Java permissions must be set for hosted applications.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62217	JBOS-AS-000025	SV-76707r1_rule		High

Description
The Java Security Manager is a java class that manages the external boundary of the Java Virtual Machine (JVM) sandbox, controlling how code executing within the JVM can interact with resources outside the JVM. The JVM requires a security policy in order to restrict application access. A properly configured security policy will define what rights the application has to the underlying system. For example, rights to make changes to files on the host system or to initiate network sockets in order to connect to another system.

Description

The Java Security Manager is a java class that manages the external boundary of the Java Virtual Machine (JVM) sandbox, controlling how code executing within the JVM can interact with resources outside the JVM. The JVM requires a security policy in order to restrict application access. A properly configured security policy will define what rights the application has to the underlying system. For example, rights to make changes to files on the host system or to initiate network sockets in order to connect to another system.

STIG	Date
JBoss EAP 6.3 Security Technical Implementation Guide	2015-11-09

Details

Check Text ( C-63021r1_chk )
Obtain documentation from the admin that identifies the applications hosted on the JBoss server as well as the corresponding rights the application requires. For example, if the application requires network socket permissions and file write permissions, those requirements should be documented. 1. Identify the JBoss installation as either domain or standalone and review the relevant configuration file. For domain installs: JBOSS_HOME/bin/domain.conf For standalone installs: JBOSS_HOME/bin/standalone.conf 2. Identify the location and name of the security policy by reading the JAVA_OPTS flag -Djava.security.policy= where will indicate name and location of security policy. If the application uses a policy URL, obtain URL and policy file from system admin. 3. Review security policy and ensure hosted applications have the appropriate restrictions placed on them as per documented application functionality requirements. If the security policy does not restrict application access to host resources as per documented requirements, this is a finding.

Check Text ( C-63021r1_chk )

Obtain documentation from the admin that identifies the applications hosted on the JBoss server as well as the corresponding rights the application requires. For example, if the application requires network socket permissions and file write permissions, those requirements should be documented.

1. Identify the JBoss installation as either domain or standalone and review the relevant configuration file.
For domain installs: JBOSS_HOME/bin/domain.conf
For standalone installs: JBOSS_HOME/bin/standalone.conf

2. Identify the location and name of the security policy by reading the JAVA_OPTS flag -Djava.security.policy= where will indicate name and location of security policy. If the application uses a policy URL, obtain URL and policy file from system admin.

3. Review security policy and ensure hosted applications have the appropriate restrictions placed on them as per documented application functionality requirements.

If the security policy does not restrict application access to host resources as per documented requirements, this is a finding.

Fix Text (F-68137r1_fix)
Configure the Java security manager to enforce access restrictions to the host system resources in accordance with application design and resource requirements.