App Suite Security

Mandatory Access Control

BSI IT-Grundschutz 2023 sections covered by this page
  • SYS.1.3

OX App Suite utilizes the Java Security Manager along with the OSGI Security Manager to help prevent abnormal or unauthorized access to system resources. The focus is to prevent any file-system access that isn't required for normal functionality, for example in the event of successfully exploiting a 0-day path traversal or file inclusion vulnerability. This constitutes runtime-level mandatory access control (MAC).

The OX Security Manager is disabled by default and can be activated by enabling the JAVA_OPTS_SECURITY options at ox-scriptconf.sh.

Basic configuration is located at /opt/open-xchange/etc/all.policy and /opt/open-xchange/etc/policies.policy. All further bundle-dependent configuration is done in .list files located at /opt/open-xchange/etc/security to provide access to files or directories needed by the bundle. In addition, configured file-store locations in the database are likewise added to the rule-set.

If activated, the Java Access Controller will throw java.security.AccessControlException in case the application violates any policy.

For further information, please refer to: https://documentation.open-xchange.com/8/middleware/security_and_encryption/security_manager.htmlopen in new window.