Security manager is too restrictive by default.

[Nicolas Ternisien]

Binary package hint: tomcat5.5

If we want to use the default Ubuntu packaging of Tomcat 5.5 server, we need to have less restrictive access on webapps folder and the shared/lib folder.

The Tomcat 5.5 server is launched by the tomcat5 user, so even if these restrictions are less important, the system will still be protected.

Indeed, it's a real hell today to install an web application which needs to right its log file /var/log/<appname>, simply because the security manager is too restrictive. New Tomcat users needs many times before finding the /etc/tomcat5.5/policy.d folder, and find how to modify it to have something that the Linux FS rights already provide.

So I hope that the providen patch will be applied on the /etc/tomcat5.5/policy.d/ folder.

[Matti Lindell (mlind)]

I added a Debian bug that is about same/similar subject. You should probably send the patch directly there for a review and possible inclusion.

[Sebastian Cardello (guindous)]

Debian Etch has a property in /etc/default/tomcat5.5 file that disable all that security. Just set:

TOMCAT5_SECURITY=no

Maybe, i'm not sure, making this option by default it's an easy way to solve this problem.

[Michael Koch (konqueror)]

I would consider disabling the security manager to be a security issue. Server admins should be aware of this do this explicitely. Disabling this silently is really a bad decision.

[Sam (sam-halliday)]

This bug report is invalid... Tomcat is the reference implementation of the Servlet framework and if your web application requires additional security permissions, then please read the documentation and add the relevant permissions to the file /etc/tomcat5.5/policy.d/50user.policy for that application. The security policy of Tomcat is mission critical in many cases.

You can start here http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html

Request that this bug report be marked invalid, as it is not a bug.

[Sam (sam-halliday)]

The referenced bug isn't related at all!

[Glenn Murray (gmurray-mines)]

This is a valid bug report.

It is much too difficult to get a webapp going out-of-the box. The suggestion to "start" by reading the howto only emphasizes the difficulty and is an unreasonable expectation for an Ubuntu distribution. Note that if you go to the Tomcat website and download and install it manually, that you can have a working implementation immediately. There is no reason Ubuntu should be more restrictive than Apache with Tomcat, especially in comparison to say, MySQL, with its empty root password, or the Apache webserver, which also works out-of the box. The current configuration is a barrier to adoption.

Whether or not Tomcat is a reference implementation is irrelevant.
Whether or not the security policy is "mission critical" is also irrelevant; that is the responsibility of the person running the app, not Ubuntu.

This is an example of free software that needs to be set free.