Discussion:
[jira] [Created] (LOG4J2-348) Java2 Security for OSGi Bundles
Roland Weiglhofer (JIRA)
2013-08-14 07:51:47 UTC
Permalink
Roland Weiglhofer created LOG4J2-348:
----------------------------------------

Summary: Java2 Security for OSGi Bundles
Key: LOG4J2-348
URL: https://issues.apache.org/jira/browse/LOG4J2-348
Project: Log4j 2
Issue Type: Improvement
Components: API, Appenders, Core, JCL Bridge, log4j 1.2 emulation
Affects Versions: 2.0
Environment: OSGi / Apache Felix 4.x
Reporter: Roland Weiglhofer
Priority: Minor
Fix For: 2.0


OSGi defines permissions for bundles. Bundles should have only those permissions that they need to function. This is very easy to implement. Just add a directory OSGI-INF in the jar and include the file permissions.perm.

Here are some examples
(org.osgi.framework.PackagePermission "package name" "import")
(org.osgi.framework.PackagePermission "package name" "export")
(org.osgi.framework.BundlePermission "groupID.artifactID of Host" "host");
(org.osgi.framework.ServicePermission "class name" "get")
(org.osgi.framework.ServicePermission "class name" "register")
(org.osgi.framework.ConfigurationPermission * "configure")
(org.osgi.framework.AdminPermission * "metadata")

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
Roland Weiglhofer (JIRA)
2013-08-14 08:37:47 UTC
Permalink
[ https://issues.apache.org/jira/browse/LOG4J2-348?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Roland Weiglhofer updated LOG4J2-348:
-------------------------------------

Description:
OSGi defines permissions for bundles. Bundles should have only those permissions that they need to function. This is very easy to implement. Just add a directory OSGI-INF in the jar and include the file permissions.perm.

Here are some examples
(org.osgi.framework.PackagePermission "package name" "import")
(org.osgi.framework.PackagePermission "package name" "export")
(org.osgi.framework.BundlePermission "groupID.artifactID of Host" "host");
(org.osgi.framework.ServicePermission "class name" "get")
(org.osgi.framework.ServicePermission "class name" "register")
(org.osgi.framework.ConfigurationPermission * "configure")
(org.osgi.framework.AdminPermission * "metadata")

pom

...
<build>
<resources>
<resource>
<directory>OSGI-INF/</directory>
<filtering>true</filtering>
<includes>
<include>permissions.perm</include>
</includes>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
...
<configuration>
...
<instructions>
...
<Include-Resource>
{maven-resources},
OSGI-INF/=OSGI-INF/
</Include-Resource>
...
</instructions>
...
</configuration>
...
</plugin>
...

was:
OSGi defines permissions for bundles. Bundles should have only those permissions that they need to function. This is very easy to implement. Just add a directory OSGI-INF in the jar and include the file permissions.perm.

Here are some examples
(org.osgi.framework.PackagePermission "package name" "import")
(org.osgi.framework.PackagePermission "package name" "export")
(org.osgi.framework.BundlePermission "groupID.artifactID of Host" "host");
(org.osgi.framework.ServicePermission "class name" "get")
(org.osgi.framework.ServicePermission "class name" "register")
(org.osgi.framework.ConfigurationPermission * "configure")
(org.osgi.framework.AdminPermission * "metadata")
Post by Roland Weiglhofer (JIRA)
Java2 Security for OSGi Bundles
-------------------------------
Key: LOG4J2-348
URL: https://issues.apache.org/jira/browse/LOG4J2-348
Project: Log4j 2
Issue Type: Improvement
Components: API, Appenders, Core, JCL Bridge, log4j 1.2 emulation
Affects Versions: 2.0
Environment: OSGi / Apache Felix 4.x
Reporter: Roland Weiglhofer
Priority: Minor
Labels: OSGi, Security
Fix For: 2.0
OSGi defines permissions for bundles. Bundles should have only those permissions that they need to function. This is very easy to implement. Just add a directory OSGI-INF in the jar and include the file permissions.perm.
Here are some examples
(org.osgi.framework.PackagePermission "package name" "import")
(org.osgi.framework.PackagePermission "package name" "export")
(org.osgi.framework.BundlePermission "groupID.artifactID of Host" "host");
(org.osgi.framework.ServicePermission "class name" "get")
(org.osgi.framework.ServicePermission "class name" "register")
(org.osgi.framework.ConfigurationPermission * "configure")
(org.osgi.framework.AdminPermission * "metadata")
pom
...
<build>
<resources>
<resource>
<directory>OSGI-INF/</directory>
<filtering>true</filtering>
<includes>
<include>permissions.perm</include>
</includes>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
...
<configuration>
...
<instructions>
...
<Include-Resource>
{maven-resources},
OSGI-INF/=OSGI-INF/
</Include-Resource>
...
</instructions>
...
</configuration>
...
</plugin>
...
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
Matt Sicker (JIRA)
2014-04-22 03:42:15 UTC
Permalink
[ https://issues.apache.org/jira/browse/LOG4J2-348?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Matt Sicker reassigned LOG4J2-348:
----------------------------------

Assignee: Matt Sicker
Post by Roland Weiglhofer (JIRA)
Java2 Security for OSGi Bundles
-------------------------------
Key: LOG4J2-348
URL: https://issues.apache.org/jira/browse/LOG4J2-348
Project: Log4j 2
Issue Type: Improvement
Components: API, Appenders, Core, JCL Bridge, log4j 1.2 emulation
Affects Versions: 2.0
Environment: OSGi / Apache Felix 4.x
Reporter: Roland Weiglhofer
Assignee: Matt Sicker
Priority: Minor
Labels: OSGi, Security
Fix For: 2.0
OSGi defines permissions for bundles. Bundles should have only those permissions that they need to function. This is very easy to implement. Just add a directory OSGI-INF in the jar and include the file permissions.perm.
Here are some examples
(org.osgi.framework.PackagePermission "package name" "import")
(org.osgi.framework.PackagePermission "package name" "export")
(org.osgi.framework.BundlePermission "groupID.artifactID of Host" "host");
(org.osgi.framework.ServicePermission "class name" "get")
(org.osgi.framework.ServicePermission "class name" "register")
(org.osgi.framework.ConfigurationPermission * "configure")
(org.osgi.framework.AdminPermission * "metadata")
pom
...
<build>
<resources>
<resource>
<directory>OSGI-INF/</directory>
<filtering>true</filtering>
<includes>
<include>permissions.perm</include>
</includes>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
...
<configuration>
...
<instructions>
...
<Include-Resource>
{maven-resources},
OSGI-INF/=OSGI-INF/
</Include-Resource>
...
</instructions>
...
</configuration>
...
</plugin>
...
--
This message was sent by Atlassian JIRA
(v6.2#6252)
Łukasz Dywicki (JIRA)
2014-04-22 08:49:17 UTC
Permalink
[ https://issues.apache.org/jira/browse/LOG4J2-348?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13976555#comment-13976555 ]

Łukasz Dywicki commented on LOG4J2-348:
---------------------------------------

You don't need any extra entries in maven-bundle-plugin configuration as long as you will place permission file in src/main/resources/OSGI-INF.
Post by Roland Weiglhofer (JIRA)
Java2 Security for OSGi Bundles
-------------------------------
Key: LOG4J2-348
URL: https://issues.apache.org/jira/browse/LOG4J2-348
Project: Log4j 2
Issue Type: Improvement
Components: API, Appenders, Core, JCL Bridge, log4j 1.2 emulation
Affects Versions: 2.0
Environment: OSGi / Apache Felix 4.x
Reporter: Roland Weiglhofer
Assignee: Matt Sicker
Priority: Minor
Labels: OSGi, Security
Fix For: 2.0
OSGi defines permissions for bundles. Bundles should have only those permissions that they need to function. This is very easy to implement. Just add a directory OSGI-INF in the jar and include the file permissions.perm.
Here are some examples
(org.osgi.framework.PackagePermission "package name" "import")
(org.osgi.framework.PackagePermission "package name" "export")
(org.osgi.framework.BundlePermission "groupID.artifactID of Host" "host");
(org.osgi.framework.ServicePermission "class name" "get")
(org.osgi.framework.ServicePermission "class name" "register")
(org.osgi.framework.ConfigurationPermission * "configure")
(org.osgi.framework.AdminPermission * "metadata")
pom
...
<build>
<resources>
<resource>
<directory>OSGI-INF/</directory>
<filtering>true</filtering>
<includes>
<include>permissions.perm</include>
</includes>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
...
<configuration>
...
<instructions>
...
<Include-Resource>
{maven-resources},
OSGI-INF/=OSGI-INF/
</Include-Resource>
...
</instructions>
...
</configuration>
...
</plugin>
...
--
This message was sent by Atlassian JIRA
(v6.2#6252)
Remko Popma (JIRA)
2014-07-18 03:44:05 UTC
Permalink
[ https://issues.apache.org/jira/browse/LOG4J2-348?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Remko Popma updated LOG4J2-348:
-------------------------------

Fix Version/s: (was: 2.0)
2.1
Post by Roland Weiglhofer (JIRA)
Java2 Security for OSGi Bundles
-------------------------------
Key: LOG4J2-348
URL: https://issues.apache.org/jira/browse/LOG4J2-348
Project: Log4j 2
Issue Type: Improvement
Components: API, Appenders, Core, JCL Bridge, log4j 1.2 emulation
Affects Versions: 2.0
Environment: OSGi / Apache Felix 4.x
Reporter: Roland Weiglhofer
Assignee: Matt Sicker
Priority: Minor
Labels: OSGi, Security
Fix For: 2.1
OSGi defines permissions for bundles. Bundles should have only those permissions that they need to function. This is very easy to implement. Just add a directory OSGI-INF in the jar and include the file permissions.perm.
Here are some examples
(org.osgi.framework.PackagePermission "package name" "import")
(org.osgi.framework.PackagePermission "package name" "export")
(org.osgi.framework.BundlePermission "groupID.artifactID of Host" "host");
(org.osgi.framework.ServicePermission "class name" "get")
(org.osgi.framework.ServicePermission "class name" "register")
(org.osgi.framework.ConfigurationPermission * "configure")
(org.osgi.framework.AdminPermission * "metadata")
pom
...
<build>
<resources>
<resource>
<directory>OSGI-INF/</directory>
<filtering>true</filtering>
<includes>
<include>permissions.perm</include>
</includes>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
...
<configuration>
...
<instructions>
...
<Include-Resource>
{maven-resources},
OSGI-INF/=OSGI-INF/
</Include-Resource>
...
</instructions>
...
</configuration>
...
</plugin>
...
--
This message was sent by Atlassian JIRA
(v6.2#6252)
Remko Popma (JIRA)
2014-09-20 06:07:33 UTC
Permalink
[ https://issues.apache.org/jira/browse/LOG4J2-348?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Remko Popma updated LOG4J2-348:
-------------------------------
Fix Version/s: (was: 2.1)
2.2
Post by Roland Weiglhofer (JIRA)
Java2 Security for OSGi Bundles
-------------------------------
Key: LOG4J2-348
URL: https://issues.apache.org/jira/browse/LOG4J2-348
Project: Log4j 2
Issue Type: Improvement
Components: API, Appenders, Core, JCL Bridge, log4j 1.2 emulation
Affects Versions: 2.0
Environment: OSGi / Apache Felix 4.x
Reporter: Roland Weiglhofer
Assignee: Matt Sicker
Priority: Minor
Labels: OSGi, Security
Fix For: 2.2
OSGi defines permissions for bundles. Bundles should have only those permissions that they need to function. This is very easy to implement. Just add a directory OSGI-INF in the jar and include the file permissions.perm.
Here are some examples
(org.osgi.framework.PackagePermission "package name" "import")
(org.osgi.framework.PackagePermission "package name" "export")
(org.osgi.framework.BundlePermission "groupID.artifactID of Host" "host");
(org.osgi.framework.ServicePermission "class name" "get")
(org.osgi.framework.ServicePermission "class name" "register")
(org.osgi.framework.ConfigurationPermission * "configure")
(org.osgi.framework.AdminPermission * "metadata")
pom
...
<build>
<resources>
<resource>
<directory>OSGI-INF/</directory>
<filtering>true</filtering>
<includes>
<include>permissions.perm</include>
</includes>
</resource>
</resources>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
...
<configuration>
...
<instructions>
...
<Include-Resource>
{maven-resources},
OSGI-INF/=OSGI-INF/
</Include-Resource>
...
</instructions>
...
</configuration>
...
</plugin>
...
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Loading...