I think it would be more correct if XWiki were to limit or eliminate use of the filesystem via java.io.*.

Things like the log4j config should be made easily configurable- not buried- and documented as something to configure during installation. Obviously, you can dig for it and replace it earlier in the classpath...

It is not hard, also, to make log4j reload configurations once the cfg file is read, or once the database is read, so that things like log output files can be configured more in the normal configuration process.

But, in general, there should not be paths in a J2EE database application.

-Tom

// These permissions apply to xwiki
grant codeBase "file:${catalina.base}/webapps/xwiki/-" { permission java.security.AllPermission; };

Restarting Tomcat you can now use the default security settings provided by the Debian Package (TOMCAT5_SECURITY=yes). Should work on Debian 4.0 systems where xwiki ist installed under the default path for Tomcat applications (/var/lib/tomcat5.5/webapps/xwiki/).

Stefan

• Remove the xerxesImpl jar, as it will be used by Tomcat to load it's own resources, thus throwing security exceptions. I'd say this is a bug in Tomcat.
• Disable the file logger in log4j.properties
• Add the following in a policy file:

grant codeBase "file:${catalina.home}/webapps/xwiki/WEB-INF/lib/-" { permission java.util.PropertyPermission "file.encoding", "read"; // Needed by Hibernate -> antlr permission java.util.PropertyPermission "ANTLR_DO_NOT_EXIT", "read"; permission java.util.PropertyPermission "ANTLR_USE_DIRECT_CLASS_LOADING", "read"; // Needed by Plexus. Can be omitted if Plexus is disabled (OK in XWiki <= 1.2) permission java.lang.RuntimePermission "createClassLoader"; permission java.lang.RuntimePermission "setContextClassLoader"; // Needed by Plexus and Hibernate permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; // Needed by commons-logging permission java.util.PropertyPermission "org.apache.commons.logging.LogFactory.HashtableImpl", "read"; // Needed for connecting to the database permission java.net.SocketPermission "127.0.0.1:3306", "connect,resolve"; // Needed by the scheduler plugin -> quartz, but works without (maybe except scheduling? should be checked) // permission java.util.PropertyPermission "org.quartz.properties", "read"; };

Our code is pretty safe for the moment, but some of the projects we are using have some problems, like antlr (v3 doesn't require them, but Hibernate still uses v2), hibernate and plexus which require custom class loading and reflection, and commons-logging.