apache / apache/grails-core

Grails 5.1.2-Application fails on Tomcat with Security Manager enabled and JDK11

Open
#12,363 4 comments 1 reaction 0 assignees View on GitHub
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Expected Behavior

Fresh created Grails 5.1.2-Application should start on Tomcat 9 with Security Manager enabled and all permissions granted (permission java.security.AllPermission in catalina.policy)

### Actual Behaviour

Although all permissions are granted, Tomcat with Security Manager enabled and JDK11 throws this error:
```
'2022-01-27 14:16:26.180 ERROR --- [ main] o.s.boot.SpringApplication : Application run failed

java.security.AccessControlException: access denied ("java.io.FilePermission" "/srv/catalina/apache-tomcat-9.0.56/webapps/testGrails512/WEB-INF/classes/META-INF/services/io.micronaut.inject.BeanDefinitionReference" "read")
```
Full log-file [catalina.2022-01-27.log](https://github.com/grails/grails-core/files/7950688/catalina.2022-01-27.log) is attached.

The same Tomcat-Instance starts correct when changed to JDK8.

Without Security Manager there are no problems with both JDK's.

The workaround from a similar [spring-boot issue](https://github.com/spring-projects/spring-boot/issues/17796) (starting Tomcat with `-Dsun.misc.URLClassPath.disableJarChecking=true`) didn't solve this problem.

### Steps To Reproduce

1. `grails create-app testGrails512 -profile web`
`cd testGrails512`
`grails war`
2. In a standalone Tomcat-instance change the content of `conf/catalina.policy` to
```
grant{
permission java.security.AllPermission;
};
```
3. drop the war-file into the `webapps`-folder
4. start tomcat `bin/startup.sh -security`

### Environment Information

- Grails-Application generated on Windows:
```
grails -version
| Grails Version: 5.1.2
| JVM Version: 11.0.14
```
- Tomcat 9.0.56 on openSUSE-Leap-15.3 (WSL2)

### Example Application

_No response_

### Version

5.1.2

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the listed Grails 5.1.2, JDK 11, and Tomcat 9 steps, using the shown catalina.policy and startup command. Start with the attached Catalina log and the FilePermission error for the Micronaut service resource. Done means the generated WAR starts under Tomcat with the Security Manager enabled on JDK 11, as it does on JDK 8.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy, java
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.