diff --git a/ee/src/main/java/org/jboss/as/ee/logging/EeLogger.java b/ee/src/main/java/org/jboss/as/ee/logging/EeLogger.java index cef7e3c0ccbd..2566de10d6a0 100644 --- a/ee/src/main/java/org/jboss/as/ee/logging/EeLogger.java +++ b/ee/src/main/java/org/jboss/as/ee/logging/EeLogger.java @@ -1224,4 +1224,7 @@ public interface EeLogger extends BasicLogger { @Message(id = 140, value="Cannot add a HTTP connection which references a null/empty URI") IllegalArgumentException cannotAddHTTPConnection(); + + @Message(id = 141, value="Running with a SecurityManager enabled is not allowed in a Jakarta EE 11 or later environment") + OperationFailedException securityManagerNotAllowed(); } diff --git a/ee/src/main/java/org/jboss/as/ee/subsystem/EeSubsystemAdd.java b/ee/src/main/java/org/jboss/as/ee/subsystem/EeSubsystemAdd.java index 5b5c136d81ff..9aab8549c389 100644 --- a/ee/src/main/java/org/jboss/as/ee/subsystem/EeSubsystemAdd.java +++ b/ee/src/main/java/org/jboss/as/ee/subsystem/EeSubsystemAdd.java @@ -80,6 +80,7 @@ import org.jboss.as.server.deployment.jbossallxml.JBossAllXmlParserRegisteringProcessor; import org.jboss.dmr.ModelNode; import org.jboss.metadata.ear.jboss.JBossAppMetaData; +import org.wildfly.security.manager.WildFlySecurityManager; /** * Handler for adding the ee subsystem. @@ -111,6 +112,12 @@ public EeSubsystemAdd(final DefaultEarSubDeploymentsIsolationProcessor isolation this.directoryDependencyProcessor = directoryDependencyProcessor; } + @Override + public void execute(final OperationContext context, final ModelNode operation) throws OperationFailedException { + checkEEvsSM(); + super.execute(context, operation); + } + protected void populateModel(ModelNode operation, ModelNode model) throws OperationFailedException { for (AttributeDefinition ad : EeSubsystemRootResource.ATTRIBUTES) { @@ -227,4 +234,14 @@ protected void execute(DeploymentProcessorTarget processorTarget) { // installs the service which manages managed executor's hung task periodic termination new ManagedExecutorHungTasksPeriodicTerminationService().install(context); } + + private static void checkEEvsSM() throws OperationFailedException { + if (WildFlySecurityManager.isChecking()) { + try { + EeSubsystemAdd.class.getClassLoader().loadClass("jakarta.annotation.ManagedBean"); + } catch (ClassNotFoundException e) { + throw ROOT_LOGGER.securityManagerNotAllowed(); + } + } + } } diff --git a/testsuite/integration/manualmode/src/test/java/org/wildfly/test/manual/securitymanager/SecurityManagerRejectedTestCase.java b/testsuite/integration/manualmode/src/test/java/org/wildfly/test/manual/securitymanager/SecurityManagerRejectedTestCase.java new file mode 100644 index 000000000000..26d0befd5057 --- /dev/null +++ b/testsuite/integration/manualmode/src/test/java/org/wildfly/test/manual/securitymanager/SecurityManagerRejectedTestCase.java @@ -0,0 +1,70 @@ +/* + * Copyright The WildFly Authors + * SPDX-License-Identifier: Apache-2.0 + */ + +package org.wildfly.test.manual.securitymanager; + +import static org.junit.Assert.assertFalse; + +import org.jboss.arquillian.container.test.api.ContainerController; +import org.jboss.arquillian.container.test.api.RunAsClient; +import org.jboss.arquillian.junit.Arquillian; +import org.jboss.arquillian.test.api.ArquillianResource; +import org.jboss.as.test.shared.util.AssumeTestGroupUtil; +import org.junit.After; +import org.junit.AssumptionViolatedException; +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.wildfly.core.testrunner.ServerControl; + +/** + * Tests that starting a server with the SecurityManager enabled fails in an EE11 environment + */ +@RunAsClient() +@RunWith(Arquillian.class) +@ServerControl(manual = true) +public class SecurityManagerRejectedTestCase { + + private static final String SERVER_CONFIG_NAME = "forced-security-manager"; + @ArquillianResource + private static volatile ContainerController containerController; + + @BeforeClass + public static void ee11Only() { + + // If we are running in a testsuite execution with the SM explicitly enabled everywhere, + // we can't be expecting servers to fail to boot with the SM. + // So no point going further + AssumeTestGroupUtil.assumeSecurityManagerDisabled(); + + // Use a missing ManagedBean class as an indicator that we are in an EE 11+ environment. + try { + SecurityManagerRejectedTestCase.class.getClassLoader().loadClass("jakarta.annotation.ManagedBean"); + throw new AssumptionViolatedException("Not an EE 11+ environment"); + } catch (ClassNotFoundException e) { + // not found means we want the test + } + } + + @After + public void ensureContainerStopped() { + // If the test fails, don't leave a running server behind + if (containerController.isStarted(SERVER_CONFIG_NAME)) { + containerController.stop(SERVER_CONFIG_NAME); + } + } + + @Test + public void testServerStart() { + assertFalse(containerController.isStarted(SERVER_CONFIG_NAME)); + try { + // This config has -secmgr hard coded in its startup args, so it should fail to start + containerController.start(SERVER_CONFIG_NAME); + } catch (Exception ok) { + // good. fall through and confirm the effect of this is the container wasn't started + } + assertFalse(containerController.isStarted(SERVER_CONFIG_NAME)); + } +} diff --git a/testsuite/integration/manualmode/src/test/resources/arquillian.xml b/testsuite/integration/manualmode/src/test/resources/arquillian.xml index 7f1542163c13..91f6fb6cd3cc 100644 --- a/testsuite/integration/manualmode/src/test/resources/arquillian.xml +++ b/testsuite/integration/manualmode/src/test/resources/arquillian.xml @@ -529,6 +529,25 @@ ${container.java.home} + + + + ${basedir}/target/wildfly + ${server.jvm.args} -Djboss.node.name=default-jbossas + ${jboss.config.file.name:standalone-ha.xml} + + ${jboss.args} -secmgr + true + ${node0:127.0.0.1} + ${as.managementPort:9990} + + + ${as.debug.port:8787} ${as.managementPort:9990} + 8 + ${basedir}/target/wildfly/modules + ${container.java.home} + + diff --git a/testsuite/integration/pom.xml b/testsuite/integration/pom.xml index 212e91e4e166..628f22fe4534 100644 --- a/testsuite/integration/pom.xml +++ b/testsuite/integration/pom.xml @@ -342,7 +342,6 @@ clustering microprofile microprofile-tck - secman elytron elytron-oidc-client vdx diff --git a/testsuite/integration/secman/pom.xml b/testsuite/integration/secman/pom.xml index 15376c5ff755..4328548148be 100644 --- a/testsuite/integration/secman/pom.xml +++ b/testsuite/integration/secman/pom.xml @@ -131,36 +131,6 @@ - - - - preview.profile - - - ts.preview - - - - - - org.apache.maven.plugins - maven-surefire-plugin - - - - default-test - test - - - ${jboss.dist} - - - - - - - - diff --git a/testsuite/preview/manualmode/pom.xml b/testsuite/preview/manualmode/pom.xml index b504c3308160..a04041dbcd9f 100644 --- a/testsuite/preview/manualmode/pom.xml +++ b/testsuite/preview/manualmode/pom.xml @@ -113,6 +113,13 @@ wildfly-controller test + + + org.wildfly.core + wildfly-core-test-runner + test + + org.wildfly.core wildfly-core-testsuite-shared diff --git a/testsuite/preview/manualmode/src/test/java/org/wildfly/test/manual/securitymanager/SecurityManagerRejectedTestCase.java b/testsuite/preview/manualmode/src/test/java/org/wildfly/test/manual/securitymanager/SecurityManagerRejectedTestCase.java new file mode 100644 index 000000000000..7dab48b13a88 --- /dev/null +++ b/testsuite/preview/manualmode/src/test/java/org/wildfly/test/manual/securitymanager/SecurityManagerRejectedTestCase.java @@ -0,0 +1,74 @@ +/* + * Copyright The WildFly Authors + * SPDX-License-Identifier: Apache-2.0 + */ + +package org.wildfly.test.manual.securitymanager; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.fail; + +import org.jboss.arquillian.container.test.api.ContainerController; +import org.jboss.arquillian.container.test.api.RunAsClient; +import org.jboss.arquillian.junit.Arquillian; +import org.jboss.arquillian.test.api.ArquillianResource; +import org.jboss.as.test.shared.util.AssumeTestGroupUtil; +import org.junit.After; +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.wildfly.core.testrunner.ServerControl; + +/** + * Tests that starting a server with the SecurityManager enabled fails in an EE11 environment + */ +@RunAsClient() +@RunWith(Arquillian.class) +@ServerControl(manual = true) +public class SecurityManagerRejectedTestCase { + + private static final String SERVER_CONFIG_NAME = "forced-security-manager"; + @ArquillianResource + private static volatile ContainerController containerController; + + @BeforeClass + public static void ee11Only() { + + // If we are running in a testsuite execution with the SM explicitly enabled everywhere, + // we can't be expecting servers to fail to boot with the SM. + // So no point going further + AssumeTestGroupUtil.assumeSecurityManagerDisabled(); + + // Use a missing ManagedBean class as an indicator that we are in an EE 11+ environment. + try { + SecurityManagerRejectedTestCase.class.getClassLoader().loadClass("jakarta.annotation.ManagedBean"); + // BES 2024/07/06 -- I've considered supporting ManagedBean in an EE 11+ env; if we do that it would + // likely require making the class available on the test classpath so test deployments can compile. + // If we do that this test should fail, so we can switch to a different mechanism for deciding if it + // should run or not. Check for this when testing WildFly Preview which no longer supports EE 10. + fail("Update this test if we begin putting ManagedBean on the classpath in an EE 11 environment"); + } catch (ClassNotFoundException e) { + // not found means we want the test + } + } + + @After + public void ensureContainerStopped() { + // If the test fails, don't leave a running server behind + if (containerController.isStarted(SERVER_CONFIG_NAME)) { + containerController.stop(SERVER_CONFIG_NAME); + } + } + + @Test + public void testServerStart() { + assertFalse(containerController.isStarted(SERVER_CONFIG_NAME)); + try { + // This config has -secmgr hard coded in its startup args, so it should fail to start + containerController.start(SERVER_CONFIG_NAME); + } catch (Exception ok) { + // good. fall through and confirm the effect of this is the container wasn't started + } + assertFalse(containerController.isStarted(SERVER_CONFIG_NAME)); + } +} diff --git a/testsuite/preview/manualmode/src/test/resources/arquillian.xml b/testsuite/preview/manualmode/src/test/resources/arquillian.xml index 2c29434588c5..8798ee54049b 100644 --- a/testsuite/preview/manualmode/src/test/resources/arquillian.xml +++ b/testsuite/preview/manualmode/src/test/resources/arquillian.xml @@ -46,6 +46,25 @@ ${container.java.home} + + + + ${basedir}/target/wildfly + ${server.jvm.args} -Djboss.node.name=default-jbossas + ${jboss.config.file.name:standalone-ha.xml} + + ${jboss.args} -secmgr + true + ${node0:127.0.0.1} + ${as.managementPort:9990} + + + ${as.debug.port:8787} ${as.managementPort:9990} + 8 + ${basedir}/target/wildfly/modules + ${container.java.home} + +