Skip to content
This repository has been archived by the owner on May 12, 2020. It is now read-only.

Cassandra steps not drawn when the custom security manager is enabled #3

Open
HiromuHota opened this issue Jan 19, 2018 · 5 comments
Open

Cassandra steps not drawn when the custom security manager is enabled #3

HiromuHota opened this issue Jan 19, 2018 · 5 comments
Labels
bug

Comments

@HiromuHota
Copy link
Owner

screen shot 2018-01-18 at 5 39 00 pm

How to reproduce: enable the custom security manager
This does not happen on Laptop/Mac OS X (10.12.6)/Oracle JDK (1.8.0_151) or on VM/Ubuntu (16.04.3)/Open JDK8 JRE (1.8.0_151).

logs/catalina.out shows

2018/01/19 01:38:43 - GUIResource - ERROR (version 8.0.0.0-28-13, build 8.0.0.0-28-13 from 2018-01-18 09.58.14 by jenkins) : Error occurred loading image [Cassandrain.svg] for plugin CassandraInput/Cassandra Input{class org.pentaho.di.core.plugins.StepPluginType}
2018/01/19 01:38:43 - GUIResource - ERROR (version 8.0.0.0-28-13, build 8.0.0.0-28-13 from 2018-01-18 09.58.14 by jenkins) : java.lang.ExceptionInInitializerError
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.UserAgentAdapter.getFontFamilyResolver(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.BridgeContext.getFontFamilyResolver(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.SVGTextElementBridge.getFontList(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.SVGTextElementBridge.getAttributeMap(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.SVGTextElementBridge.fillAttributedStringBuffer(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.SVGTextElementBridge.buildAttributedString(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.SVGTextElementBridge.computeLaidoutText(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.SVGTextElementBridge.buildGraphicsNode(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.GVTBuilder.buildGraphicsNode(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.GVTBuilder.buildComposite(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.GVTBuilder.build(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.core.SwtUniversalImageSvg.<init>(SwtUniversalImageSvg.java:56)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.util.SwtSvgImageUtil.loadImage(SwtSvgImageUtil.java:301)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.util.SwtSvgImageUtil.loadFromClassLoader(SwtSvgImageUtil.java:210)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.util.SwtSvgImageUtil.getUniversalImageInternal(SwtSvgImageUtil.java:148)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.util.SwtSvgImageUtil.getUniversalImage(SwtSvgImageUtil.java:173)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.core.gui.GUIResource.loadStepImages(GUIResource.java:750)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.core.gui.GUIResource.getResources(GUIResource.java:518)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.core.gui.GUIResource.initialize(GUIResource.java:415)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.core.gui.GUIResource.<init>(GUIResource.java:405)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.core.gui.GUIResource.getInstance(GUIResource.java:464)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.core.PropsUI.init(PropsUI.java:130)
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.ui.spoon.WebSpoonEntryPoint.createContents(WebSpoonEntryPoint.java:63)
2018/01/19 01:38:43 - GUIResource - 	at org.eclipse.rap.rwt.application.AbstractEntryPoint.createUI(AbstractEntryPoint.java:60)
2018/01/19 01:38:43 - GUIResource - 	at org.eclipse.rap.rwt.internal.lifecycle.RWTLifeCycle.createUI(RWTLifeCycle.java:177)
2018/01/19 01:38:43 - GUIResource - 	at org.eclipse.rap.rwt.internal.lifecycle.RWTLifeCycle$UIThreadController.run(RWTLifeCycle.java:290)
2018/01/19 01:38:43 - GUIResource - 	at java.lang.Thread.run(Thread.java:748)
2018/01/19 01:38:43 - GUIResource - 	at org.eclipse.rap.rwt.internal.lifecycle.UIThread.run(UIThread.java:107)
2018/01/19 01:38:43 - GUIResource - Caused by: java.lang.SecurityException: access denied ("java.io.FilePermission" "/root/.java/fonts/1.8.0_151/fcinfo-1-54cb43256958-Linux-4.9.60-linuxkit-aufs-en.properties" "read")
2018/01/19 01:38:43 - GUIResource - 	at org.pentaho.di.security.WebSpoonSecurityManager.checkPermission(WebSpoonSecurityManager.java:75)
2018/01/19 01:38:43 - GUIResource - 	at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
2018/01/19 01:38:43 - GUIResource - 	at java.io.File.exists(File.java:814)
2018/01/19 01:38:43 - GUIResource - 	at sun.font.FcFontConfiguration.readFcInfo(FcFontConfiguration.java:426)
2018/01/19 01:38:43 - GUIResource - 	at sun.font.FcFontConfiguration.init(FcFontConfiguration.java:94)
2018/01/19 01:38:43 - GUIResource - 	at sun.font.FcFontConfiguration.<init>(FcFontConfiguration.java:76)
2018/01/19 01:38:43 - GUIResource - 	at sun.awt.X11FontManager.createFontConfiguration(X11FontManager.java:768)
2018/01/19 01:38:43 - GUIResource - 	at sun.font.SunFontManager$2.run(SunFontManager.java:431)
2018/01/19 01:38:43 - GUIResource - 	at java.security.AccessController.doPrivileged(Native Method)
2018/01/19 01:38:43 - GUIResource - 	at sun.font.SunFontManager.<init>(SunFontManager.java:376)
2018/01/19 01:38:43 - GUIResource - 	at sun.awt.FcFontManager.<init>(FcFontManager.java:35)
2018/01/19 01:38:43 - GUIResource - 	at sun.awt.X11FontManager.<init>(X11FontManager.java:57)
2018/01/19 01:38:43 - GUIResource - 	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
2018/01/19 01:38:43 - GUIResource - 	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
2018/01/19 01:38:43 - GUIResource - 	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
2018/01/19 01:38:43 - GUIResource - 	at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
2018/01/19 01:38:43 - GUIResource - 	at java.lang.Class.newInstance(Class.java:442)
2018/01/19 01:38:43 - GUIResource - 	at sun.font.FontManagerFactory$1.run(FontManagerFactory.java:83)
2018/01/19 01:38:43 - GUIResource - 	at java.security.AccessController.doPrivileged(Native Method)
2018/01/19 01:38:43 - GUIResource - 	at sun.font.FontManagerFactory.getInstance(FontManagerFactory.java:74)
2018/01/19 01:38:43 - GUIResource - 	at sun.java2d.SunGraphicsEnvironment.getFontManagerForSGE(SunGraphicsEnvironment.java:190)
2018/01/19 01:38:43 - GUIResource - 	at sun.java2d.SunGraphicsEnvironment.getAvailableFontFamilyNames(SunGraphicsEnvironment.java:224)
2018/01/19 01:38:43 - GUIResource - 	at sun.java2d.SunGraphicsEnvironment.getAvailableFontFamilyNames(SunGraphicsEnvironment.java:252)
2018/01/19 01:38:43 - GUIResource - 	at sun.java2d.HeadlessGraphicsEnvironment.getAvailableFontFamilyNames(HeadlessGraphicsEnvironment.java:94)
2018/01/19 01:38:43 - GUIResource - 	at org.apache.batik.bridge.DefaultFontFamilyResolver.<clinit>(Unknown Source)
2018/01/19 01:38:43 - GUIResource - 	... 28 more
2018/01/19 01:38:43 - GUIResource - ERROR (version 8.0.0.0-28-13, build 8.0.0.0-28-13 from 2018-01-18 09.58.14 by jenkins) : Unable to load image file [Cassandrain.svg] for plugin CassandraInput/Cassandra Input{class org.pentaho.di.core.plugins.StepPluginType}
@HiromuHota
Copy link
Owner Author

Adding permission java.io.FilePermission "${user.home}/.java/fonts/-", "read"; to the policy file gives another access denied error for different path.
I ended up adding the following permissions to catalina.policy, but still have not resolved.

  permission java.io.FilePermission "/usr/share/fonts/-", "read";
  permission java.io.FilePermission "/var/cache/fontconfig", "read";
  permission java.io.FilePermission "${user.home}/.cache/fontconfig", "read";
  permission java.io.FilePermission "${user.home}/.fontconfig", "read";
  permission java.io.FilePermission "/usr/X11R6/lib/X11/fonts/TrueType", "read";
  permission java.io.FilePermission "/usr/X11R6/lib/X11/fonts/truetype", "read";
  permission java.io.FilePermission "/usr/X11R6/lib/X11/fonts/tt", "read";

Adding more and more permissions might resolve it eventually, but the policy file will become very cumbersome.

@HiromuHota
Copy link
Owner Author

The dependency chain of Docker image is hiromuhota/webspoon:nightly-full <- tomcat:jre8 <- openjdk:8-jre <- buildpack-deps:stretch-curl <- debian:stretch.

@HiromuHota
Copy link
Owner Author

I thought this has something to do with the openjdk package for debian/stretch, but this does not happen on VM/Debian Stretch(9.3)/Open JDK8 JRE (1.8.0_151).

@HiromuHota
Copy link
Owner Author

HiromuHota commented Jan 19, 2018 •
edited
Loading

I created a -full image based on tomcat:jre8-alpine.
I needed to install ttf-dejavu since NPE happened as reported here.
Even with ttf-dejavu installed, I'm having the original access denied error.
Changing the base image to alpine does not help.

@HiromuHota HiromuHota changed the title Cassandra steps not drawn Cassandra steps not drawn when the custom security manager is enabled Sep 12, 2018
@HiromuHota HiromuHota added the bug label Sep 13, 2018
@HiromuHota
Copy link
Owner Author

The root cause of this problem is that Cassandrain.svg and Cassandraout.svg use a custom font unlike Cassandra.svg.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@HiromuHota