fix(jdbc,jms): add command ACLs for the jdbc and jms scopes - #2864
Open
jbonofre wants to merge 1 commit into
Open
fix(jdbc,jms): add command ACLs for the jdbc and jms scopes#2864jbonofre wants to merge 1 commit into
jbonofre wants to merge 1 commit into
Conversation
The jdbc and jms command scopes had no org.apache.karaf.command.acl.*
configuration. The command guard treats an unmatched command as allowed,
so any authenticated shell user (viewer role included) could run every
jdbc:* and jms:* command.
jdbc:ds-create and jms:create store a user-supplied URL into a
pax-jdbc-config / pax-jms-config factory configuration that is turned
into a live DataSource / ConnectionFactory. Several JDBC drivers run
code at connection time based on URL parameters (for instance H2
INIT=RUNSCRIPT), so creating a datasource is equivalent to arbitrary
code execution. jdbc:execute / jdbc:query run arbitrary SQL, and
jms:send / jms:consume / jms:move write to or destructively drain
broker destinations.
Add an ACL for each scope, provided by the jdbc / jms feature via a
<config> element under a shell conditional (same mechanism as the kar
and maven scopes):
jdbc: ds-create, ds-delete, execute, query = admin;
ds-list, ds-info, ds-factories, tables = viewer
jms: create, delete, send, consume, move = admin;
connectionfactories, info, queues, topics, count, browse = viewer
This is consistent with shell:exec and config:install, which are
already restricted to admin. Add SSH command security itests for both
scopes.
jbonofre
force-pushed
the
command-acl-jdbc-jms-main
branch
from
September 8, 2026 17:43
4e48e6e to
6a3b2ef
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
maincounterpart of #2863 (which targetskaraf-4.4.x).Problem
The
jdbcandjmscommand scopes ship noorg.apache.karaf.command.acl.*configuration. Karaf's command guard treats a command with no matching ACL entry as allowed, so any authenticated shell user —viewerrole included — can run everyjdbc:*andjms:*command.jdbc:ds-create/jms:createstore a user-supplied URL into a pax-jdbc-config / pax-jms-config factory configuration that is turned into a liveDataSource/ConnectionFactory. Several JDBC drivers execute code at connection time based on URL parameters (for instance H2INIT=RUNSCRIPT), making datasource creation equivalent to arbitrary code execution.jdbc:execute/jdbc:queryrun arbitrary SQL, andjms:send/jms:consume/jms:movewrite to or destructively drain broker destinations.This is the same class of gap as #2861 (
config:install), and lets a low-privilege user bypass theadminrequirement that already protectsshell:exec.Fix
Add an ACL for each scope, provided by the
jdbc/jmsfeature via a<config>element under ashellconditional (same mechanism as thekarandmavenscopes):jdbcds-create,ds-delete,execute,queryds-list,ds-info,ds-factories,tablesjmscreate,delete,send,consume,moveconnectionfactories,info,queues,topics,count,browseConsistent with
shell:execandconfig:install, already restricted toadmin.Notes
etc/jmx.acl.cfg(* = admin).INITetc. can be legitimate for an admin. The ACL is the trust boundary.Tests
JdbcSshCommandSecurityTestandJmsSshCommandSecurityTest— verify a viewer and a manager cannot see the admin-only commands whilekarafcan, over SSH.user-guide/security.adoc).