Re: [Php-java-bridge-users] Debian's security manager

[<php...@li...>]

Hi Andre,

I have just tested it on a tomcat 6.0.18 running with -security switched on.
It stops the PhpCGIServlet from executing /bin/sh.

This can be solved by removing the JavaBridge.jar, php-servlet.jar and
php-script.jar from the application "JavaBridge.war", and adding them to the
shared library dir TOMCAT_HOME/lib/ instead. Neither additional security
declarations nor manipulations of global, shared XML files are necessary to
fix this problem.

It is true that PHP scripts may do foolish things like killing all other
running php scripts, <?php system("killall php")?>, or even its own java
container, <?php system("killall java");?>, but Java security doesn't help.
The best way to secure PHP scripts is to use "Security Enhanced Linux"
rules. RedHat Fedora and Enterprise Linux already contains these rules.
Rules for the PHP/Java Bridge are contained in the security folder of the
redhat RPM, and applied when the RPM is installed.

Regards,
Jost Boekemeier

Apr 29, 2009 10:33 nachm. schrieb am <
php...@li...>:

<3af...@ma...>
<200...@te...>
<3af...@ma...>
<3af...@ma...> <
3af...@ma...>
Message-ID: <ef694f0b3cfec3015febb4fe6e11ef83@localhost>

X-Sender: and...@te...

Received: from 161.148.54.70 [161.148.54.70] with HTTP/1.1 (POST); Wed, 29
Apr
       2009 09:34:29 -0300

User-Agent: RoundCube Webmail/0.1 Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit


Hello,

I will verify what are the JSP permissions.

Debian Policy does not allow a package manipulate configuration files

from other packages.

Because of this, the right way is to create a new own file at policy.d

directory

I tested

/etc/tomcat5.5/policy.d/60JavaBridge.policy



containing:

grant codeBase "file:${catalina.base}/webapps/JavaBridge/-" {
permission java.security.AllPermission;

};



And it worked well after restarting tomcat.

I simply placed the war file at the autodeploy dir and automagically all

worked.



I will try to create a new package using the debconf tools for manipulating

the new

file and test it.

Regards.

Andre Felipe











On Wed, 29 Apr 2009 22:22:26 +0200,

php...@li... wrote: > I think PHP should have
the same permissions ...
--

http://www.techforce.com.br
A Debian user never dies. Issues a last command:

#shutdown -h now

------------------------------------------------------------------------------
Register Now & Save...

php...@li...
https://lists.sourceforge.net/lists/listinfo/php-java-br...