security issue running jruby on tomcat6

Question

i deployed a jruby/rails app to tomcat6 through a warbler-built war. system is ubuntu 8, running tomcat6. when i try to start the app, i get the following stack trace

    Sep 13, 2010 7:57:24 PM org.apache.catalina.core.ApplicationContext log
    SEVERE: Application Error
    java.security.AccessControlException: access denied (java.util.PropertyPermissio
    n jruby.management.enabled read)
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:342)
        at java.security.AccessController.checkPermission(AccessController.java:553)
        at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
        at java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1302)
        at java.lang.System.getProperty(System.java:669)
        at org.jruby.rack.DefaultRackApplicationFactory.setupJRubyManagement(DefaultRackApplicationFactory.java:94)
        at org.jruby.rack.DefaultRackApplicationFactory.newRuntime(DefaultRackApplicationFactory.java:78)
        at org.jruby.rack.DefaultRackApplicationFactory.createApplication(DefaultRackApplicationFactory.java:177)
        at org.jruby.rack.DefaultRackApplicationFactory.newApplication(DefaultRackApplicationFactory.java:50)
        at org.jruby.rack.DefaultRackApplicationFactory.getApplication(DefaultRackApplicationFactory.java:58)
        at org.jruby.rack.PoolingRackApplicationFactory.getApplication(PoolingRackApplicationFactory.java:94)
        at org.jruby.rack.servlet.DefaultServletDispatcher.process(DefaultServletDispatcher.java:36)
        at org.jruby.rack.RackFilter.doFilter(RackFilter.java:59)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:616)
        at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:244)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:276)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:218)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230)
        at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:56)
        at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:189)
        at java.security.AccessController.doPrivileged(Native Method)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:185)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
        at java.lang.Thread.run(Thread.java:636)

tomcat was install through aptitude, and is in a default config. the default tomcat apps work fine. log files get populated.

what gives?

edit: Nick was right, looking for the policy information revealed the following (documented here for whoever has the same stupid issue the next time around):

there is a set of policy configuration files under (default install) /var/lib/tomcat6/conf/policy.d. the one you car about is 04webapps.policy. Edit it to add the permissions that jruby needs. in my case, they were

// Required for jRuby
permission java.util.PropertyPermission "jruby.*", "read";
permission java.util.PropertyPermission "jruby.*", "write";
permission java.util.PropertyPermission "java.io.tmpdir", "read";
permission java.util.PropertyPermission "*", "read";
permission java.util.PropertyPermission "*", "write";
permission java.lang.RuntimePermission "getClassLoader";
permission java.lang.RuntimePermission "getProtectionDomain";
permission java.lang.RuntimePermission "createClassLoader";
permission java.lang.RuntimePermission "getenv.*";
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.coyote";

Answer 1

Tomcat's default configuration on Ubuntu must be using a security manager. Look in configuration files for -Djava.security.manager=FILE.policy option and remove if you don't need it.

Otherwise, you'll have to relax the security policy, possibly adding a section like

grant codeBase "file:/var/lib/tomcat5.5/-" {
    permission java.security.AllPermission;
}

in the security policy mentioned in the -Djava.security.manager argument above.