org.wildfly.security.manager.WildFlySecurityManager Java Examples

public AcmeChallenge proveIdentifierControl(AcmeAccount account, List<AcmeChallenge> challenges) throws AcmeException {
    Assert.checkNotNullParam("account", account);
    Assert.checkNotNullParam("challenges", challenges);
    AcmeChallenge selectedChallenge = null;
    for (AcmeChallenge challenge : challenges) {
        if (challenge.getType() == AcmeChallenge.Type.HTTP_01) {
            selectedChallenge = challenge;
            break;
        }
    }

    // ensure the token is valid before proceeding
    String token = selectedChallenge.getToken();
    if (! token.matches(TOKEN_REGEX)) {
        throw ROOT_LOGGER.invalidCertificateAuthorityChallenge();
    }

    // respond to the http challenge
    String responseFilePath = WildFlySecurityManager.getPropertyPrivileged("jboss.home.dir", ".") + ACME_CHALLENGE_PREFIX + token;
    try (FileOutputStream fos = new FileOutputStream(responseFilePath)) {
        fos.write(selectedChallenge.getKeyAuthorization(account).getBytes(StandardCharsets.US_ASCII));
    } catch (IOException e) {
        throw ROOT_LOGGER.unableToRespondToCertificateAuthorityChallenge(e, e.getLocalizedMessage());
    }
    return selectedChallenge;
}
 

public void cleanupAfterChallenge(AcmeAccount account, AcmeChallenge challenge) throws AcmeException {
    Assert.checkNotNullParam("account", account);
    Assert.checkNotNullParam("challenge", challenge);
    // ensure the token is valid before proceeding
    String token = challenge.getToken();
    if (! token.matches(TOKEN_REGEX)) {
        throw ROOT_LOGGER.invalidCertificateAuthorityChallenge();
    }

    // delete the file that was created to prove identifier control
    String responseFilePath = WildFlySecurityManager.getPropertyPrivileged("jboss.home.dir", ".") + ACME_CHALLENGE_PREFIX + token;
    File responseFile = new File(responseFilePath);
    if (responseFile.exists()) {
        responseFile.delete();
    }
}
 

@After
public void tearDown() throws Exception {
    afterTest();
    readThreadActive.set(false);
    if (ctx != null) {
        ctx.terminateSession();
    }
    for (Thread thread : threads) {
        thread.join(5000);
        if (thread.isAlive()) {
            thread.interrupt();
        }
        waitFor(() -> !thread.isAlive(), 10000);
    }
    threads.removeAll(threads);
    IOUtil.close(consoleInput);
    IOUtil.close(consoleWriter);
    IOUtil.close(consoleOutput);
    IOUtil.close(consoleReader);

    // return back original value for jboss.cli.config property
    WildFlySecurityManager.setPropertyPrivileged("jboss.cli.config", originalCliConfig);
}
 

static Configuration getGlobalJaasConfiguration() throws SecurityException {
    if (WildFlySecurityManager.isChecking() == false) {
        return internalGetGlobalJaasConfiguration();
    } else {

        try {
            return doPrivileged(new PrivilegedExceptionAction<Configuration>() {

                @Override
                public Configuration run() throws Exception {
                    return internalGetGlobalJaasConfiguration();
                }

            });
        } catch (PrivilegedActionException e) {
            throw (SecurityException) e.getCause();
        }

    }
}
 

@Before
public void setup() throws Exception {
    originalJvmArgs = WildFlySecurityManager.getPropertyPrivileged("jvm.args", null);
    timestamp = String.valueOf(System.currentTimeMillis());
    File target = new File("target").getAbsoluteFile();
    if (!Files.exists(target.toPath())) {
        throw new IllegalStateException("No target/ directory");
    }

    File parent = new File(target, "cli-boot-ops");
    if (!Files.exists(parent.toPath())) {
        Files.createDirectories(parent.toPath());
    }

    markerDirectory = new File(parent, timestamp);
    if (Files.exists(markerDirectory.toPath())) {
        throw new IllegalStateException(markerDirectory.getAbsolutePath() + " already exists");
    }

}
 

private ClassLoader pushClassLoader(final ObjectName name) throws InstanceNotFoundException {
    ClassLoader mbeanCl;
    try {
        mbeanCl = doPrivileged(new PrivilegedExceptionAction<ClassLoader>() {
            public ClassLoader run() throws InstanceNotFoundException {
                return delegate.getClassLoaderFor(name);
            }
        });
    } catch (PrivilegedActionException e) {
        try {
            throw e.getCause();
        } catch (RuntimeException r) {
            throw r;
        } catch (InstanceNotFoundException ie) {
            throw ie;
        } catch (Error error) {
            throw error;
        } catch (Throwable throwable) {
            throw new UndeclaredThrowableException(throwable);
        }
    }
    return WildFlySecurityManager.setCurrentContextClassLoaderPrivileged(mbeanCl);
}
 

private ClassLoader pushClassLoaderByName(final ObjectName loaderName) throws InstanceNotFoundException {
    ClassLoader mbeanCl;
    try {
        mbeanCl = doPrivileged(new PrivilegedExceptionAction<ClassLoader>() {
            public ClassLoader run() throws Exception {
                return delegate.getClassLoader(loaderName);
            }
        });
    } catch (PrivilegedActionException e) {
        try {
            throw e.getCause();
        } catch (RuntimeException r) {
            throw r;
        } catch (InstanceNotFoundException ie) {
            throw ie;
        } catch (Error error) {
            throw error;
        } catch (Throwable throwable) {
            throw new UndeclaredThrowableException(throwable);
        }
    }
    return WildFlySecurityManager.setCurrentContextClassLoaderPrivileged(mbeanCl);
}
 

private File getJBossHome(final ParsedCommandLine parsedCmd) throws CommandLineException {
    String jbossHome = this.jbossHome == null ? null : this.jbossHome.getValue(parsedCmd);
    if (jbossHome == null || jbossHome.length() == 0) {
        jbossHome = WildFlySecurityManager.getEnvPropertyPrivileged("JBOSS_HOME", null);
        if (jbossHome == null || jbossHome.length() == 0) {
            if (this.jbossHome != null) {
                throw new CommandLineException("Missing configuration value for --jboss-home and environment variable JBOSS_HOME is not set");
            } else {
                throw new CommandLineException("Environment variable JBOSS_HOME is not set");
            }
        }
        return validateJBossHome(jbossHome, "environment variable JBOSS_HOME");
    } else {
        return validateJBossHome(jbossHome, "argument --jboss-home");
    }
}
 

public static String printHelp(CommandContext ctx, String filename) {
    InputStream helpInput = WildFlySecurityManager.getClassLoaderPrivileged(CommandHandlerWithHelp.class).getResourceAsStream(filename);
    if (helpInput != null) {
        BufferedReader reader = new BufferedReader(new InputStreamReader(helpInput));
        try {
            /*                String helpLine = reader.readLine();
            while(helpLine != null) {
                ctx.printLine(helpLine);
                helpLine = reader.readLine();
            }
             */
            return format(ctx, reader);
        } catch (java.io.IOException e) {
            return "Failed to read " + filename + ". " + e.getLocalizedMessage();
        } finally {
            StreamUtils.safeClose(reader);
        }
    } else {
        return "Failed to locate command description " + filename;
    }
}
 

private DirContext getConnection(final Hashtable<String, String> properties, final SSLContext sslContext) throws NamingException {
    ClassLoader old = WildFlySecurityManager.setCurrentContextClassLoaderPrivileged(LdapConnectionManagerService.class);
    try {
        if (sslContext != null) {
            ThreadLocalSSLSocketFactory.setSSLSocketFactory(sslContext.getSocketFactory());
            properties.put("java.naming.ldap.factory.socket", ThreadLocalSSLSocketFactory.class.getName());
        }
        if (SECURITY_LOGGER.isTraceEnabled()) {
            Hashtable<String, String> logProperties;
            if (properties.containsKey(Context.SECURITY_CREDENTIALS)) {
                logProperties = new Hashtable<String, String>(properties);
                logProperties.put(Context.SECURITY_CREDENTIALS, "***");
            } else {
                logProperties = properties;
            }
            SECURITY_LOGGER.tracef("Connecting to LDAP with properties (%s)", logProperties.toString());
        }

        return new InitialDirContext(properties);
    } finally {
        if (sslContext != null) {
            ThreadLocalSSLSocketFactory.removeSSLSocketFactory();
        }
        WildFlySecurityManager.setCurrentContextClassLoaderPrivileged(old);
    }
}
 

/**
 * Determine the number of threads to use for the bootstrap service container. This reads
 * the {@link #BOOTSTRAP_MAX_THREADS} system property and if not set, defaults to 2*cpus.
 * @see Runtime#availableProcessors()
 * @return the maximum number of threads to use for the bootstrap service container.
 */
public static int getBootstrapMaxThreads() {
    // Base the bootstrap thread on proc count if not specified
    int cpuCount = ProcessorInfo.availableProcessors();
    int defaultThreads = cpuCount * 2;
    String maxThreads = WildFlySecurityManager.getPropertyPrivileged(BOOTSTRAP_MAX_THREADS, null);
    if (maxThreads != null && maxThreads.length() > 0) {
        try {
            int max = Integer.decode(maxThreads);
            defaultThreads = Math.max(max, 1);
        } catch(NumberFormatException ex) {
            ServerLogger.ROOT_LOGGER.failedToParseCommandLineInteger(BOOTSTRAP_MAX_THREADS, maxThreads);
        }
    }
    return defaultThreads;
}
 

protected static String usage(String executableBaseName) {
    boolean isWindows = (WildFlySecurityManager.getPropertyPrivileged("os.name", null)).toLowerCase(Locale.ENGLISH).contains("windows");
    String executableName = isWindows ? executableBaseName : executableBaseName + ".sh";

    if (USAGE == null) {
        final StringBuilder sb = new StringBuilder();
        sb.append(NEW_LINE).append(ProcessLogger.ROOT_LOGGER.argUsage(executableName)).append(NEW_LINE);

        for (int i = 0; i < arguments.size(); i++) {
            sb.append(getCommand(i)).append(NEW_LINE);
        }
        USAGE = sb.toString();
    }
    return USAGE;

}
 

static void setGlobalJaasConfiguration(final Configuration configuration) throws SecurityException {
    if (WildFlySecurityManager.isChecking() == false) {
        internalSetGlobalJaasConfiguration(configuration);
    } else {

        try {
            doPrivileged(new PrivilegedExceptionAction<Void>() {

                @Override
                public Void run() throws Exception {
                    internalSetGlobalJaasConfiguration(configuration);

                    return null;
                }

            });
        } catch (PrivilegedActionException e) {
            throw (SecurityException) e.getCause();
        }

    }
}
 

private AccessAuditContext(final boolean inflowed, final SecurityIdentity securityIdentity, final InetAddress remoteAddress, final AccessAuditContext previous) {
    // This can only be instantiated as part of the doAs call.
    this.securityIdentity = securityIdentity;
    // The address would be set on the first context in the stack so use it.
    if (previous != null) {
        domainUuid = previous.domainUuid;
        accessMechanism = previous.accessMechanism;
        domainRollout = previous.domainRollout;
        this.remoteAddress = previous.remoteAddress;
        this.inflowed = previous.inflowed;
    } else {
        this.inflowed = inflowed;
        this.remoteAddress = remoteAddress;
    }

    // This is checked here so code can not obtain a reference to an AccessAuditContext with an inflowed identity and then
    // use it swap in any arbitrary identity.
    if (this.inflowed && WildFlySecurityManager.isChecking()) {
        System.getSecurityManager().checkPermission(ControllerPermission.INFLOW_SECURITY_IDENTITY);
    }
}
 

private static int getCorePoolSize(boolean forDomain) {
    String val = WildFlySecurityManager.getPropertyPrivileged(CONFIG_SYS_PROP, null);
    if (val != null) {
        try {
            int result = Integer.parseInt(val);
            if (result >= 0) {
                return result;
            } else {
                ServerLogger.ROOT_LOGGER.invalidPoolCoreSize(val, CONFIG_SYS_PROP);
            }
        } catch (NumberFormatException nfe) {
            ServerLogger.ROOT_LOGGER.invalidPoolCoreSize(val, CONFIG_SYS_PROP);
        }

    }
    return forDomain ? DEFAULT_DOMAIN_CORE_POOL_SIZE : DEFAULT_CORE_POOL_SIZE;
}
 

@Override
public void activate(final ServiceActivatorContext serviceActivatorContext) throws ServiceRegistryException {
    final ServiceTarget serviceTarget = serviceActivatorContext.getServiceTarget();
    final ServiceName endpointName = managementSubsystemEndpoint ? RemotingServices.SUBSYSTEM_ENDPOINT : ManagementRemotingServices.MANAGEMENT_ENDPOINT;
    final EndpointService.EndpointType endpointType = managementSubsystemEndpoint ? EndpointService.EndpointType.SUBSYSTEM : EndpointService.EndpointType.MANAGEMENT;
    try {
        ManagementWorkerService.installService(serviceTarget);
        // TODO see if we can figure out a way to work in the vault resolver instead of having to use ExpressionResolver.SIMPLE
        @SuppressWarnings("deprecation")
        final OptionMap options = EndpointConfigFactory.create(ExpressionResolver.SIMPLE, endpointConfig, DEFAULTS);
        ManagementRemotingServices.installRemotingManagementEndpoint(serviceTarget, endpointName, WildFlySecurityManager.getPropertyPrivileged(ServerEnvironment.NODE_NAME, null), endpointType, options);

        // Install the communication services
        final ServiceBuilder<?> sb = serviceTarget.addService(HostControllerConnectionService.SERVICE_NAME);
        final Supplier<ExecutorService> esSupplier = Services.requireServerExecutor(sb);
        final Supplier<ScheduledExecutorService> sesSupplier = sb.requires(ServerService.JBOSS_SERVER_SCHEDULED_EXECUTOR);
        final Supplier<Endpoint> eSupplier = sb.requires(endpointName);
        final Supplier<ProcessStateNotifier> cpsnSupplier = sb.requires(ControlledProcessStateService.INTERNAL_SERVICE_NAME);
        sb.setInstance(new HostControllerConnectionService(managementURI, serverName, serverProcessName, authKey, initialOperationID, managementSubsystemEndpoint, sslContextSupplier, esSupplier, sesSupplier, eSupplier, cpsnSupplier));
        sb.install();
    } catch (OperationFailedException e) {
        throw new ServiceRegistryException(e);
    }
}
 

private static int resolveDefaultTimeout() {
    String propValue = WildFlySecurityManager.getPropertyPrivileged(SYSTEM_PROPERTY, DEFAULT_TIMEOUT_STRING);
    if (sysPropLocalValue == null || !sysPropLocalValue.equals(propValue)) {
        // First call or the system property changed
        sysPropLocalValue = propValue;
        int number = -1;
        try {
            number = Integer.valueOf(sysPropLocalValue);
        } catch (NumberFormatException nfe) {
            // ignored
        }

        if (number > 0) {
            defaultLocalValue = number * 1000; // seconds to ms
        } else {
            ControllerLogger.MGMT_OP_LOGGER.invalidDefaultBlockingTimeout(sysPropLocalValue, SYSTEM_PROPERTY, DEFAULT_TIMEOUT);
            defaultLocalValue = DEFAULT_TIMEOUT * 1000; // seconds to ms
        }
    }
    return defaultLocalValue;
}
 

/** Allows testsuites to shorten the domain timeout adder */
private static int resolveDomainTimeoutAdder() {
    String propValue = WildFlySecurityManager.getPropertyPrivileged(DOMAIN_TEST_SYSTEM_PROPERTY, DEFAULT_DOMAIN_TIMEOUT_STRING);
    if (sysPropDomainValue == null || !sysPropDomainValue.equals(propValue)) {
        // First call or the system property changed
        sysPropDomainValue = propValue;
        int number = -1;
        try {
            number = Integer.valueOf(sysPropDomainValue);
        } catch (NumberFormatException nfe) {
            // ignored
        }

        if (number > 0) {
            defaultDomainValue = number; // this one is in ms
        } else {
            ControllerLogger.MGMT_OP_LOGGER.invalidDefaultBlockingTimeout(sysPropDomainValue, DOMAIN_TEST_SYSTEM_PROPERTY, DEFAULT_DOMAIN_TIMEOUT_ADDER);
            defaultDomainValue = DEFAULT_DOMAIN_TIMEOUT_ADDER;
        }
    }
    return defaultDomainValue;
}
 

private File getJBossHome(final ParsedCommandLine parsedCmd) throws CommandLineException {
    String jbossHome = this.jbossHome == null ? null : this.jbossHome.getValue(parsedCmd);
    if (jbossHome == null || jbossHome.length() == 0) {
        jbossHome = WildFlySecurityManager.getEnvPropertyPrivileged("JBOSS_HOME", null);
        if (jbossHome == null || jbossHome.length() == 0) {
            if (this.jbossHome != null) {
                throw new CommandLineException("Missing configuration value for --jboss-home and environment variable JBOSS_HOME is not set");
            } else {
                throw new CommandLineException("Environment variable JBOSS_HOME is not set");
            }
        }
        return validateJBossHome(jbossHome, "environment variable JBOSS_HOME");
    } else {
        return validateJBossHome(jbossHome, "argument --jboss-home");
    }
}
 

private XMLStreamException loadModule(final String moduleName, final XMLMapper xmlMapper) throws XMLStreamException {
    // Register element handlers for this extension
    try {
        final Module module = moduleLoader.loadModule(ModuleIdentifier.fromString(moduleName));
        boolean initialized = false;
        for (final Extension extension : module.loadService(Extension.class)) {
            ClassLoader oldTccl = WildFlySecurityManager.setCurrentContextClassLoaderPrivileged(extension.getClass());
            try {
                extensionRegistry.initializeParsers(extension, moduleName, xmlMapper);
            } finally {
                WildFlySecurityManager.setCurrentContextClassLoaderPrivileged(oldTccl);
            }
            if (!initialized) {
                initialized = true;
            }
        }
        if (!initialized) {
            throw ControllerLogger.ROOT_LOGGER.notFound("META-INF/services/", Extension.class.getName(), module.getName());
        }
        return null;
    } catch (final ModuleLoadException e) {
        throw ControllerLogger.ROOT_LOGGER.failedToLoadModule(e);
    }
}
 

static void addShutdownHook(Thread hook) {
    if (! WildFlySecurityManager.isChecking()) {
        getRuntime().addShutdownHook(hook);
    } else {
        doPrivileged(new AddShutdownHookAction(hook));
    }
}
 

@Override
public Boolean get() {
    if (WildFlySecurityManager.isChecking()) {
        return doPrivileged((PrivilegedAction<Boolean>) () -> SecurityContextAssociation.getSecurityContext() != null);
    } else {
        return SecurityContextAssociation.getSecurityContext() != null;
    }
}
 

private static Path findJavaHome() {
    String path = WildFlySecurityManager.getPropertyPrivileged("java.home", null);
    if (path != null) {
        path = WildFlySecurityManager.getEnvPropertyPrivileged("JAVA_HOME", null);
    }
    if (path == null) {
        return null;
    }
    Path resolved = Paths.get(path);
    if (Files.exists(resolved)) {
        return resolved;
    }
    return null;
}
 

private static boolean checkForPresence(final String key, final String value) {
    final String tmp = WildFlySecurityManager.getPropertyPrivileged(key, value);
    try {
        return tmp != null && tmp.trim().toLowerCase(Locale.ENGLISH).startsWith(value);
    } catch (Throwable t) {
        return false;
    }
}
 

private void setProperty(String name, String value) {
    if (value != null) {
        WildFlySecurityManager.setPropertyPrivileged(name, value);
    } else {
        WildFlySecurityManager.clearPropertyPrivileged(name);
    }
    if (systemPropertyUpdater != null) {
        systemPropertyUpdater.systemPropertyUpdated(name, value);
    }
}
 

EnvironmentRestorer(final String... propertyKeys) {
    this.propertiesToReset = new HashMap<>();
    for (String key : propertyKeys) {
        final String value = WildFlySecurityManager.getPropertyPrivileged(key, null);
        propertiesToReset.put(key, value);
    }
    propertiesToReset.put("jboss.home.dir", WildFlySecurityManager.getPropertyPrivileged("jboss.home.dir", null));
    propertiesToReset.put("org.jboss.boot.log.file", WildFlySecurityManager.getPropertyPrivileged("org.jboss.boot.log.file", null));
}
 

@Before
public void setup() throws Exception {
    readThreadActive = new AtomicBoolean(true);
    threads = new ArrayList<>();
    queue = new ArrayBlockingQueue<>(1);
    consoleInput = new PipedInputStream(bufferSize);
    consoleWriter = new PrintWriter(new PipedOutputStream(consoleInput));
    consoleOutput = new PipedOutputStream();
    consoleInputStream = new PipedInputStream(consoleOutput, bufferSize);
    consoleReader = new InputStreamReader(consoleInputStream);
    sb = new StringBuilder();
    // tests can  manipulate with jboss.cli.config system property thus we need  keep have original value so
    // it can be restored in @After phase
    originalCliConfig = WildFlySecurityManager.getPropertyPrivileged("jboss.cli.config", "");
}
 

@Test(expected = IllegalStateException.class)
public void testNotAdminOnlyFails() throws Exception {
    runningModeControl = new RunningModeControl(RunningMode.NORMAL);
    createCliScript("One\nTwo");
    WildFlySecurityManager.setPropertyPrivileged(AdditionalBootCliScriptInvoker.CLI_SCRIPT_PROPERTY, cliFile.getAbsolutePath());
    startController();
}
 

/**
 * Initialise the SSLContext and associated TrustManager for this CommandContext.
 *
 * If no configuration is specified the default mode of operation will be to use a lazily initialised TrustManager with no
 * KeyManager.
 */
private void initSSLContext() throws CliInitializationException {
    // If the standard properties have been set don't enable and CLI specific stores.
    if (WildFlySecurityManager.getPropertyPrivileged("javax.net.ssl.keyStore", null) != null
            || WildFlySecurityManager.getPropertyPrivileged("javax.net.ssl.trustStore", null) != null) {
        return;
    }

    this.defaultSslContext = config.getSslConfig() == null;
    sslContextFactory = new OneTimeSecurityFactory<>(this::createSslContext);
}
 

private void testPathDir(final String propName, final String value) throws IOException, InterruptedException {
    String currBaseDir = null;
    final String newStandalone = "CLIEmbedServerTestCaseStandaloneTmp";
    assertFalse(cli.isConnected());
    try {
        // save the current value
        currBaseDir = WildFlySecurityManager.getPropertyPrivileged(JBOSS_SERVER_BASE_DIR, null);
        // The current directory isn't set until the embedded server is started, just use the root directory if the
        // property was not previously set.
        if (currBaseDir == null) {
            currBaseDir = ROOT + File.separator + "standalone";
        }
        CLIEmbedUtil.copyServerBaseDir(ROOT, "standalone", newStandalone, true);
        String newBaseDir = ROOT + File.separator + newStandalone;
        WildFlySecurityManager.setPropertyPrivileged(propName, newBaseDir + File.separator + value);
        String line = "embed-server --std-out=echo " + JBOSS_HOME;
        cli.sendLine(line);
        assertTrue(cli.isConnected());

        for(String prop : SERVER_PROPS) {
            if (prop.equals(propName)) {
                assertPath(propName, ROOT + File.separator + newStandalone + File.separator + value);
            } else {
                // just make sure the unchanged property has the default basedir
                assertTrue(WildFlySecurityManager.getPropertyPrivileged(prop, "").contains(currBaseDir));
            }
        }
    } finally {
        // stop the server
        cli.sendLine("stop-embedded-server");
        // restore the original
        setProperties(currBaseDir);
        FileUtils.deleteDirectory(new File(ROOT + File.separator + newStandalone));
    }
}