Configuring Minimal File Access Permissions

The Oxygen XML Web Author Component requires access to the following file resources:

• READ access to the directory where the Oxygen XML Web Author Component is deployed.
• READ and WRITE access to the application's working directory.
• READ and WRITE access to JVM's temporary directory.

It is a good security practice to allow a component to access only the information and resources that are necessary for its purpose. In an environment that uses Apache Tomcat, you can enforce these rules following these steps:

• Start the Apache Tomcat server using the -security flag.

• Edit the catalina.policy file and add the following snippet:

grant codeBase "file:${catalina.base}/webapps/oxygen-webapp/-" {
  // Oxygen uses System properties for various configuration purposes.
  permission java.util.PropertyPermission "*", "read,write";
  // Oxygen custom protocols need access to network.
  permission java.net.NetPermission "*";
  permission java.net.SocketPermission "*", "accept,connect,listen,resolve";
  // The web framework used by Oxygen Webapp uses reflection and classloaders.
  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
  permission java.security.SecurityPermission "*";
  permission java.util.logging.LoggingPermission "control";
  permission java.lang.RuntimePermission "*";

  // Oxygen requires these permissions to connect to a URL.
  permission java.net.URLPermission "http:*", "*";
  permission java.net.URLPermission "https:*", "*";
  permission java.net.URLPermission "file:*", "*";

  // Oxygen should be allowed to read JVM jars
  permission java.io.FilePermission "${java.home}/-", "read";
	
  // Oxygen uses the JVM's java.io.tempdir for various file handling tasks.
  permission java.io.FilePermission "${java.io.tmpdir}/-", "read,write,delete";
  permission java.io.FilePermission "${java.io.tmpdir}", "read,write,delete";

  // Folder used by oXygen to deploy the plugins to.
  permission java.io.FilePermission "${oxygen.data.dir}/-", "read,write,delete";
  permission java.io.FilePermission "${oxygen.data.dir}", "read,write,delete";
};
// The jar that contains sandboxing code.
grant codeBase 
  "jar:file:${catalina.base}/oxygen-webapp/WEB-INF/lib/oxygen-sandbox.jar!/-" {
    permission java.security.AllPermission;
};
// Give all permissions to plugins code unless otherwise instructed by vendor.
grant codeBase "file:${oxygen.data.dir}/plugins-v18.1/-" {
    permission java.security.AllPermission;
};
// Give all permissions to frameworks code unless otherwise instructed by vendor
grant codeBase "file:${oxygen.data.dir}/frameworks-v18.1/-" {
    permission java.security.AllPermission;
};