[KARAF-6251] Jolokia bypasses JMX ACL

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 4.2.5
• Component/s: karaf
• Assignee: Jean-Baptiste Onofré
• Reporter: Tadayoshi Sato
• Created: 23/Apr/19 07:46
• Updated: 17/May/20 05:47
• Resolved: 17/May/20 05:47

Description

For example, after you install jolokia feature:

karaf@root()> feature:install jolokia

the invocation to Memory.gc() over Jolokia always gets successful even if the user viewer doesn't have the right:

$ curl -s -u viewer:viewer http://localhost:8181/jolokia/exec/java.lang:type=Memory/gc\(\)
{"request":{"mbean":"java.lang:type=Memory","type":"exec","operation":"gc()"},"value":null,"timestamp":1556005468,"status":200}

Note jmx.acl.java.lang.Memory.cfg only allows manager (not viewer) to invoke gc():

$ cat etc/jmx.acl.java.lang.Memory.cfg
...
gc = manager

This is actually an old issue, which must have been caused by KARAF-3147, as Jolokia is considered to be local JMX connection.

Issue Links

• is caused by: KARAF-3147 Local JMX connect is not possible