Practical security In a modular world

@martin_fmi
Practical security
in a modular world
Martin Toshev

@martin_fmi
Who am I
Software consultant (CoffeeCupConsulting)
BG JUG board member (http://jug.bg)
OpenJDK and Oracle RDBMS enthusiast
2

@martin_fmi
Agenda
• Security sandbox model at a glance
• Security aspects of Jigsaw
• Jigsaw vs OSGi from a security perspective
3

@martin_fmi
Security sandbox model
at a glance
4

@martin_fmi
The big picture
5
applet/war/bundle
System code
JVM
Browser/Java EE server/OSGI server
grant codeBase http://javaday.ua/demoapplet {
permission java.io.FilePermisions “C:Windows” “delete”
}
java.policy
SecurityManager.checkPermission(…)
AccessController.checkPermission(…)

@martin_fmi
Permission checking
• Typical flow for permission checking:
1) upon system startup a security policy is set and a security manager
is installed:
6
Policy.setPolicy(…)
System.setSecurityManager(…)

@martin_fmi
Permission checking
2) during classloading (e.g. of a remote applet) bytecode verification is
done and the protection domain is set for the current classloader
(along with the code source, the set of permissions and the set of
JAAS principals)
7

@martin_fmi
Protection Domain
• The protection domain is set during classloading and
contains the code source, the list of principals and the list
of permissions for the class
• Two types of protection domain: system and application
8
object.getClass().getProtectionDomain();

@martin_fmi
Permission checking
3) when system code is invoked from the remote code the
SecurityManager is used to check against the intersection of
protection domains based on the chain of threads and their call
stacks
9

@martin_fmi
Permission checking
10
SocketPermission permission = new
SocketPermission(“javaday.ua:8000-9000","connect,accept");
SecurityManager sm = System.getSecurityManager();
if (sm != null) {
sm.checkPermission(permission);
}

@martin_fmi
Permission checking
4) application code can also do permission checking against remote
code using a SecurityManager or an AccessController
11

@martin_fmi
Permission checking
12
SocketPermission permission = new
SocketPermission(“javaday.ua:8000-9000", "connect,accept");
AccessController.checkPermission(permission)

@martin_fmi
Permission checking
5) application code can also do permission checking with all
permissions of the calling domain or a particular JAAS subject
13
AccessController.doPrivileged(…)
Subject.doAs(…)
Subject.doAsPrivileged(…)

@martin_fmi
Example: banking app server
14
FIX protocol integration
Banking server (plain Java)
Alpha protocol integration
Demo application
…

@martin_fmi
Security sandbox model
at a glance
(demo)
15

@martin_fmi
Security aspects of Jigsaw
16

@martin_fmi
The big picture
17
JVM
Application
grant codeBase http://javaday.ua/demoapplet {
permission java.io.FilePermisions “C:Windows” “delete”
}
java.policy
SecurityManager.checkPermission(…)
AccessController.checkPermission(…)
java.base
java.logging
other module

@martin_fmi
Security implications
• The security model remains the same with Java modules
• System code is split into modules and applications can
use a stripped down VM => improved security
• Application code can be split into modules with stronger
encapsulation at runtime => improved security
18

@martin_fmi
Access control
• Access control is governed not by the class loader(s) of
the module’s classes but by the module itself
• Access modifiers are fulfilled by another layer of
encapsulation: exported/opened packages
19

@martin_fmi
Runtime modules
• Modules can also be defined at runtime with multiple
classloaders and grouped into module layers for that
purpose:
20
obj.getClass().getModule().getLayer().defineModulesXXX(…)

@martin_fmi
Security aspects of Jigsaw
(demo)
21

@martin_fmi
OSGi vs Jigsaw
from a security perspective
22

@martin_fmi
OSGi security model
• An extension of the Java security model
• The OSGi spec provides a set of custom permissions such
as PackagePermission (in order to specify whether a
bundle exports/imports a package) or ServicePermission
(to get or register an OSGI service)
23

@martin_fmi
OSGi security model
• The PermissionAdmin and ConditionalPermissionAdmin
classes provide additional permission management on
top of SecurityManager
• Local permissions can be specified for each bundle in
OSGI-INF/permissions.perm and are useful for bundle
security auditing
24

@martin_fmi
OSGi vs Jigsaw
• Both a Jigsaw module and an OSGi bundle have a distinct
protection domain that defines the set of permissions for
the Jigsaw module/OSGi bundle
• Both a Jigsaw module and an OSGi bundle can be signed
and the set of permissions can be defined on the signer
of the Jigsaw module/OSGi bundle
25

@martin_fmi
OSGi vs Jigsaw
• A Jigsaw module doesn’t have the notion of “local
permissions” as an OSGi bundle
• A runtime Jigsaw module can have classes from multiple
classloaders that have different protection domains
26

@martin_fmi
Summary
• The new module system in Java brings better security
while still fitting in platform’s security architecture
• The new module systems introduces yet another layer of
access control for applications
27

@martin_fmi
Thank you !
Q&A
28
demos: https://github.com/martinfmi/practical_security_in_a_modular_world

@martin_fmi
References
29
Java platform security architecture
http://docs.oracle.com/javase/7/docs/technotes/guides/security/spec/securi
ty-spec.doc.html
Java Platform Module System (JSR 376)
http://openjdk.java.net/projects/jigsaw/spec/

Practical security In a modular world

More Related Content

Similar to Practical security In a modular world

More from Martin Toshev

Recently uploaded

Practical security In a modular world