jbonofre opened a new pull request, #2865:
URL: https://github.com/apache/karaf/pull/2865
## Motivation
The `KarafMBeanServerGuard` (via `MBeanInvocationHandler`) only intercepts
`invoke`, `getAttribute(s)` and `setAttribute(s)`. The MBean lifecycle
operations of `MBeanServer` — `createMBean`, `registerMBean` and
`unregisterMBean` — are passed straight through to the delegate `MBeanServer`
and are therefore not subject to any RBAC check, which is inconsistent with the
rest of the guarded API exposed over the remote JMX connector.
## Changes
* `MBeanInvocationHandler` adds `createMBean`, `registerMBean` and
`unregisterMBean` to the guarded operation list.
* `KarafMBeanServerGuard` handles them through a new
`handleRegistration(...)`: required roles are resolved from the `jmx.acl*`
configuration by `ObjectName` and operation name. The target MBean is not (or
not yet) registered, so no `MBeanInfo` introspection is performed.
* For `createMBean` / `registerMBean` the class name is passed as the
operation argument, so ACL rules can match on it, e.g.
```
createMBean(java.lang.String)[/javax\.management\.loading\..*/] = admin
```
* A `null` `ObjectName` falls back to the generic `jmx.acl` configuration.
* Default `jmx.acl.cfg` (standard feature + `instance` resources) gets
explicit `createMBean` / `registerMBean` / `unregisterMBean` `= admin` entries.
The existing `* = admin` fallback already covered them; the explicit entries
make the policy visible and overridable.
* `KarafMBeanServerGuardTest` gains coverage for the three operations
(viewer denied / admin allowed, `null` `ObjectName`, and class-name matching).
* `monitoring.adoc` updated.
## Testing
```
mvn -pl management/server -am test -Dtest=KarafMBeanServerGuardTest
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
