// Licensed to the Apache Software Foundation (ASF) under one or more
// contributor license agreements.  See the NOTICE file distributed with
// this work for additional information regarding copyright ownership.
// The ASF licenses this file to You under the Apache License, Version 2.0
// (the "License"); you may not use this file except in compliance with
// the License.  You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// ============================================================================
// catalina.corepolicy - Security Policy Permissions for Tomcat 6
//
// This file contains a default set of security policies to be enforced (by the
// JVM) when Catalina is executed with the "-security" option.  In addition
// to the permissions granted here, the following additional permissions are
// granted to the codebase specific to each web application:
//
// * Read access to the document root directory
//
// $Id: catalina.policy 609294 2008-01-06 11:43:46Z markt $
// ============================================================================


// ===================== GROOVY PERMISSIONS ====================================

grant codeBase "file:/groovy/script/jaxrs" {
   permission java.net.SocketPermission "api.flickr.com:80", "connect, accept, listen";
   permission java.net.SocketPermission "api.twitter.com:80", "connect, accept, listen";
   permission java.io.FilePermission "${catalina.base}${file.separator}-", "read";
   permission java.lang.RuntimePermission "getClassLoader";
   permission java.util.PropertyPermission "*", "read";
   permission java.lang.RuntimePermission "accessDeclaredMembers";
   permission java.lang.RuntimePermission "manageRepository";
   permission java.lang.RuntimePermission "invokeInternalAPI";
};

grant codeBase "file:/groovy/script/jaxrs/-" {
   permission java.net.SocketPermission "api.flickr.com:80", "connect, accept, listen";
   permission java.net.SocketPermission "api.twitter.com:80", "connect, accept, listen";
   permission java.io.FilePermission "${catalina.base}${file.separator}-", "read";
   permission java.lang.RuntimePermission "getClassLoader";
   permission java.util.PropertyPermission "*", "read";
   permission java.lang.RuntimePermission "accessDeclaredMembers";
   permission java.lang.RuntimePermission "manageRepository";
   permission java.lang.RuntimePermission "invokeInternalAPI";
};

grant codeBase "file:/groovy/script" {
    permission java.security.AllPermission;
};

grant codeBase "file:/groovy/shell" {
    permission java.security.AllPermission;
};


// ========== SYSTEM CODE PERMISSIONS =========================================


// These permissions apply to javac
grant codeBase "file:${java.home}/lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions
grant codeBase "file:${java.home}/jre/lib/ext/-" {
        permission java.security.AllPermission;
};

// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/../lib/-" {
        permission java.security.AllPermission;
};

// These permissions apply to all shared system extensions when
// ${java.home} points at $JAVA_HOME/jre
grant codeBase "file:${java.home}/lib/ext/-" {
        permission java.security.AllPermission;
};


// ========== CATALINA CODE PERMISSIONS =======================================


grant codeBase "file:${catalina.home}/bin/-" {
        permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/lib/-" {
        permission java.security.AllPermission;
};


// ========== WEB APPLICATION PERMISSIONS =====================================

grant codeBase "file:${catalina.home}/webapps/-" {
        permission java.security.AllPermission;
};

// ========== 11.3.1 RMI Connector With Fine-Grained Security =================
// http://download.oracle.com/docs/cd/E19698-01/816-7609/6mdjrf871/index.html#security-ex-68

grant codeBase "file:server" {
    permission java.security.AllPermission;
};

grant codeBase "file:mbeans" {
    permission javax.management.MBeanTrustPermission "register";
};

//Need more for jvisualvm
grant principal javax.management.remote.JMXPrincipal "jmxadmin" {
    permission java.security.AllPermission;
};
