Enforcing Java Security Manager in Restricted Windows Environments?
Lately I came across several Citrix and Terminal Server projects which provide a restricted set of applications to their users. This is achieved using Windows Software Restriction Policies or AppSense Application Manager to white or black list executables.
One of these permitted binaries is often java.exe. Now the problem arises that once Java is enabled any Java application can be executed on the system. This allows a malicious user to execute arbitrary Java code, like replacement shells (JSH), RDP clients (Propero Java RDP) and network port scanners. I could block java.exe but business requires that the company’s Java application must still work. This lead me into this research on how to white list Java applications in a restricted Windows environment.
First of all Java has a mechanism called Java 2 Security which allows implementing policies based on code location or digital signatures. These policies are configured through the files java.policy and java.security. When java.exe gets executed these policies are not enforced by default. To enforce the restrictions the Java system property java.security.manager must included at the startup command line:
java.exe -Djava.security.manager MyCode
This property causes Java’s Security Manager to be installed and the policy to be enforced. So far so good. But how can I pass this parameter without having it to be specified on the command line? Well Java offers the environment variable _JAVA_OPTIONS. So I thought I place the parameter into a Windows system environment variable:
_JAVA_OPTIONS=-Djava.security.manager=
Testing revealed that java.exe can be executed with the Security Manager enabled without passing the parameter on the command line directly. Further testing revealed that when I start a cmd.exe as a low-privileged user I can overwrite this system environment variable and I can bypass the Java Security Manager using following command:
set _JAVA_OPTIONS=
I tried the same from within a Microsoft Word macro. The effect is the same. According to my research and feedback from Microsoft the system environment variables can always be overwritten within the process for the local process. In the paper Software Restriction Policies in Windows XP on page 13 in Chapter Analysis of Path Rule John Lambert writes:
Environment variables are not secure, and any user who can load a command prompt can temporarily redefine them.
So this melts down to my question: Is there a way to tell java.exe to always use the Java Security Manager without the possibility of manipulation by the user?
I would be very interested to learn your ideas. For those of you who want to play yourself I provide a ZIP archive with the files I used for testing. Please send your comments by mail to: jan.monsch ät iplosion.com. I will then write-up a post with the discussion results