Grails 5.1.2-Application fails on Tomcat with Security Manager enabled and JDK11
- Dominant language
- Groovy
- Stars
- 2.9k
- Forks
- 975
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 92
Description
### Expected Behavior
Fresh created Grails 5.1.2-Application should start on Tomcat 9 with Security Manager enabled and all permissions granted (permission java.security.AllPermission in catalina.policy)
### Actual Behaviour
Although all permissions are granted, Tomcat with Security Manager enabled and JDK11 throws this error:
```
'2022-01-27 14:16:26.180 ERROR --- [ main] o.s.boot.SpringApplication : Application run failed
java.security.AccessControlException: access denied ("java.io.FilePermission" "/srv/catalina/apache-tomcat-9.0.56/webapps/testGrails512/WEB-INF/classes/META-INF/services/io.micronaut.inject.BeanDefinitionReference" "read")
```
Full log-file [catalina.2022-01-27.log](https://github.com/grails/grails-core/files/7950688/catalina.2022-01-27.log) is attached.
The same Tomcat-Instance starts correct when changed to JDK8.
Without Security Manager there are no problems with both JDK's.
The workaround from a similar [spring-boot issue](https://github.com/spring-projects/spring-boot/issues/17796) (starting Tomcat with `-Dsun.misc.URLClassPath.disableJarChecking=true`) didn't solve this problem.
### Steps To Reproduce
1. `grails create-app testGrails512 -profile web`
`cd testGrails512`
`grails war`
2. In a standalone Tomcat-instance change the content of `conf/catalina.policy` to
```
grant{
permission java.security.AllPermission;
};
```
3. drop the war-file into the `webapps`-folder
4. start tomcat `bin/startup.sh -security`
### Environment Information
- Grails-Application generated on Windows:
```
grails -version
| Grails Version: 5.1.2
| JVM Version: 11.0.14
```
- Tomcat 9.0.56 on openSUSE-Leap-15.3 (WSL2)
### Example Application
_No response_
### Version
5.1.2
Contributor guide
Research direction
Reproduce the failure with the listed Grails 5.1.2, JDK 11, and Tomcat 9 steps, using the shown catalina.policy and startup command. Start with the attached Catalina log and the FilePermission error for the Micronaut service resource. Done means the generated WAR starts under Tomcat with the Security Manager enabled on JDK 11, as it does on JDK 8.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- groovy, java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100