Tomcat startup with security-manager - CentOS

Question

I've seen this topic before, and the solution given works.

However, it doesn't fit in my needs, since it's granting read access to every directory, by setting this catalina.policy:

grant {
permission java.security.AllPermission;
};

So, my question is: There's some way to identify what file or resource is being requested but is denied when I take this grant off?

Here's the log that may be helpful, and appears when given Grant is removed:

java.security.AccessControlException: access denied (java.security.SecurityPermission getProperty.package.definition) at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323) at java.security.AccessController.checkPermission(AccessController.java:546) at java.lang.SecurityManager.checkPermission(SecurityManager.java:532) at java.security.Security.getProperty(Security.java:725) at org.apache.catalina.security.SecurityConfig.setSecurityProperty(SecurityConfig.java:117) at org.apache.catalina.security.SecurityConfig.setPackageDefinition(SecurityConfig.java:106) at org.apache.catalina.startup.Embedded.setSecurityProtection(Embedded.java:990) at org.apache.catalina.startup.Embedded.(Embedded.java:130) at org.apache.catalina.startup.Embedded.(Embedded.java:115) at org.apache.catalina.startup.Catalina.(Catalina.java:58) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27) at java.lang.reflect.Constructor.newInstance(Constructor.java:513) at java.lang.Class.newInstance0(Class.java:355) at java.lang.Class.newInstance(Class.java:308) at org.apache.catalina.startup.Bootstrap.init(Bootstrap.java:225) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:410)

Thank you in advance!

Answer 1

I've found this, that's part of Tomcat's documentation, which allowed me to debug Security Manager's blocking results.

The "export CATALINA_OPTS=-Djava.security.debug=all" option, when invoked while starting Catalina, print out every single access attempt that Tomcat executes, and the result of this attempt.

Since there's a bunch of files loaded by the system and this log method generates very large files, I preferred not to log it, and started my VM manually, printing the output in my screen.

I ran my JVM in command line like this:

/usr/local/java/jdk6/bin/java -server 
-Duser.timezone=America/Sao_Paulo -XX:MaxPermSize=128m -Xms30m -Xmx1024m 
-Djava.endorsed.dirs=/var/tomcat/7.0/endorsed 
-classpath :/var/tomcat/7.0/bin/bootstrap.jar 
-Djava.security.manager 
-Djava.security.policy==/var/tomcat/7.0/conf/catalina.policy 
-Dcatalina.base=/var/tomcat/7.0 -Dcatalina.home=/var/tomcat/7.0 
-Djava.security.debug=all
-Djava.io.tmpdir=tmpdir org.apache.catalina.startup.Bootstrap 
-config dir/to/xml.conf start