CentOS 上配置 Java 安全设置的实用指南
一 环境准备与基线检查
java -versionreadlink -f $(which java) 或 ls /usr/lib/jvm/sudo yum update java-1.8.0-openjdk(或对应版本),及时获取安全补丁。二 使用 Java 安全管理器与策略文件
// 仅允许应用目录只读
grant codeBase "file:/opt/myapp/-" {
permission java.io.FilePermission "/opt/myapp/conf/*", "read";
permission java.io.FilePermission "/opt/myapp/logs", "read,write,delete";
permission java.util.PropertyPermission "file.encoding", "read";
permission java.lang.RuntimePermission "getenv.*";
};
// 仅允许本机回环访问 8080 端口
grant {
permission java.net.SocketPermission "localhost:8080", "listen,accept";
permission java.net.SocketPermission "127.0.0.1:8080", "listen,accept";
};
java -Djava.security.manager -Djava.security.policy=/opt/myapp/security.policy -jar /opt/myapp/app.jarinclude 或将规则追加到系统策略。-Djava.security.debug=access,failure 输出细粒度权限调试日志,定位缺失的 permission 声明。三 系统级安全配置与权限收敛
sudo groupadd java_app
sudo useradd -g java_app java_app
sudo chown -R java_app:java_app /opt/myapp
sudo chmod -R 750 /opt/myapp
sestatussudo chcon -R -t usr_t /opt/myappsemanage fcontext/restorecon 维护策略。sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
四 常见场景与策略示例
grant {
permission java.net.SocketPermission "localhost:8080", "listen,accept";
permission java.net.SocketPermission "127.0.0.1:8080", "listen,accept";
};
grant codeBase "file:/opt/myapp/-" {
permission java.io.FilePermission "/opt/myapp/conf/*", "read";
permission java.io.FilePermission "/opt/myapp/logs", "read,write,delete";
};
grant {
permission java.net.SocketPermission "api.example.com:443", "connect,resolve";
};
exec、loadLibrary.*)除非业务明确需要,避免扩大攻击面。五 维护与加固清单