SEC31-J. Never grant AllPermission to untrusted code

The java.security.AllPermission class grants all possible permissions to the caller. This facility was included for routine testing purposes to make it less cumbersome to deal with a multitude of permissions or for use when the code is completely trusted. It should never be applied to untrusted code.

Noncompliant Code Example

This noncompliant example grants AllPermission to the klib library. The permission itself is specified in the security policy file used by the security manager. Alternatively, a permission object can be obtained in the code by subclassing the Permission class (or any subclass such as BasicPermission) in the java.security package.

/* grant the klib library AllPermission */ 
grant codebase "file:${klib.home}/j2ee/home/klib.jar" { 
  permission java.security.AllPermission; 
}; 

Compliant Solution

This compliant solution shows a policy file that can be used to enforce fine-grained permissions.

grant codeBase "file:${klib.home}/j2ee/home/klib.jar", signedBy "Admin" {
    permission java.io.FilePermission "/tmp/*", "read";
    permission java.io.SocketPermission "*", "connect";
};

To check whether the caller has the requisite permissions, use the following check within the code:

//security manager code
perm = new java.io.FilePermission("/tmp/JavaFile","read");
//other code

Always assign appropriate permissions to code. When more control is required over the granularity of permissions, define custom permissions. (SEC11-J. Define custom security permissions for fine grained security)

Exceptions

SEC31-EX1: It may be necessary to grant AllPermission to trusted library code so that callbacks will work. For example, it is common practice to grant AllPermission to the Java system code:

// Standard extensions get all permissions by default
grant codeBase "file:${{java.ext.dirs}}/*" {
	permission java.security.AllPermission;
};

Risk Assessment

Granting AllPermission to untrusted code allows it to perform arbitrary operations.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[API 06]] Class AllPermission
[[Gong 03]]
[[Security 06]] Security Architecture

SEC30-J. Always use a Security Manager      00. Security (SEC)      SEC32-J. Do not grant ReflectPermission with target suppressAccessChecks