Title | Code signing is unnecessary |
Date | 25-Feb-2006 01:04:17 EET |
Version | 2.3 |
Submitter | 89.55.177.112 |
Bug criticality | LightBug |
Browser version | |
Bug status | NotReallyBug |
PageProvider used | |
Servlet Container | Tomcat 5.5 |
Operating System | Win32, Linux |
URL | |
Java version | 5.0 |
JSPWiki uses jspwiki.policy entries like ({) grant signedBy "jspwiki" principal com.ecyrd.jspwiki.auth.authorize.Role "Asserted" (})
The signedBy is unnecessary, it suffices to grant to principals.
I deleted all signedBy "jspwiki", the security code still works. I tested Sun JDK 5.0 with XP and Linux.
The signing makes development unnecessarily difficult.
This is not a bug, because code-signing is needed to support certain deployment scenarios. This is perhaps a slight impediment to development, but I think we've done the best we can to make code-signing easy. The Ant scripts will auto-generate a key for you (with sensible defaults) whenever you build JSPWiki from scratch. So I think the comment "unnecessarily difficult" is a little harsh.
As for why we need to do code-signing, it's NOT necessary in the default case where you drop a WAR into a servlet container and use JSPWiki as a single, stand-alone wiki. But for multi-wiki deployments in the same container, or for those cases where the implementer wishes to specify an external security policy file, then we need our code to be signed. Specifically, it has to do with the way Permission classes are loaded and evaluated by the Java access control classes. JSPWiki makes extensive use of custom Permission types (PagePermission, WikiPermission and AllPermission).
Here's an excerpt from the definitive book, Inside Java 2 Platform Security, 2nd Edition, by Li Gong, that explains why this is so:
Many Permission classes referenced by the policy configuration exist locally. That is, those classes can be discovered by the Policy provider's defining class loader or another loader it delegates to, such as the bootstrap class loader. Objects for such permissions can be instantiated during Policy initialization. For example, it is always possible to instantiate a java.io.FilePermission, as the FilePermission class is bound on the bootstrap class path.
However, [it is possible that] when the Policy object is constructed, the code that implements a particular Permission class has yet to be loaded or is not available for loading. For example, a referenced Permission class might be in a JAR file that will eventually be downloaded. In this case, the Permission has yet to be defined within the Java runtime environment. For such a class, an UnresolvedPermission object is instantiated instead, as a placeholder that contains information about the permission... Unresolved permissions of a particular type must be resolved before an access control decision can be made about a permission of the actual type... To resolve an UnresolvedPermission, the policy decision point must locate and instantiate the appropriate permission class type...
A few methods... in the UnresolvedPermission class are
public UnresolvedPermission(String type, String name, String actions, java.security.cert.Certificate certs[]); public boolean implies(Permission p); public boolean equals(Object obj);
Note that the constructor takes an array of certificates, which can be used to verify the signatures on the permission class. Remember that UnresolvedPermissions enable the deferred loading of permission classes so that a given permission class need not be defined until necessary. The very nature of such permission classes suggests that a more rigorous mechanism is required to ensure their authenticity. By signing a given permission class and specifying the signing requirement in the security policy, we have a foundation that can be used to assure us that the permission class respects the intentions of the root class java.security.Permission and that the implementation is not malicious. Of course, this assurance depends on the trust conveyed by the signature keys used to sign the class. However, without this mechanism, it would be up to the application to make this trust decision, which would be difficult, if not impossible, for the application to do. [emphasis mine]
Thus -- the logic works like this...
If the classes containing our custom permissions are all loaded before the Policy is set, then we don't need to sign them. For stand-alone, out-of-the-box JSPWiki implementations that do not also specify an external policy file via the java.security.policy system property at startup, all classes will be loaded before JSPWiki sets its custom policy.
However, it is not safe to assume that all environments work this way. In some (mine, for instance), the admin will wish to set the policy file manually. In this case, the JSPWiki Permission classes will not be available to the Java Policy object at JVM startup. Thus, they are instantiated initially as UnresolvedPermission instances. Therefore, we must have our JAR signed in order for them to become "resolved."
P.S. Li Gong's book is outstanding, by the way, and I recommend it to anyone who wishes to explore the innards of Java security. Took me several read-throughs to really grok it, but it was well worth the effort.
-- Andrew Jaquith, 29 March 2006
http://dvd.1golod.org/ken-park-dvd-uncensored.html ken park dvd uncensored
http://dvd.1golod.org/kawasaki-portable-dvd-player.html
kawasaki portable dvd player
http://dvd.1golod.org/kawasaki-9inch-dvd-pvs10921.html
kawasaki 9inch dvd pvs10921
http://dvd.1golod.org/kacey-dvd.html
kacey dvd
http://dvd.1golod.org/jvc-dvd-players.html
jvc dvd players
http://dvd.1golod.org/jvc-dvd-mp3.html
jvc dvd mp3
http://dvd.1golod.org/jvc-combo-dvd-vcr.html
jvc combo dvd vcr
http://dvd.1golod.org/joueurs-portatifs-initiaux-de-dvd-en-vente.html
joueurs portatifs initiaux de dvd en vente
http://dvd.1golod.org/joueur-libre-de-logiciel-de-dvd.html
joueur libre de logiciel de dvd
http://dvd.1golod.org/joueur-de-dvd-de-l-audiovox-d1800-portatif.html
joueur de dvd de l audiovox d1800 portatif
http://dvd.1golod.org/joueur-de-dvd-d-orbite.html
joueur de dvd d orbite
http://dvd.1golod.org/john-doe-the-series-dvd.html
john doe the series dvd
http://dvd.1golod.org/johannes-weidenmueller-dvd.html
johannes weidenmueller dvd
http://dvd.1golod.org/jeu-de-secours-ps2-r-de-dvd.html
jeu de secours ps2 r de dvd
http://dvd.1golod.org/japanese-cooking-dvd.html
japanese cooking dvd
http://dvd.1golod.org/janq-dvd-discs.html
janq dvd discs
http://dvd.1golod.org/izakaya-yuurei-dvd.html
izakaya yuurei dvd
http://dvd.1golod.org/itunes-to-dvd.html
itunes to dvd
http://dvd.1golod.org/ionics-ems-dvd-drive.html
ionics ems dvd drive
http://dvd.1golod.org/interviews-with-bob-dvd.html
interviews with bob dvd
http://dvd.1golod.org/international-on98p-dvd-player.html
international on98p dvd player
http://dvd.1golod.org/internal-dvd-drive.html
internal dvd drive
http://dvd.1golod.org/internal-dvd-burner.html
internal dvd burner
http://dvd.1golod.org/instruction-manual-for-ch-dvd-320.html
instruction manual for ch dvd 320
http://dvd.1golod.org/install-osx-tiger-without-dvd-drive.html
install osx tiger without dvd drive
http://dvd.1golod.org/install-configure-dvd-drives.html
install configure dvd drives
http://dvd.1golod.org/inspector-alleyn-mysteries-dvd-region-2.html
inspector alleyn mysteries dvd region 2
http://dvd.1golod.org/innovatek-dvd-players-price.html
innovatek dvd players price
http://dvd.1golod.org/initial-dvd-dvd5820.html
initial dvd dvd5820
http://dvd.1golod.org/in-search-of-on-dvd.html
in search of on dvd
http://dvd.1golod.org/imtoo-dvd-to-mp4-converter-serial-number.html
imtoo dvd to mp4 converter serial number
http://dvd.1golod.org/imtoo-dvd-to-mp4-converter-keygen.html
imtoo dvd to mp4 converter keygen
http://dvd.1golod.org/imtoo-dvd-to-3gp-suite-crack.html
imtoo dvd to 3gp suite crack
http://dvd.1golod.org/imtoo-dvd-ripper-4.html
imtoo dvd ripper 4
http://dvd.1golod.org/imtoo-dvd-converter.html
imtoo dvd converter
http://dvd.1golod.org/impressionen-le-dvd-d-escompte-de-wasser-d-unter.html
impressionen le dvd d escompte de wasser d unter
http://dvd.1golod.org/imagemixer-dvd-authoring-software.html
imagemixer dvd authoring software
http://dvd.1golod.org/if-----film--malcom-mcdowel--dvd.html
if film malcom mcdowel dvd
http://dvd.1golod.org/i-need-to-convert-a-movie-maker-file-to-a-dvd-file.html
i need to convert a movie maker file to a dvd file
http://dvd.1golod.org/i-need-to-conver-a-movie-maker-file-to-a-dvd-file.html
i need to conver a movie maker file to a dvd file
http://dvd.1golod.org/i-love-lucy-dvd.html
i love lucy dvd
http://dvd.1golod.org/hp-dvd-630e-total-life.html
hp dvd 630e total life
http://dvd.1golod.org/hp-dvd-630e.html
hp dvd 630e
http://dvd.1golod.org/how-to-use-windows-recovery-dvd.html
how to use windows recovery dvd
http://dvd.1golod.org/how-to-transfer-8mm-to-dvd.html
how to transfer 8mm to dvd
http://dvd.1golod.org/how-to-tell-dvd-rom.html
how to tell dvd rom
http://dvd.1golod.org/how-to-rip-dvd-to-ipod.html
how to rip dvd to ipod
http://dvd.1golod.org/how-to-rip-audio-from-a-dvd.html
how to rip audio from a dvd
http://dvd.1golod.org/how-to-retrieve-cprx-copied-dvd.html
how to retrieve cprx copied dvd
http://dvd.1golod.org/how-to-record-to-dvd-hdd-freeview.html
how to record to dvd hdd freeview
http://dvd.1golod.org/how-to-make-a-bootable-dvd.html
how to make a bootable dvd
http://dvd.1golod.org/how-to-made-dvd-with-menu.html
how to made dvd with menu
http://dvd.1golod.org/how-to-install-a-mobile-dvd-system.html
how to install a mobile dvd system
http://dvd.1golod.org/how-to-install-a-dvd-drive-into-a-xp-computer.html
how to install a dvd drive into a xp computer
http://dvd.1golod.org/how-to-encrypt-dvd.html
how to encrypt dvd
http://dvd.1golod.org/how-to-drag-and-drop-dvd-rw.html
how to drag and drop dvd rw
http://dvd.1golod.org/how-to-copy-a-dvd-with-copy-protection.html
how to copy a dvd with copy protection
http://dvd.1golod.org/how-to-convert-mpg-files-to-dvd-files.html
how to convert mpg files to dvd files
http://dvd.1golod.org/how-to-connect-two-tv-dvd-player.html
how to connect two tv dvd player
http://dvd.1golod.org/how-to-connect-tv-dvd-foxtel-video-together.html
how to connect tv dvd foxtel video together
http://dvd.1golod.org/how-to-clean-dvd-heads.html
how to clean dvd heads
http://dvd.1golod.org/how-to-change-a-format-on-a-music-dvd.html
how to change a format on a music dvd
http://dvd.1golod.org/how-to-backup-os-x-dvd-to-cd.html
how to backup os x dvd to cd
http://dvd.1golod.org/how-put-large-files-on-dvd.html
how put large files on dvd
http://dvd.1golod.org/how-do-i-copy-a-copy-protected-dvd-.html
how do i copy a copy protected dvd
http://dvd.1golod.org/how-do-i-burn-vhs-to-dvd-on-computer.html
how do i burn vhs to dvd on computer
http://dvd.1golod.org/hot-dvd.html
hot dvd
http://dvd.1golod.org/hostel-dvd-at-walmart.html
hostel dvd at walmart
http://dvd.1golod.org/hook-up-vcr-to-dvd-player.html
hook up vcr to dvd player
http://dvd.1golod.org/hook-up-vcr-to-dvd-plater.html
hook up vcr to dvd plater
http://dvd.1golod.org/hong-kong-adult-dvd.html
hong kong adult dvd
http://dvd.1golod.org/hon-hai-precision-dvd-dhw-1160.html
hon hai precision dvd dhw 1160
http://dvd.1golod.org/homemade-sex-dvd.html
homemade sex dvd
http://dvd.1golod.org/home-moives-on-dvd.html
home moives on dvd
http://dvd.1golod.org/hogtie-dvd-bondage.html
hogtie dvd bondage
http://dvd.1golod.org/hogans-heroes-dvd.html
hogans heroes dvd
http://dvd.1golod.org/hitachi-dvd-cam.html
hitachi dvd cam
http://dvd.1golod.org/history-channel-dvd.html
history channel dvd
http://dvd.1golod.org/high-capacity-dvd-holder.html
high capacity dvd holder
http://dvd.1golod.org/hercules-10th-anniversary-dvd.html
hercules 10th anniversary dvd
http://dvd.1golod.org/herbie-fully-loaded-dvd.html
herbie fully loaded dvd
http://dvd.1golod.org/helios-dvd.html
helios dvd
http://dvd.1golod.org/heavenly-creatures-dvd.html
heavenly creatures dvd
http://dvd.1golod.org/heather-lere-dvd.html
heather lere dvd
http://dvd.1golod.org/heart-of-gold--buy-the-dvd.html
heart of gold buy the dvd
http://dvd.1golod.org/heart-like-a-wheel-dvd.html
heart like a wheel dvd
http://dvd.1golod.org/heardrest-screen-dvd-north-england.html
heardrest screen dvd north england
http://dvd.1golod.org/headrest-dvd-used.html
headrest dvd used
http://dvd.1golod.org/hd-quality-dvd-player-on-laptop.html
hd quality dvd player on laptop
http://dvd.1golod.org/hd-dvd-player-wont-play-.html
hd dvd player wont play
http://dvd.1golod.org/hbo-s-the-wire-3rd-season-on-dvd.html
hbo s the wire 3rd season on dvd
http://dvd.1golod.org/harvard-man-dvd-used.html
harvard man dvd used
http://dvd.1golod.org/harry-potter-and-the-sorcerer-stone-dvd.html
harry potter and the sorcerer stone dvd
http://dvd.1golod.org/harrowhouse-dvd.html
harrowhouse dvd
http://dvd.1golod.org/hack-dvd-menus-with-toast-7.html
hack dvd menus with toast 7
http://dvd.1golod.org/ha-dvd-burner.html
ha dvd burner
http://dvd.1golod.org/h-i-m--dvd.html
h i m dvd
http://dvd.1golod.org/gymstick-dvd.html
gymstick dvd
http://dvd.1golod.org/gt-pro-dvd-storage.html
gt pro dvd storage
http://dvd.1golod.org/grey-s-anatomy-dvd.html
grey s anatomy dvd
http://dvd.1golod.org/go-video-portable-dvd-player.html
go video portable dvd player
http://dvd.1golod.org/glory-road-dvd.html
glory road dvd
http://dvd.1golod.org/gia-carangi-the-self-destruction-of-gia-dvd.html
gia carangi the self destruction of gia dvd
http://dvd.1golod.org/get-smart-why-not-on-dvd.html
get smart why not on dvd
http://dvd.1golod.org/get-smart-tv-show-dvd.html
get smart tv show dvd
http://dvd.1golod.org/gay-rimming-dvd.html
gay rimming dvd
http://dvd.1golod.org/gay-dvd-shop-graz-wolfi.html
gay dvd shop graz wolfi
http://dvd.1golod.org/gateway-200x-dvd-driver.html
gateway 200x dvd driver
http://dvd.1golod.org/fujitsu-laptop-dvd-drivers.html
fujitsu laptop dvd drivers
http://dvd.1golod.org/freeware-pc-dvd-player.html
freeware pc dvd player
http://dvd.1golod.org/freeware-mpeg-to-dvd-converter.html
freeware mpeg to dvd converter
http://dvd.1golod.org/freeware-dvd-frame-grabber.html
freeware dvd frame grabber
http://dvd.1golod.org/freeware-dvd-copier.html
freeware dvd copier
http://dvd.1golod.org/free-windows-video-to-dvd-converter.html
free windows video to dvd converter
http://dvd.1golod.org/free-windows-media-player-dvd-decoder.html
free windows media player dvd decoder
http://dvd.1golod.org/free-trial-adult-dvd-rent.html
free trial adult dvd rent
http://dvd.1golod.org/free-selfformatting-dvd-copiers.html
free selfformatting dvd copiers
http://dvd.1golod.org/free-r-kelly-porn-dvd-download.html
free r kelly porn dvd download
http://dvd.1golod.org/free-porn-semen-sippers-dvd-direct.html
free porn semen sippers dvd direct
http://dvd.1golod.org/free-music-video-dvd.html
free music video dvd
http://dvd.1golod.org/free-guitat-lesson-video-dvd.html
free guitat lesson video dvd
http://dvd.1golod.org/free-full-version-dvd-player.html
free full version dvd player
http://dvd.1golod.org/free-ebook-dvd-cover-creation-software.html
free ebook dvd cover creation software
http://dvd.1golod.org/free-dvd-x-copy-platinum-download.html
free dvd x copy platinum download
http://dvd.1golod.org/free-dvd-upgrade.html
free dvd upgrade
http://dvd.1golod.org/free-dvd-trailers-for-xxx-movies.html
free dvd trailers for xxx movies
http://dvd.1golod.org/free-dvd-to-avi-convert.html
free dvd to avi convert
http://dvd.1golod.org/free-dvd-search-engine.html
free dvd search engine
http://dvd.1golod.org/free-dvd-ripper-mp3.html
free dvd ripper mp3
http://dvd.1golod.org/free-dvd-rip-hack.html
free dvd rip hack
http://dvd.1golod.org/free-dvd-porn.html
free dvd porn
http://dvd.1golod.org/free-dvd-plug-in-download.html
free dvd plug in download
http://dvd.1golod.org/free-dvd-player-for-xp.html
free dvd player for xp
http://dvd.1golod.org/free-dvd-player-for-computer.html
free dvd player for computer
http://dvd.1golod.org/free-dvd-movie.html
free dvd movie
http://dvd.1golod.org/free-dvd-decrypt-software.html
free dvd decrypt software
http://dvd.1golod.org/free-dvd-data-reader.html
free dvd data reader
http://dvd.1golod.org/free-dvd-burning-programs-download.html
free dvd burning programs download
http://dvd.1golod.org/free-dvd-burner-crack.html
free dvd burner crack
http://dvd.1golod.org/free-dvd-backup.html
free dvd backup
http://dvd.1golod.org/free-downlaod-of-power-dvd-player.html
free downlaod of power dvd player
http://dvd.1golod.org/free-computer-dvd-player-software.html
free computer dvd player software
http://dvd.1golod.org/freddy-mercury-dvd.html
freddy mercury dvd
http://dvd.1golod.org/fox-dvd-sequel.html
fox dvd sequel
http://dvd.1golod.org/forum-de-xpress-de-copie-du-dvd-x.html
forum de xpress de copie du dvd x
http://dvd.1golod.org/forum-de-copie-du-dvd-1click.html
forum de copie du dvd 1click
http://dvd.1golod.org/format-avi-mpg-mpeg-to-dvd-video-files.html
format avi mpg mpeg to dvd video files
http://dvd.1golod.org/foreign-film-on-dvd.html
foreign film on dvd
http://dvd.1golod.org/forced-cuckold-dvd.html
forced cuckold dvd
http://dvd.1golod.org/forced-bisexuality-dvd.html
forced bisexuality dvd
http://dvd.1golod.org/first-movie-commercially-released-on-dvd.html
first movie commercially released on dvd
http://dvd.1golod.org/first-dvd-player.html
first dvd player
http://dvd.1golod.org/firmware-download-region-free-hp-dvd-writer-400c.html
firmware download region free hp dvd writer 400c
http://dvd.1golod.org/finding-home-dvd.html
finding home dvd
http://dvd.1golod.org/final-fuck-x-dvd.html
final fuck x dvd
http://dvd.1golod.org/fedora-core-dvd-download.html
fedora core dvd download
http://dvd.1golod.org/father-corapi-dvd.html
father corapi dvd
http://dvd.1golod.org/fastest-dvd-ripping-program.html
fastest dvd ripping program
http://dvd.1golod.org/family-guy--uncovered-dvd-review.html
family guy uncovered dvd review
http://dvd.1golod.org/family-feud-dvd.html
family feud dvd
http://dvd.1golod.org/fahrenheit-game-dvd-image.html
fahrenheit game dvd image
http://dvd.1golod.org/eye-of-the-beholder-dvd.html
eye of the beholder dvd
http://dvd.1golod.org/external-dvd---rw-drives.html
external dvd rw drives
http://dvd.1golod.org/extended-dvd.html
extended dvd
http://dvd.1golod.org/explain-dvd-types.html
explain dvd types