Subversion Repositories Integrator Subversion

Rev

Details | Last modification | View Log | RSS feed

Rev Author Line No. Line
771 blopes 1 
<!DOCTYPE html SYSTEM "about:legacy-compat">
2 
<html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"><link href="./images/docs-stylesheet.css" rel="stylesheet" type="text/css"><title>Apache Tomcat 9 (9.0.112) - Security Manager How-To</title></head><body><div id="wrapper"><header><div id="header"><div><div><div class="logo noPrint"><a href="https://tomcat.apache.org/"><img alt="Tomcat Home" src="./images/tomcat.png"></a></div><div style="height: 1px;"></div><div class="asfLogo noPrint"><a href="https://www.apache.org/" target="_blank"><img src="./images/asf-logo.svg" alt="The Apache Software Foundation" style="width: 266px; height: 83px;"></a></div><h1>Apache Tomcat 9</h1><div class="versionInfo">
3 
            Version 9.0.112,
4 
            <time datetime="2025-11-06">Nov 6 2025</time></div><div style="height: 1px;"></div><div style="clear: left;"></div></div></div></div></header><div id="middle"><div><div id="mainLeft" class="noprint"><div><nav><div><h2>Links</h2><ul><li><a href="index.html">Docs Home</a></li><li><a href="https://cwiki.apache.org/confluence/display/TOMCAT/FAQ">FAQ</a></li></ul></div><div><h2>User Guide</h2><ul><li><a href="introduction.html">1) Introduction</a></li><li><a href="setup.html">2) Setup</a></li><li><a href="appdev/index.html">3) First webapp</a></li><li><a href="deployer-howto.html">4) Deployer</a></li><li><a href="manager-howto.html">5) Manager</a></li><li><a href="host-manager-howto.html">6) Host Manager</a></li><li><a href="realm-howto.html">7) Realms and AAA</a></li><li><a href="security-manager-howto.html">8) Security Manager</a></li><li><a href="jndi-resources-howto.html">9) JNDI Resources</a></li><li><a href="jndi-datasource-examples-howto.html">10) JDBC DataSources</a></li><li><a href="class-loader-howto.html">11) Classloading</a></li><li><a href="jasper-howto.html">12) JSPs</a></li><li><a href="ssl-howto.html">13) SSL/TLS</a></li><li><a href="ssi-howto.html">14) SSI</a></li><li><a href="cgi-howto.html">15) CGI</a></li><li><a href="proxy-howto.html">16) Proxy Support</a></li><li><a href="mbeans-descriptors-howto.html">17) MBeans Descriptors</a></li><li><a href="default-servlet.html">18) Default Servlet</a></li><li><a href="cluster-howto.html">19) Clustering</a></li><li><a href="balancer-howto.html">20) Load Balancer</a></li><li><a href="connectors.html">21) Connectors</a></li><li><a href="monitoring.html">22) Monitoring and Management</a></li><li><a href="logging.html">23) Logging</a></li><li><a href="apr.html">24) APR/Native</a></li><li><a href="virtual-hosting-howto.html">25) Virtual Hosting</a></li><li><a href="aio.html">26) Advanced IO</a></li><li><a href="maven-jars.html">27) Mavenized</a></li><li><a href="security-howto.html">28) Security Considerations</a></li><li><a href="windows-service-howto.html">29) Windows Service</a></li><li><a href="windows-auth-howto.html">30) Windows Authentication</a></li><li><a href="jdbc-pool.html">31) Tomcat's JDBC Pool</a></li><li><a href="web-socket-howto.html">32) WebSocket</a></li><li><a href="rewrite.html">33) Rewrite</a></li><li><a href="cdi.html">34) CDI 2 and JAX-RS</a></li><li><a href="graal.html">35) AOT/GraalVM Support</a></li></ul></div><div><h2>Reference</h2><ul><li><a href="RELEASE-NOTES.txt">Release Notes</a></li><li><a href="config/index.html">Configuration</a></li><li><a href="api/index.html">Tomcat Javadocs</a></li><li><a href="servletapi/index.html">Servlet 4.0 Javadocs</a></li><li><a href="jspapi/index.html">JSP 2.3 Javadocs</a></li><li><a href="elapi/index.html">EL 3.0 Javadocs</a></li><li><a href="websocketapi/index.html">WebSocket 1.1 Javadocs</a></li><li><a href="jaspicapi/index.html">JASPIC 1.1 Javadocs</a></li><li><a href="annotationapi/index.html">Common Annotations 1.3 Javadocs</a></li><li><a href="https://tomcat.apache.org/connectors-doc/">JK 1.2 Documentation</a></li></ul></div><div><h2>Apache Tomcat Development</h2><ul><li><a href="building.html">Building</a></li><li><a href="changelog.html">Changelog</a></li><li><a href="https://cwiki.apache.org/confluence/display/TOMCAT/Tomcat+Versions">Status</a></li><li><a href="developers.html">Developers</a></li><li><a href="architecture/index.html">Architecture</a></li><li><a href="tribes/introduction.html">Tribes</a></li></ul></div></nav></div></div><div id="mainRight"><div id="content"><h2>Security Manager How-To</h2><h3 id="Table_of_Contents">Table of Contents</h3><div class="text">
5 
<ul><li><a href="#Background">Background</a></li><li><a href="#Known_Issues">Known Issues</a></li><li><a href="#Permissions">Permissions</a><ol><li><a href="#Standard_Permissions">Standard Permissions</a></li></ol></li><li><a href="#Configuring_Tomcat_With_A_SecurityManager">Configuring Tomcat With A SecurityManager</a><ol><li><a href="#Permissions_for_packed_WAR_files">Permissions for packed WAR files</a></li></ol></li><li><a href="#Configuring_Package_Protection_in_Tomcat">Configuring Package Protection in Tomcat</a></li><li><a href="#Troubleshooting">Troubleshooting</a></li></ul>
6 
</div><h3 id="Background">Background</h3><div class="text">
7 
 
8 
  <p>The Java <strong>SecurityManager</strong> is what allows a web browser
9 
  to run an applet in its own sandbox to prevent untrusted code from
10 
  accessing files on the local file system, connecting to a host other
11 
  than the one the applet was loaded from, and so on.  In the same way
12 
  the SecurityManager protects you from an untrusted applet running in
13 
  your browser, use of a SecurityManager while running Tomcat can protect
14 
  your server from trojan servlets, JSPs, JSP beans, and tag libraries.
15 
  Or even inadvertent mistakes.</p>
16 
 
17 
  <p>Imagine if someone who is authorized to publish JSPs on your site
18 
  inadvertently included the following in their JSP:</p>
19 
<div class="codeBox"><pre><code>&lt;% System.exit(1); %&gt;</code></pre></div>
20 
 
21 
  <p>Every time this JSP was executed by Tomcat, Tomcat would exit.
22 
  Using the Java SecurityManager is just one more line of defense a
23 
  system administrator can use to keep the server secure and reliable.</p>
24 
 
25 
  <p><strong>WARNING</strong> - A security audit
26 
  have been conducted using the Tomcat codebase. Most of the critical
27 
  package have been protected and a new security package protection mechanism
28 
  has been implemented. Still, make sure that you are satisfied with your SecurityManager
29 
  configuration before allowing untrusted users to publish web applications,
30 
  JSPs, servlets, beans, or tag libraries.  <strong>However, running with a
31 
  SecurityManager is definitely better than running without one.</strong></p>
32 
 
33 
</div><h3 id="Known_Issues">Known Issues</h3><div class="text">
34 
 
35 
  <p>As of Java 17, the SecurityManager has been deprecated with the expectation
36 
  that it will be removed in a future Java version. Users currently using a
37 
  SecurityManager are recommended to start planning for its removal.</p>
38 
 
39 
</div><h3 id="Permissions">Permissions</h3><div class="text">
40 
 
41 
  <p>Permission classes are used to define what Permissions a class loaded
42 
  by Tomcat will have.  There are a number of Permission classes that are
43 
  a standard part of the JDK, and you can create your own Permission class
44 
  for use in your own web applications.  Both techniques are used in
45 
  Tomcat.</p>
46 
 
47 
 
48 
  <div class="subsection"><h4 id="Standard_Permissions">Standard Permissions</h4><div class="text">
49 
 
50 
    <p>This is just a short summary of the standard system SecurityManager
51 
    Permission classes applicable to Tomcat.  See
52 
    <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/">
53 
    http://docs.oracle.com/javase/7/docs/technotes/guides/security/</a>
54 
    for more information.</p>
55 
 
56 
    <ul>
57 
    <li><strong>java.util.PropertyPermission</strong> - Controls read/write
58 
        access to JVM properties such as <code>java.home</code>.</li>
59 
    <li><strong>java.lang.RuntimePermission</strong> - Controls use of
60 
        some System/Runtime functions like <code>exit()</code> and
61 
        <code>exec()</code>. Also control the package access/definition.</li>
62 
    <li><strong>java.io.FilePermission</strong> - Controls read/write/execute
63 
        access to files and directories.</li>
64 
    <li><strong>java.net.SocketPermission</strong> - Controls use of
65 
        network sockets.</li>
66 
    <li><strong>java.net.NetPermission</strong> - Controls use of
67 
        multicast network connections.</li>
68 
    <li><strong>java.lang.reflect.ReflectPermission</strong> - Controls
69 
        use of reflection to do class introspection.</li>
70 
    <li><strong>java.security.SecurityPermission</strong> - Controls access
71 
        to Security methods.</li>
72 
    <li><strong>java.security.AllPermission</strong> - Allows access to all
73 
        permissions, just as if you were running Tomcat without a
74 
        SecurityManager.</li>
75 
    </ul>
76 
 
77 
  </div></div>
78 
 
79 
</div><h3 id="Configuring_Tomcat_With_A_SecurityManager">Configuring Tomcat With A SecurityManager</h3><div class="text">
80 
 
81 
  <h3>Policy File Format</h3>
82 
 
83 
  <p>The security policies implemented by the Java SecurityManager are
84 
  configured in the <code>$CATALINA_BASE/conf/catalina.policy</code> file.
85 
  This file completely replaces the <code>java.policy</code> file present
86 
  in your JDK system directories.  The <code>catalina.policy</code> file
87 
  can be edited by hand, or you can use the
88 
  <a href="http://docs.oracle.com/javase/6/docs/technotes/guides/security/PolicyGuide.html">policytool</a>
89 
  application that comes with Java 1.2 or later.</p>
90 
 
91 
  <p>Entries in the <code>catalina.policy</code> file use the standard
92 
  <code>java.policy</code> file format, as follows:</p>
93 
<div class="codeBox"><pre><code>// Example policy file entry
94 
 
95 
grant [signedBy &lt;signer&gt;,] [codeBase &lt;code source&gt;] {
96 
  permission  &lt;class&gt;  [&lt;name&gt; [, &lt;action list&gt;]];
97 
};</code></pre></div>
98 
 
99 
  <p>The <strong>signedBy</strong> and <strong>codeBase</strong> entries are
100 
  optional when granting permissions.  Comment lines begin with "//" and
101 
  end at the end of the current line.  The <code>codeBase</code> is in the
102 
  form of a URL, and for a file URL can use the <code>${java.home}</code>
103 
  and <code>${catalina.home}</code> properties (which are expanded out to
104 
  the directory paths defined for them by the <code>JAVA_HOME</code>,
105 
  <code>CATALINA_HOME</code> and <code>CATALINA_BASE</code> environment
106 
  variables).</p>
107 
 
108 
  <h3>The Default Policy File</h3>
109 
 
110 
  <p>The default <code>$CATALINA_BASE/conf/catalina.policy</code> file
111 
  looks like this:</p>
112 
 
113 
 
114 
<div class="codeBox"><pre><code>// Licensed to the Apache Software Foundation (ASF) under one or more
115 
// contributor license agreements.  See the NOTICE file distributed with
116 
// this work for additional information regarding copyright ownership.
117 
// The ASF licenses this file to You under the Apache License, Version 2.0
118 
// (the "License"); you may not use this file except in compliance with
119 
// the License.  You may obtain a copy of the License at
120 
//
121 
//     http://www.apache.org/licenses/LICENSE-2.0
122 
//
123 
// Unless required by applicable law or agreed to in writing, software
124 
// distributed under the License is distributed on an "AS IS" BASIS,
125 
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
126 
// See the License for the specific language governing permissions and
127 
// limitations under the License.
128 
 
129 
// ============================================================================
130 
// catalina.policy - Security Policy Permissions for Tomcat
131 
//
132 
// This file contains a default set of security policies to be enforced (by the
133 
// JVM) when Catalina is executed with the "-security" option.  In addition
134 
// to the permissions granted here, the following additional permissions are
135 
// granted to each web application:
136 
//
137 
// * Read access to the web application's document root directory
138 
// * Read, write and delete access to the web application's working directory
139 
// ============================================================================
140 
 
141 
 
142 
// ========== SYSTEM CODE PERMISSIONS =========================================
143 
 
144 
 
145 
// These permissions apply to javac
146 
grant codeBase "file:${java.home}/lib/-" {
147 
        permission java.security.AllPermission;
148 
};
149 
 
150 
// These permissions apply to all shared system extensions
151 
grant codeBase "file:${java.home}/jre/lib/ext/-" {
152 
        permission java.security.AllPermission;
153 
};
154 
 
155 
// These permissions apply to javac when ${java.home} points at $JAVA_HOME/jre
156 
grant codeBase "file:${java.home}/../lib/-" {
157 
        permission java.security.AllPermission;
158 
};
159 
 
160 
// These permissions apply to all shared system extensions when
161 
// ${java.home} points at $JAVA_HOME/jre
162 
grant codeBase "file:${java.home}/lib/ext/-" {
163 
        permission java.security.AllPermission;
164 
};
165 
 
166 
// This permission is required when using javac to compile JSPs on Java 9
167 
// onwards
168 
//grant codeBase "jrt:/jdk.compiler" {
169 
//        permission java.security.AllPermission;
170 
//};
171 
 
172 
 
173 
// ========== CATALINA CODE PERMISSIONS =======================================
174 
 
175 
// These permissions apply to the daemon code
176 
grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
177 
        permission java.security.AllPermission;
178 
};
179 
 
180 
// These permissions apply to the logging API
181 
// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
182 
// update this section accordingly.
183 
//  grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
184 
grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
185 
        permission java.io.FilePermission
186 
         "${java.home}${file.separator}lib${file.separator}logging.properties", "read";
187 
 
188 
        permission java.io.FilePermission
189 
         "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
190 
        permission java.io.FilePermission
191 
         "${catalina.base}${file.separator}logs", "read, write";
192 
        permission java.io.FilePermission
193 
         "${catalina.base}${file.separator}logs${file.separator}*", "read, write, delete";
194 
 
195 
        permission java.lang.RuntimePermission "shutdownHooks";
196 
        permission java.lang.RuntimePermission "getClassLoader";
197 
        permission java.lang.RuntimePermission "setContextClassLoader";
198 
 
199 
        permission java.lang.management.ManagementPermission "monitor";
200 
 
201 
        permission java.util.logging.LoggingPermission "control";
202 
 
203 
        permission java.util.PropertyPermission "java.util.logging.config.class", "read";
204 
        permission java.util.PropertyPermission "java.util.logging.config.file", "read";
205 
        permission java.util.PropertyPermission "org.apache.juli.AsyncMaxRecordCount", "read";
206 
        permission java.util.PropertyPermission "org.apache.juli.AsyncOverflowDropType", "read";
207 
        permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read";
208 
        permission java.util.PropertyPermission "catalina.base", "read";
209 
 
210 
        // Note: To enable per context logging configuration, permit read access to
211 
        // the appropriate file. Be sure that the logging configuration is
212 
        // secure before enabling such access.
213 
        // E.g. for the examples web application (uncomment and unwrap
214 
        // the following to be on a single line):
215 
        // permission java.io.FilePermission "${catalina.base}${file.separator}
216 
        //  webapps${file.separator}examples${file.separator}WEB-INF
217 
        //  ${file.separator}classes${file.separator}logging.properties", "read";
218 
};
219 
 
220 
// These permissions apply to the server startup code
221 
grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
222 
        permission java.security.AllPermission;
223 
};
224 
 
225 
// These permissions apply to the servlet API classes
226 
// and those that are shared across all class loaders
227 
// located in the "lib" directory
228 
grant codeBase "file:${catalina.home}/lib/-" {
229 
        permission java.security.AllPermission;
230 
};
231 
 
232 
 
233 
// If using a per instance lib directory, i.e. ${catalina.base}/lib,
234 
// then the following permission will need to be uncommented
235 
// grant codeBase "file:${catalina.base}/lib/-" {
236 
//         permission java.security.AllPermission;
237 
// };
238 
 
239 
 
240 
// ========== WEB APPLICATION PERMISSIONS =====================================
241 
 
242 
 
243 
// These permissions are granted by default to all web applications
244 
// In addition, a web application will be given a read FilePermission
245 
// for all files and directories in its document root.
246 
grant {
247 
    // Required for JNDI lookup of named JDBC DataSource's and
248 
    // javamail named MimePart DataSource used to send mail
249 
    permission java.util.PropertyPermission "java.home", "read";
250 
    permission java.util.PropertyPermission "java.naming.*", "read";
251 
    permission java.util.PropertyPermission "javax.sql.*", "read";
252 
 
253 
    // OS Specific properties to allow read access
254 
    permission java.util.PropertyPermission "os.name", "read";
255 
    permission java.util.PropertyPermission "os.version", "read";
256 
    permission java.util.PropertyPermission "os.arch", "read";
257 
    permission java.util.PropertyPermission "file.separator", "read";
258 
    permission java.util.PropertyPermission "path.separator", "read";
259 
    permission java.util.PropertyPermission "line.separator", "read";
260 
 
261 
    // JVM properties to allow read access
262 
    permission java.util.PropertyPermission "java.version", "read";
263 
    permission java.util.PropertyPermission "java.vendor", "read";
264 
    permission java.util.PropertyPermission "java.vendor.url", "read";
265 
    permission java.util.PropertyPermission "java.class.version", "read";
266 
    permission java.util.PropertyPermission "java.specification.version", "read";
267 
    permission java.util.PropertyPermission "java.specification.vendor", "read";
268 
    permission java.util.PropertyPermission "java.specification.name", "read";
269 
 
270 
    permission java.util.PropertyPermission "java.vm.specification.version", "read";
271 
    permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
272 
    permission java.util.PropertyPermission "java.vm.specification.name", "read";
273 
    permission java.util.PropertyPermission "java.vm.version", "read";
274 
    permission java.util.PropertyPermission "java.vm.vendor", "read";
275 
    permission java.util.PropertyPermission "java.vm.name", "read";
276 
 
277 
    // Required for OpenJMX
278 
    permission java.lang.RuntimePermission "getAttribute";
279 
 
280 
    // Allow read of JAXP compliant XML parser debug
281 
    permission java.util.PropertyPermission "jaxp.debug", "read";
282 
 
283 
    // All JSPs need to be able to read this package
284 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat";
285 
 
286 
    // Precompiled JSPs need access to these packages.
287 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
288 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
289 
    permission java.lang.RuntimePermission
290 
     "accessClassInPackage.org.apache.jasper.runtime.*";
291 
 
292 
    // Applications using WebSocket need to be able to access these packages
293 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket";
294 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server";
295 
};
296 
 
297 
 
298 
// The Manager application needs access to the following packages to support the
299 
// session display functionality. It also requires the custom Tomcat
300 
// DeployXmlPermission to enable the use of META-INF/context.xml
301 
// These settings support the following configurations:
302 
// - default CATALINA_HOME == CATALINA_BASE
303 
// - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
304 
// - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
305 
grant codeBase "file:${catalina.base}/webapps/manager/-" {
306 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
307 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
308 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
309 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
310 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
311 
    permission org.apache.catalina.security.DeployXmlPermission "manager";
312 
};
313 
grant codeBase "file:${catalina.home}/webapps/manager/-" {
314 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
315 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
316 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
317 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
318 
    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
319 
    permission org.apache.catalina.security.DeployXmlPermission "manager";
320 
};
321 
 
322 
// The Host Manager application needs the custom Tomcat DeployXmlPermission to
323 
// enable the use of META-INF/context.xml
324 
// These settings support the following configurations:
325 
// - default CATALINA_HOME == CATALINA_BASE
326 
// - CATALINA_HOME != CATALINA_BASE, per instance Host Manager in CATALINA_BASE
327 
// - CATALINA_HOME != CATALINA_BASE, shared Host Manager in CATALINA_HOME
328 
grant codeBase "file:${catalina.base}/webapps/host-manager/-" {
329 
    permission org.apache.catalina.security.DeployXmlPermission "host-manager";
330 
};
331 
grant codeBase "file:${catalina.home}/webapps/host-manager/-" {
332 
    permission org.apache.catalina.security.DeployXmlPermission "host-manager";
333 
};
334 
 
335 
 
336 
// You can assign additional permissions to particular web applications by
337 
// adding additional "grant" entries here, based on the code base for that
338 
// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
339 
//
340 
// Different permissions can be granted to JSP pages, classes loaded from
341 
// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
342 
// directory, or even to individual jar files in the /WEB-INF/lib/ directory.
343 
//
344 
// For instance, assume that the standard "examples" application
345 
// included a JDBC driver that needed to establish a network connection to the
346 
// corresponding database and used the scrape taglib to get the weather from
347 
// the NOAA web server.  You might create a "grant" entries like this:
348 
//
349 
// The permissions granted to the context root directory apply to JSP pages.
350 
// grant codeBase "file:${catalina.base}/webapps/examples/-" {
351 
//      permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
352 
//      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
353 
// };
354 
//
355 
// The permissions granted to the context WEB-INF/classes directory
356 
// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" {
357 
// };
358 
//
359 
// The permission granted to your JDBC driver
360 
// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
361 
//      permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
362 
// };
363 
// The permission granted to the scrape taglib
364 
// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
365 
//      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
366 
// };
367 
 
368 
// To grant permissions for web applications using packed WAR files, use the
369 
// Tomcat specific WAR url scheme.
370 
//
371 
// The permissions granted to the entire web application
372 
// grant codeBase "war:file:${catalina.base}/webapps/examples.war*/-" {
373 
// };
374 
//
375 
// The permissions granted to a specific JAR
376 
// grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {
377 
// };</code></pre></div>
378 
 
379 
  <h3>Starting Tomcat With A SecurityManager</h3>
380 
 
381 
  <p>Once you have configured the <code>catalina.policy</code> file for use
382 
  with a SecurityManager, Tomcat can be started with a SecurityManager in
383 
  place by using the "-security" option:</p>
384 
<div class="codeBox"><pre><code>$CATALINA_HOME/bin/catalina.sh start -security    (Unix)
385 
%CATALINA_HOME%\bin\catalina start -security      (Windows)</code></pre></div>
386 
 
387 
  <div class="subsection"><h4 id="Permissions_for_packed_WAR_files">Permissions for packed WAR files</h4><div class="text">
388 
 
389 
    <p>When using packed WAR files, it is necessary to use Tomcat's custom war
390 
    URL protocol to assign permissions to web application code.</p>
391 
 
392 
    <p>To assign permissions to the entire web application the entry in the
393 
    policy file would look like this:</p>
394 
 
395 
<div class="codeBox"><pre><code>// Example policy file entry
396 
grant codeBase "war:file:${catalina.base}/webapps/examples.war*/-" {
397 
    ...
398 
};
399 
</code></pre></div>
400 
 
401 
    <p>To assign permissions to a single JAR within the web application the
402 
    entry in the policy file would look like this:</p>
403 
 
404 
<div class="codeBox"><pre><code>// Example policy file entry
405 
grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {
406 
    ...
407 
};
408 
</code></pre></div>
409 
 
410 
  </div></div>
411 
 
412 
</div><h3 id="Configuring_Package_Protection_in_Tomcat">Configuring Package Protection in Tomcat</h3><div class="text">
413 
  <p>Starting with Tomcat 5, it is now possible to configure which Tomcat
414 
  internal package are protected against package definition and access. See
415 
  <a href="http://www.oracle.com/technetwork/java/seccodeguide-139067.html">
416 
    http://www.oracle.com/technetwork/java/seccodeguide-139067.html</a>
417 
    for more information.</p>
418 
 
419 
 
420 
  <p><strong>WARNING</strong>: Be aware that removing the default package protection
421 
  could possibly open a security hole</p>
422 
 
423 
  <h3>The Default Properties File</h3>
424 
 
425 
  <p>The default <code>$CATALINA_BASE/conf/catalina.properties</code> file
426 
  looks like this:</p>
427 
<div class="codeBox"><pre><code>#
428 
# List of comma-separated packages that start with or equal this string
429 
# will cause a security exception to be thrown when
430 
# passed to checkPackageAccess unless the
431 
# corresponding RuntimePermission ("accessClassInPackage."+package) has
432 
# been granted.
433 
package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,
434 
org.apache.jasper.
435 
#
436 
# List of comma-separated packages that start with or equal this string
437 
# will cause a security exception to be thrown when
438 
# passed to checkPackageDefinition unless the
439 
# corresponding RuntimePermission ("defineClassInPackage."+package) has
440 
# been granted.
441 
#
442 
# by default, no packages are restricted for definition, and none of
443 
# the class loaders supplied with the JDK call checkPackageDefinition.
444 
#
445 
package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,
446 
org.apache.tomcat.,org.apache.jasper.</code></pre></div>
447 
  <p>Once you have configured the <code>catalina.properties</code> file for use
448 
  with a SecurityManager, remember to re-start Tomcat.</p>
449 
</div><h3 id="Troubleshooting">Troubleshooting</h3><div class="text">
450 
 
451 
  <p>If your web application attempts to execute an operation that is
452 
  prohibited by lack of a required Permission, it will throw an
453 
  <code>AccessControLException</code> or a <code>SecurityException</code>
454 
  when the SecurityManager detects the violation.  Debugging the permission
455 
  that is missing can be challenging, and one option is to turn on debug
456 
  output of all security decisions that are made during execution.  This
457 
  is done by setting a system property before starting Tomcat.  The easiest
458 
  way to do this is via the <code>CATALINA_OPTS</code> environment variable.
459 
  Execute this command:</p>
460 
<div class="codeBox"><pre><code>export CATALINA_OPTS=-Djava.security.debug=all    (Unix)
461 
set CATALINA_OPTS=-Djava.security.debug=all       (Windows)</code></pre></div>
462 
 
463 
  <p>before starting Tomcat.</p>
464 
 
465 
  <p><strong>WARNING</strong> - This will generate <em>many megabytes</em>
466 
  of output!  However, it can help you track down problems by searching
467 
  for the word "FAILED" and determining which permission was being checked
468 
  for.  See the Java security documentation for more options that you can
469 
  specify here as well.</p>
470 
 
471 
</div></div></div></div></div><footer><div id="footer">
472 
    Copyright &copy; 1999-2025, The Apache Software Foundation
473 
    <br>
474 
    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
475 
    are either registered trademarks or trademarks of the Apache Software
476 
    Foundation.
477 
    </div></footer></div></body></html>