#927971 tomcat9: split policy files and libexec scripts so that pki-server can use them

Package:
src:tomcat9
Source:
tomcat9
Submitter:
Timo Aaltonen
Date:
2020-12-19 22:27:05 UTC
Severity:
normal
#927971#5
Date:
2019-04-25 17:37:58 UTC
From:
To:
Hi,

I'd like to use the libexec scripts and policy files from the pki-server systemd service file, but installing 'tomcat9' will start an instance and then 'pkispawn' would fail because the (default) port is already used. So I can't just depend on tomcat9, but maybe these files could be moved to -common or -user?
#927971#10
Date:
2019-06-02 22:11:49 UTC
From:
To:
Hi Timo,

Le 25/04/2019 à 19:37, Timo Aaltonen a écrit :

Did you consider calling /usr/share/tomcat9/bin/catalina.sh (installed
by tomcat9-common) instead of reusing the libexec script that's focused
on the tomcat9 package needs? That should allow you to start a Tomcat
instance with the settings you want.

Emmanuel Bourg
#927971#15
Date:
2019-09-16 13:54:58 UTC
From:
To:
Right, I've copied the start-script to pki and modified to suit, but the
policy files should probably still moved to -common?
#927971#20
Date:
2020-12-16 14:26:31 UTC
From:
To:
Ping, any objection to moving policy files and the update script to
-common? I can do that either directly or via a merge request.
#927971#25
Date:
2020-12-16 15:21:51 UTC
From:
To:
Le 16/12/2020 à 15:26, Timo Aaltonen a écrit :

I wonder if this is really necessary. The policy files are used to limit
the privileges of the web applications hosted by Tomcat when the
security manager is enabled. This is convenient when the applications
aren't fully trusted. But in the pki-server case there is no trust issue
and the security manager could be disabled. The sandboxing could be
implemented at the systemd level if necessary.

Emmanuel Bourg
#927971#30
Date:
2020-12-19 22:23:23 UTC
From:
To:
Hmm, it's possible I don't have the full picture of using the security
manager with dogtag (which Redhat does). I'll fix that after the holidays :)