOptions;
43 import net.sf.jguard.core.authorization.AuthorizationException;
44 import net.sf.jguard.core.authorization.AuthorizationHelper;
45 import net.sf.jguard.core.authorization.manager.AuthorizationManagerFactory;
46 import net.sf.jguard.core.authorization.manager.PermissionProvider;
47 import net.sf.jguard.core.authorization.permissions.AuditPermissionCollection;
48 import net.sf.jguard.core.authorization.permissions.PermissionUtils;
49 import org.slf4j.Logger;
50 import org.slf4j.LoggerFactory;
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80 public final class SingleAppPolicy extends JGuardPolicy {
81
82 private static Logger logger = LoggerFactory.getLogger(SingleAppPolicy.class.getName());
83 private static final String DEFAULT_POLICY_CONFIGURATION_FILE = "JGuardAuthorization.xml";
84
85 private PermissionProvider permissionProvider;
86 private Permissions alwaysGrantedPermissions = null;
87
88
89
90
91
92 public SingleAppPolicy() throws AuthorizationException {
93
94 alwaysGrantedPermissions = new Permissions();
95
96
97 AccessController.doPrivileged(new PrivilegedAction() {
98
99 public Object run() {
100 logger.info( "####### loading SingleAppPolicy "+JGuardPolicy.version+" ###########");
101 String configurationLocation = System.getProperty(CoreConstants.POLICY_CONFIGURATION_FILE);
102
103 if (configurationLocation == null) {
104 logger.info( "No configuration file in " + CoreConstants.POLICY_CONFIGURATION_FILE + ", using default " + DEFAULT_POLICY_CONFIGURATION_FILE + " location");
105 configurationLocation = DEFAULT_POLICY_CONFIGURATION_FILE;
106 }
107
108 String appHomePath = System.getProperty(CoreConstants.APPLICATION_HOME_PATH);
109 if(appHomePath!=null && !appHomePath.endsWith("/")){
110 appHomePath+="/";
111 }
112
113 if(appHomePath==null){
114 appHomePath="";
115 }
116
117
118 Map authorizationOptions = AuthorizationHelper.loadConfiguration(configurationLocation, appHomePath);
119
120 if (authorizationOptions.get(PolicyEnforcementPointOptions.APPLICATION_NAME.getLabel()) == null) {
121 String appNameProp = System.getProperty(CoreConstants.APPLICATION_NAME_SYSTEM_PROPERTY);
122
123 if (appNameProp != null) {
124 authorizationOptions.put(PolicyEnforcementPointOptions.APPLICATION_NAME.getLabel(), appNameProp);
125 } else {
126 String appNameJMXProp = System.getProperty("com.sun.management.jmxremote.login.config");
127
128 if (appNameJMXProp != null) {
129 authorizationOptions.put(PolicyEnforcementPointOptions.APPLICATION_NAME.getLabel(), appNameJMXProp);
130 } else {
131
132 authorizationOptions.put(PolicyEnforcementPointOptions.APPLICATION_NAME.getLabel(), CoreConstants.DEFAULT_APPLICATION_NAME);
133 }
134 }
135 }
136
137 if ("false".equals(authorizationOptions.get(CoreConstants.AUTHORIZATION_PERMISSION_RESOLUTION_CACHING))){
138 PermissionUtils.setCachesEnabled(false);
139 }else{
140
141 try {
142 PermissionUtils.createCaches();
143 PermissionUtils.setCachesEnabled(true);
144 } catch (CacheException e) {
145 logger.warn("Failed to activate permission resolution caching : " + e.getMessage());
146 PermissionUtils.setCachesEnabled(false);
147 }
148 }
149
150 try {
151 String authorizationManagerImplName =(String)authorizationOptions.get(CoreConstants.AUTHORIZATION_MANAGER);
152
153 Class clazz;
154 clazz = Thread.currentThread().getContextClassLoader().loadClass(authorizationManagerImplName);
155 AuthorizationManagerFactory.setAuthorizationManager(AuthorizationManagerFactory.createAuthorizationManager(clazz,authorizationOptions));
156 permissionProvider = AuthorizationManagerFactory.getAuthorizationManager();
157 } catch (AuthorizationException e) {
158 logger.error("AuthorizationException", e);
159 } catch (ClassNotFoundException e) {
160 logger.error("AuthorizationException", e); }
161
162 return permissionProvider;
163 }
164 });
165
166 loadDefaultPolicy();
167 }
168
169 public PermissionCollection getPermissions(ProtectionDomain protectionDomain) {
170 final ProtectionDomain fProtectionDomain = protectionDomain;
171
172
173 PermissionCollection pc = (PermissionCollection) AccessController.doPrivileged(new PrivilegedAction() {
174 public Object run() {
175 return getPermissions(fProtectionDomain, permissionProvider);
176 }
177 });
178
179 PermissionCollection mergedPc = PermissionUtils.mergePermissionCollections(pc,alwaysGrantedPermissions);
180
181 mergedPc = PermissionUtils.mergePermissionCollections(mergedPc,getPermissions(protectionDomain.getCodeSource()));
182 return new AuditPermissionCollection(mergedPc,protectionDomain);
183 }
184
185 public void refresh() {
186 if (permissionProvider != null) {
187
188 permissionProvider.refresh();
189 }
190 }
191
192 @Override
193 public boolean implies(ProtectionDomain domain, Permission permission) {
194 return super.implies(domain, permission);
195 }
196
197
198
199
200
201
202
203 public void addAlwaysGrantedPermissions(ClassLoader cl,Permissions permissions){
204 Enumeration perms= permissions.elements();
205 while(perms.hasMoreElements()){
206 alwaysGrantedPermissions.add((Permission)perms.nextElement());
207 }
208 }
209 }