[KARAF-3400] Enabling Java System Security and OSGi security leaves Karaf in unusable state

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.2, 4.0.0.M1
• Fix Version/s: 4.1.0, 4.0.8
• Component/s: karaf
• Assignee: Guillaume Nodet
• Reporter: Achim Nierbeck
• Created: 04/Dec/14 21:30
• Updated: 19/Dec/19 17:36
• Resolved: 02/Nov/16 10:57

Description

It seems to boil down to the new functionalities of OSGi, like Bundle Adapt fails with the default security configuration

java.security.AccessControlException: access denied ("org.osgi.framework.AdaptPermission" "org.osgi.framework.wiring.BundleRevision" "adapt")
	at java.security.AccessControlContext.checkPermission(AccessControlContext.java:372)
	at org.eclipse.osgi.internal.permadmin.EquinoxSecurityManager.internalCheckPermission(EquinoxSecurityManager.java:117)
	at org.eclipse.osgi.internal.permadmin.EquinoxSecurityManager$CheckPermissionAction.run(EquinoxSecurityManager.java:60)
	at java.security.AccessController.doPrivileged(Native Method)

Just switch framework to equinox and enable the security params in etc/system.properties

#
# By default, only Karaf shell commands are secured, but additional services can be
#
# To enable OSGi security, uncomment the properties below,
# install the framework-security feature and restart.
#
java.security.policy=${karaf.etc}/all.policy
org.osgi.framework.security=osgi
org.osgi.framework.trust.repositories=${karaf.etc}/trustStore.ks

This also happens with Felix but needs the additional Felix.Security bundle to be installed.

Issue Links

• depends upon: KARAF-4405 Upgrade to Felix Framework 5.6.1
• depends upon: KARAF-4812 Upgrade to Felix ConfigAdmin 1.8.12
• is blocked by: FELIX-5148 Framework Security unusable
• relates to: KARAF-4790 Upgrade to felix framework security 2.6.0
• requires: FELIX-5384 EventDispatcher#createWhitelistFromHooks fails under security
• requires: FELIX-5385 ConfigAdmin uses wrong security when calling ManagedServices