This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-karaf.git
The following commit(s) were added to refs/heads/main by this push:
new 6f2d1e26b fix(#728): scope the camel-core jmx.acl to Karaf's role
conventions
6f2d1e26b is described below
commit 6f2d1e26bbc67ebf8761f9f255de7c74a4e23844
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Sep 1 11:16:11 2026 +0200
fix(#728): scope the camel-core jmx.acl to Karaf's role conventions
The camel-core feature seeded jmx.acl.org.apache.camel with a single
"* = *" entry. Karaf resolves ACL PIDs most-specific-first, so this
domain-level PID displaced the stock per-operation mapping for every
MBean in the org.apache.camel domain, and JaasHelper treats a required
role of "*" as satisfied before examining any principal — so any
authenticated remote JMX user could invoke every operation.
Replaced with an operation-scoped mapping: context and route lifecycle
at manager, mirroring how Karaf maps bundle lifecycle; the read-only
dumps that take no arguments at viewer. There is deliberately no dump*
wildcard, so the overloads taking a resolvePlaceholders flag and the
backlog tracer operations returning traced message bodies fall through
to Karaf's admin default — an operation added by a future Camel release
is denied rather than granted until reviewed. Message injection and
route mutation stay at admin.
Adds an operator bullet to the security model: Karaf seeds a config only
when the file does not exist, so existing installations keep their copy
on upgrade and must be checked.
Closes #737
---
docs/modules/ROOT/pages/security-model.adoc | 17 ++++++++++++
features/src/main/feature/camel-features.xml | 40 ++++++++++++++++++++++++++--
2 files changed, 55 insertions(+), 2 deletions(-)
diff --git a/docs/modules/ROOT/pages/security-model.adoc
b/docs/modules/ROOT/pages/security-model.adoc
index 7ef916720..8880d120e 100644
--- a/docs/modules/ROOT/pages/security-model.adoc
+++ b/docs/modules/ROOT/pages/security-model.adoc
@@ -482,6 +482,23 @@ hardening checklist, which applies unchanged.
boundaries, no Java serialisation on untrusted consumers, least privilege,
minimal dependency set). _(documented — Apache Camel Security Model,
"Deployment hardening")_
+* *Review the JMX role mapping for the Camel domain.* The `camel-core` feature
+ seeds `etc/jmx.acl.org.apache.camel.cfg`, which decides which Karaf roles may
+ invoke which operations on `org.apache.camel` MBeans over a remote JMX
+ connection. Karaf seeds a configuration only when it does not already exist,
+ so an installation created before the current mapping shipped keeps its own
+ copy on upgrade — check the file matches the mapping you intend, in
+ particular for the operations that inject messages or mutate routes
+ (`sendBody*`, `requestBody*`, `createEndpoint`, `removeEndpoints`,
+ `addOrUpdateRoutes*`). The shipped mapping grants `viewer` the read-only
+ dumps that take no arguments, and deliberately does not use a `dump*`
+ wildcard: the overloads that take a `resolvePlaceholders` flag, and the
+ backlog tracer/debugger operations that return traced message bodies, are
+ left at Karaf's `admin` default, so an operation added by a future Camel
+ release is denied rather than granted until it is reviewed. Note this file
governs remote JMX only: the Karaf
+ `KarafMBeanServerGuard` is installed on the JMX connector, so in-VM access
+ and the `camel:*` shell commands are gated by the console/JAAS realm
+ instead. _(maintainer, 2026-08-24)_
* *Bundle authors: treat Blueprint XML as code.* Do not generate Blueprint or
route definitions from untrusted input, and filter `Camel*` headers from
untrusted producers inside the route, as in core. _(maintainer, 2026-05-15)_
diff --git a/features/src/main/feature/camel-features.xml
b/features/src/main/feature/camel-features.xml
index dddf5bdb4..abdb43af2 100644
--- a/features/src/main/feature/camel-features.xml
+++ b/features/src/main/feature/camel-features.xml
@@ -315,9 +315,45 @@
<condition>shell</condition>
<bundle>mvn:org.apache.camel.karaf/camel-karaf-shell/${project.version}</bundle>
</conditional>
- <!-- allow camel to access its own mbeans for karaf commands and other
needs -->
+ <!--
+ JMX role mapping for the org.apache.camel MBean domain.
+
+ Karaf resolves ACL PIDs most specific first and only falls through
to the
+ next one when no rule in the current PID matches the operation, so
this
+ file needs to list only the operations that should differ from the
stock
+ jmx.acl defaults (get*/list*/is* = viewer, everything else =
admin).
+
+ Context and route lifecycle is mapped to manager, matching how
Karaf maps
+ bundle lifecycle in its own jmx.acl.org.apache.karaf.bundle.
Everything not
+ listed here - message injection (sendBody*, requestBody*),
endpoint and
+ route mutation (createEndpoint, removeEndpoints,
addOrUpdateRoutes*) and
+ the dump* operations, which resolve property placeholders - falls
through
+ to the jmx.acl default of admin.
+ -->
<config name="jmx.acl.org.apache.camel">
- * = *
+ start* = manager
+ stop* = manager
+ suspend* = manager
+ resume* = manager
+ reset* = manager
+
+ browse* = viewer
+
+ dumpRoutesAsXml() = viewer
+ dumpRoutesAsYaml() = viewer
+ dumpRouteAsXml() = viewer
+ dumpRouteAsYaml() = viewer
+ dumpRestsAsXml() = viewer
+ dumpRouteTemplatesAsXml() = viewer
+ dumpRoutesCoverageAsXml() = viewer
+ dumpRouteSourceLocationsAsXml() = viewer
+ dumpProcessorAsXml() = viewer
+ dumpRoutesStatsAsXml(boolean,boolean) = viewer
+ dumpRouteStatsAsXml(boolean,boolean) = viewer
+ dumpRouteStatsAsJSon(boolean,boolean) = viewer
+ dumpStepStatsAsXml(boolean) = viewer
+ dumpStatsAsXml(boolean) = viewer
+ dumpStatsAsJSon(boolean) = viewer
</config>
</feature>
