应用DOD STIG Java Security Manager修复后Tomcat启动失败求助

为了符合DOD STIG关于Java Security Manager的修复要求，我修改了/etc/systemd/system/tomcat.service文件，将ExecStart参数改为：

ExecStart=/opt/tomcat/bin/startup.sh -security

修改后执行了systemctl daemon-reload，重启Tomcat后启动失败，catalina.out中报错如下：

19-Oct-2023 14:16:26.412 SEVERE [acop-startStop-1]
org.apache.catalina.core.ContainerBase.startInternal 子容器启动失败
java.util.concurrent.ExecutionException: org.apache.catalina.LifecycleException: 启动组件失败
[StandardEngine[a2].StandardHost[localhost].StandardContext[/a2]]
at java.util.concurrent.FutureTask.report(FutureTask.java:122)
at java.util.concurrent.FutureTask.get(FutureTask.java:192)
at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:892)
at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:793)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1362)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1352)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:750)
Caused by: org.apache.catalina.LifecycleException: 启动组件失败
[StandardEngine[a2].StandardHost[localhost].StandardContext[/a2]]
at org.apache.catalina.util.LifecycleBase.handleSubClassException(LifecycleBase.java:440)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:198)
... 6 more
Caused by: java.security.AccessControlException: 访问被拒绝 ("java.lang.RuntimePermission"
"accessClassInPackage.org.apache.catalina.connector")
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
at java.security.AccessController.checkPermission(AccessController.java:886)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1564)
at java.lang.ClassLoader$1.run(ClassLoader.java:496)
at java.lang.ClassLoader$1.run(ClassLoader.java:494)
at java.security.AccessController.doPrivileged(Native Method)
at java.lang.ClassLoader.checkPackageAccess(ClassLoader.java:494)
at java.lang.Class.getDeclaredFields0(Native Method)
at java.lang.Class.privateGetDeclaredFields(Class.java:2583)
at java.lang.Class.getDeclaredFields(Class.java:1916)
at org.apache.catalina.util.Introspection$1.run(Introspection.java:106)
at org.apache.catalina.util.Introspection$1.run(Introspection.java:103)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.util.Introspection.getDeclaredFields(Introspection.java:102)
at org.apache.catalina.startup.WebAnnotationSet.loadFieldsAnnotation(WebAnnotationSet.java:269)
at org.apache.catalina.startup.WebAnnotationSet.loadApplicationServletAnnotations(WebAnnotationSet.java:137)
at org.apache.catalina.startup.WebAnnotationSet.loadApplicationAnnotations(WebAnnotationSet.java:69)
at org.apache.catalina.startup.ContextConfig.applicationAnnotationsConfig(ContextConfig.java:329)

这个问题很常见，启用Java安全管理器后，默认的Tomcat安全策略会严格限制Web应用对内部API的访问，你的报错明确指向缺少accessClassInPackage.org.apache.catalina.connector权限。

• 编辑Tomcat安装目录下的conf/catalina.policy文件，给目标Web应用添加对应权限：

  grant codeBase "file:${catalina.base}/webapps/a2/-" {
      permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.connector";
  };
  

  其中a2是你报错里的Web应用名称，若存在多个应用，需要为每个应用单独配置对应的权限规则。

• 重启Tomcat后如果仍有其他权限拒绝的报错，直接根据catalina.out中的提示，在catalina.policy里补充缺失的权限即可。比如后续可能遇到的文件读写、其他包访问权限等，都需要按需添加。

• 注意：启用-security参数后，默认安全策略的限制非常严格，必须结合实际应用的功能需求逐步调整策略，才能保证应用正常运行。

内容的提问来源于stack exchange，提问作者Valdis Ibeh