catalina.policy?
// These permissions apply to javac
grant codeBase "file:${java.home}/lib/-" {
permission java.security.AllPermission;
};
// These permissions apply to all shared system extensions
grant codeBase "file:${java.home}/jre/lib/ext/-" {
permission java.security.AllPermission;
};
// These permissions apply to javac when ${java.home] points at
$JAVA_HOME/jre
grant codeBase "file:${java.home}/../lib/-" {
permission java.security.AllPermission;
};
// These permissions apply to all shared system extensions when
// ${java.home} points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/lib/ext/-" {
permission java.security.AllPermission;
};
// ========== CATALINA CODE PERMISSIONS
=======================================
// These permissions apply to the daemon code
grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
permission java.security.AllPermission;
};
// These permissions apply to the logging API
// Note: If tomcat-juli.jar is in ${catalina.base} and not in
${catalina.home},
// update this section accordingly.
// grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
permission java.io.FilePermission
"${java.home}${file.separator}lib${file.separator}logging.properties",
"read";
permission java.io.FilePermission
"${catalina.base}${file.separator}conf${file.separator}logging.properties",
"read";
permission java.io.FilePermission
"${catalina.base}${file.separator}logs", "read, write";
permission java.io.FilePermission
"${catalina.base}${file.separator}logs${file.separator}*", "read,
write";
permission java.lang.RuntimePermission "shutdownHooks";
permission java.lang.RuntimePermission "getClassLoader";
permission java.lang.RuntimePermission "setContextClassLoader";
permission java.util.logging.LoggingPermission "control";
permission java.util.PropertyPermission
"java.util.logging.config.class", "read";
permission java.util.PropertyPermission
"java.util.logging.config.file", "read";
permission java.util.PropertyPermission "catalina.base", "read";
// Note: To enable per context logging configuration, permit read
access to
// the appropriate file. Be sure that the logging configuration is
// secure before enabling such access.
// E.g. for the examples web application (uncomment and unwrap
// the following to be on a single line):
// permission java.io.FilePermission
"${catalina.base}${file.separator}
// webapps${file.separator}examples${file.separator}WEB-INF
// ${file.separator}classes${file.separator}logging.properties",
"read";
};
// These permissions apply to the server startup code
grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
permission java.security.AllPermission;
};
// These permissions apply to the servlet API classes
// and those that are shared across all class loaders
// located in the "lib" directory
grant codeBase "file:${catalina.home}/lib/-" {
permission java.security.AllPermission;
};
// If using a per instance lib directory, i.e. ${catalina.base}/lib,
// then the following permission will need to be uncommented
// grant codeBase "file:${catalina.base}/lib/-" {
// permission java.security.AllPermission;
// };
// ========== WEB APPLICATION PERMISSIONS
=====================================
// These permissions are granted by default to all web applications
// In addition, a web application will be given a read FilePermission
// and JndiPermission for all files and directories in its document root.
grant {
// Required for JNDI lookup of named JDBC DataSource's and
// javamail named MimePart DataSource used to send mail
permission java.util.PropertyPermission "java.home", "read";
permission java.util.PropertyPermission "java.naming.*", "read";
permission java.util.PropertyPermission "javax.sql.*", "read";
// OS Specific properties to allow read access
permission java.util.PropertyPermission "os.name", "read";
permission java.util.PropertyPermission "os.version", "read";
permission java.util.PropertyPermission "os.arch", "read";
permission java.util.PropertyPermission "file.separator", "read";
permission java.util.PropertyPermission "path.separator", "read";
permission java.util.PropertyPermission "line.separator", "read";
// JVM properties to allow read access
permission java.util.PropertyPermission "java.version", "read";
permission java.util.PropertyPermission "java.vendor", "read";
permission java.util.PropertyPermission "java.vendor.url", "read";
permission java.util.PropertyPermission "java.class.version", "read";
permission java.util.PropertyPermission "java.specification.version",
"read";
permission java.util.PropertyPermission "java.specification.vendor",
"read";
permission java.util.PropertyPermission "java.specification.name",
"read";
permission java.util.PropertyPermission "java.vm.specification.version",
"read";
permission java.util.PropertyPermission "java.vm.specification.vendor",
"read";
permission java.util.PropertyPermission "java.vm.specification.name",
"read";
permission java.util.PropertyPermission "java.vm.version", "read";
permission java.util.PropertyPermission "java.vm.vendor", "read";
permission java.util.PropertyPermission "java.vm.name", "read";
// Required for OpenJMX
permission java.lang.RuntimePermission "getAttribute";
// Allow read of JAXP compliant XML parser debug
permission java.util.PropertyPermission "jaxp.debug", "read";
// All JSPs need to be able to read this package
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.tomcat";
// Precompiled JSPs need access to these packages.
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.jasper.el";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.jasper.runtime";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.jasper.runtime.*";
// Precompiled JSPs need access to these system properties.
permission java.util.PropertyPermission
"org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
permission java.util.PropertyPermission
"org.apache.el.parser.COERCE_TO_ZERO", "read";
// The cookie code needs these.
permission java.util.PropertyPermission
"org.apache.catalina.STRICT_SERVLET_COMPLIANCE", "read";
permission java.util.PropertyPermission
"org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING", "read";
permission java.util.PropertyPermission
"org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR",
"read";
// Applications using Comet need to be able to access this package
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.comet";
};
// The Manager application needs access to the following packages to support
the
// session display functionality. These settings support the following
// configurations:
// - default CATALINA_HOME == CATALINA_BASE
// - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
// - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
grant codeBase "file:${catalina.base}/webapps/manager/-" {
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.ha.session";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.manager";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.manager.util";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.util";
};
grant codeBase "file:${catalina.home}/webapps/manager/-" {
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.ha.session";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.manager";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.manager.util";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.util";
};
// You can assign additional permissions to particular web applications by
// adding additional "grant" entries here, based on the code base for that
// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
//
// Different permissions can be granted to JSP pages, classes loaded from
// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
// directory, or even to individual jar files in the /WEB-INF/lib/
directory.
//
// For instance, assume that the standard "examples" application
// included a JDBC driver that needed to establish a network connection to
the
// corresponding database and used the scrape taglib to get the weather from
// the NOAA web server. You might create a "grant" entries like this:
//
// The permissions granted to the context root directory apply to JSP pages.
// grant codeBase "file:${catalina.base}/webapps/examples/-" {
// permission java.net.SocketPermission "dbhost.mycompany.com:5432",
"connect";
// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
// };
//
// The permissions granted to the context WEB-INF/classes directory
// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-"
{
// };
//
// The permission granted to your JDBC driver
// grant codeBase
"jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
// permission java.net.SocketPermission "dbhost.mycompany.com:5432",
"connect";
// };
// The permission granted to the scrape taglib
// grant codeBase
"jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
// permission java.net.SocketPermission "*.noaa.gov:80", "connect";
// };
> Can you paste the application web.xml file (inline) into your reply?
>
> <?xml version="1.0" encoding="UTF-8"?>
> <web-app
> xmlns:xsi="http://www.w3.org/**2001/XMLSchema-instance<http://www.w3.org/2001/XMLSchema-instance>
"
>
> xmlns="http://java.sun.com/**xml/ns/javaee<http://java.sun.com/xml/ns/javaee>
"
> xmlns:web="http://java.sun.**com/xml/ns/javaee/web-app_2_5.**
xsd <http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd>"
>
> xsi:schemaLocation="http://**java.sun.com/xml/ns/javaee<http://java.sun.com/xml/ns/javaee>
>
http://java.sun.com/xml/ns/**javaee/web-app_2_5.xsd<http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd>
"
> version="2.5">
> <display-name>WEB query</display-name>
> <description></description>
> <error-page>
> <error-code>404</error-code>
> <location>/includes/error404.**jsp</location>
> </error-page>
> <error-page>
> <error-code>500</error-code>
> <location>/includes/error500.**jsp</location>
> </error-page>
> <servlet>
> <description></description>
> <display-name>reportcmnt</**display-name>
> <servlet-name>reportcmnt</**servlet-name>
> <jsp-file>/jsp/reportcmnt.jsp<**/jsp-file>
> </servlet>
> <servlet-mapping>
> <servlet-name>reportcmnt</**servlet-name>
> <url-pattern>/reportcmnt</url-**pattern>
> </servlet-mapping>
> </web-app>
>
Do you have an access log configured, if so, what does it show?
0:0:0:0:0:0:0:1 - - [13/Nov/2011:09:50:32 +0300] "GET /query HTTP/1.1"
302
125 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML,
like
Gecko) Chrome/15.0.874.120 Safari/535.2"
0:0:0:0:0:0:0:1 - - [13/Nov/2011:09:50:32 +0300] "GET /query/ HTTP/1.1"
403
964 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML,
like
Gecko) Chrome/15.0.874.120 Safari/535.2"
0:0:0:0:0:0:0:1 - - [13/Nov/2011:11:40:54 +0300] "GET /query HTTP/1.1"
302
125
"http://localhost:8082/**manager/html;jsessionid=**
4D76EA53493CA915B556DB02D1D993**2E?org.apache.catalina.**
filters.CSRF_NONCE=**95AB554C225507BE146FBA41E2BF3A**97<http://localhost:8082/manager/html;jsessionid=4D76EA53493CA915B556DB02D1D9932E?org.apache.catalina.filters.CSRF_NONCE=95AB554C225507BE146FBA41E2BF3A97>
"
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like
Gecko)
Chrome/15.0.874.120 Safari/535.2"
0:0:0:0:0:0:0:1 - - [13/Nov/2011:11:40:54 +0300] "GET /query/ HTTP/1.1"
403
964
"http://localhost:8082/**manager/html;jsessionid=**
4D76EA53493CA915B556DB02D1D993**2E?org.apache.catalina.**
filters.CSRF_NONCE=**95AB554C225507BE146FBA41E2BF3A**97<http://localhost:8082/manager/html;jsessionid=4D76EA53493CA915B556DB02D1D9932E?org.apache.catalina.filters.CSRF_NONCE=95AB554C225507BE146FBA41E2BF3A97>
"
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like
Gecko)
Chrome/15.0.874.120 Safari/535.2"
What user account is Tomcat running under?
A: local system account. It has full access to the application's folders
and files.
OK, you're getting a 403 on http://localhost:8082/query/ but your
web.xml only shows a mapping for /reportcmnt and no welcome file
declarations. What happens if you use /query/reportcmnt instead?
A: 403 error again.
Is there perhaps an index.html that would have redirected
to /query/reportcmnt?
A: My index.html contains
<html>
<meta content="text/html;charset=**utf-8"/>
<head>
<title>WEB query</title>
</head>
<body>
<script>location="jsp/app.jsp"**</script>
</body>
</html>
Q: What version of Tomcat were you using prior to the win7 migration?
A: Tomcat 7.0.22.
I've just installed Tomcat 7.0.22 on WinXP,
then copied my app from Win7 to the WinXp webapps folder and run my app.
It works fine.
If you were using a pre-Tomcat7 version you may be butting up against
7's stricter servlet compliance. You should explicitly declare a
welcome file in web.xml.
Why?
------------------------------**------------------------------**---------
To unsubscribe, e-mail:
users-unsubscribe@tomcat.**apache.org<users-unsubscr...@tomcat.apache.org>
For additional commands, e-mail: users-h...@tomcat.apache.org
------------------------------**------------------------------**---------
To unsubscribe, e-mail:
users-unsubscribe@tomcat.**apache.org<users-unsubscr...@tomcat.apache.org>
For additional commands, e-mail: users-h...@tomcat.apache.org
------------------------------**------------------------------**---------
To unsubscribe, e-mail:
users-unsubscribe@tomcat.**apache.org<users-unsubscr...@tomcat.apache.org>
For additional commands, e-mail: users-h...@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
