Problems with security policies for Axis2 in Tomcat

[Cedric Le Roux]

Using Debian 5, Tomcat 5.5, Axis2

I am seeing the following error when trying to run the Axis2 sample page at http://localhost:8180/axis2/axis2-web/HappyAxis.jsp

"There was a problem in Axis2 version service , may be the service not available or some thing has gone wrong. But this does not mean system is not working ! Try to upload some other service and check to see whether it is working."

I can get this error to go away if I disable Tomcat's security manager by setting

TOMCAT5_SECURITY=no

in /etc/default/tomcat5.5

I would like to avoid disabling the security manager so I have tried to add a .policy file for Axis2 in /etc/tomcat5.5/policy.d/

grant codeBase "file:${catalina.home}/webapps/axis2/-" {
  permission java.security.AllPermission;
};

In theory this policy should grant all permissions for axis2 but I still get the error above, and I also see plenty of exceptions in Tomcat's log files.

Lastly, I found the following security policy which is supposed to allow Axis2 to run without granting all permissions. With this policy, I no longer see any exceptions but the error above still appears.

grant {
    // For some mysterious reason these 2 are required outside the Axis-specific permissions
    // No idea what the codebase should be
    permission java.io.FilePermission "${catalina.base}/webapps/axis2/WEB-INF/-", "read";
    permission java.lang.RuntimePermission "getClassLoader";
};

grant codeBase "file:${catalina.home}/webapps/axis2/-" {
    permission java.lang.RuntimePermission "createClassLoader";
    permission java.lang.RuntimePermission "setContextClassLoader";
    permission java.lang.RuntimePermission "checkPropertiesAccess";
    permission java.lang.RuntimePermission "getClassLoader";
    permission java.lang.RuntimePermission "getProtectionDomain";
    permission java.lang.RuntimePermission "defineClassInPackage.org.apache.jasper.runtime";
    permission java.lang.RuntimePermission "shutdownHooks";
    permission java.lang.RuntimePermission "accessDeclaredMembers";
    permission java.util.PropertyPermission "*", "read,write";
    permission java.net.SocketPermission "<your hostname goes here>", "resolve, connect";
    permission java.io.FilePermission "${catalina.base}/webapps/axis2/WEB-INF/modules/*", "read,write";
    permission java.io.FilePermission "${catalina.base}/webapps/axis2/WEB-INF/services/*", "read,write";
    permission java.io.FilePermission "${catalina.home}/common/classes", "read";
    permission java.io.FilePermission "${catalina.home}/shared/classes", "read";
    permission java.io.FilePermission "${catalina.base}/common/classes", "read";
    permission java.io.FilePermission "${catalina.base}/shared/classes", "read";
    permission java.io.FilePermission "${catalina.home}/common/i18n/*", "read";
    permission java.io.FilePermission "${catalina.home}/common/lib/*", "read";
    permission java.io.FilePermission "${catalina.home}/bin/bootstrap.jar", "read";
    permission java.io.FilePermission "${catalina.base}/webapps/axis2/WEB-INF/scriptServices/*", "read";
    permission java.io.FilePermission "${java.home}/lib/ext/*", "read";
    // Other directories that are in the classpath
    permission java.io.FilePermission "/usr/share/java/*", "read";
};

If you have any ideas as to how I can get Axis2 running properly with the security manager enabled I'd love to hear them.
Thanks.