From the Java Spring-Boot Application, I am invoking the following and it works when Java Security POLICY is not set. But when Java Security Policy is set it does not work and gives the error message
sudo: no tty present and no askpass program specified.
In terminally, this C cmd works without sudo same user shell but in Java execution, it returns an above error.
C program can run any system cmd or sudo cmd I am not sure it is black box to me.
Process process;
try{
ProcessBuilder builder = new ProcessBuilder(new String[] {"/opt/xxx/util/cmd","-S"});
builder.redirectErrorStream(true);
process = builder.start();
StreamReaderThread streamReader = new StreamReaderThread(process.getInputStream());
streamReader.start();
int shellExitStatusCode = process.waitFor();
streamReader.join();
String output = streamReader.getResult()!=null ? streamReader.getResult().getBuffer():null;
}catch(Exception e){
logger.error("ERROR",e);
}finally{
process.destroy();
}
public class StreamReaderThread extends Thread{
private InputStream is=null;
private StringWriter sw=null;
public StreamReaderThread(InputStream is) {
this.is = is;
sw = new StringWriter(30000);
}
public void run(){
BufferedReader inReader=null;
try {
inReader = new BufferedReader(new InputStreamReader(is));
char[] buf = new char[1024];
int nRead;
while ( (nRead = inReader.read(buf, 0, buf.length)) > 0 ) {
sw.write(buf, 0, nRead);
}
} catch (IOException e) {
LOG.error("Error",e);
}finally {
// close the input stream
try {
if(inReader!=null){
inReader.close();
}
} catch (Exception ioe) {
LOG.warn("Error while closing the input stream", ioe);
}
}
}
public StringWriter getResult(){
return sw;
}
}
Based on this: Even after editing, /etc/sudoers with the following still complain “sudo: no tty present and no askpass program specified”. I have verified that this cmd works on the terminal.
USERNAME ALL = NOPASSWD: /opt/xxx/util/cmd *
Java Security Policy: (/dev/* read/write/execute but still did not help).
grant{
permission java.io.FilePermission "bin/libtcnative-1.so", "read";
permission java.io.FilePermission "/dev/*", "read,write,execute";
permission java.io.FilePermission "/etc/hostname", "read";
permission java.io.FilePermission "/etc/hosts", "read";
permission java.io.FilePermission "/etc/issue", "read";
permission java.io.FilePermission "/etc/motd.tail", "read";
permission java.io.FilePermission "/etc/netwrok/interfaces", "read";
permission java.io.FilePermission "/etc/ntp/*", "read";
permission java.io.FilePermission "/etc/ntp", "read";
permission java.io.FilePermission "/etc/resolv.conf", "read";
permission java.io.FilePermission "/etc/rsyslogd", "read";
permission java.io.FilePermission "${java.io.tmpdir}/-", "read,write,execute,delete";
permission java.io.FilePermission "loader.properties", "read,write";
permission java.io.FilePermission "/META-INF/MANIFEST.MF", "read";
permission java.io.FilePermission "/opt/versa/etc/*", "read";
permission java.io.FilePermission "/opt/xxx/util/cmd", "read,write, execute";
permission java.lang.reflect.ReflectPermission "*", "read,write";
permission java.lang.RuntimePermission "*";
permission java.lang.RuntimePermission "exitVM.*", "*";
permission java.lang.RuntimePermission "getClassLoader";
permission java.lang.RuntimePermission "getProtectionDomain";
permission java.lang.RuntimePermission "*", "readFileDescriptor";
permission java.lang.RuntimePermission "setContextClassLoader";
permission java.lang.RuntimePermission "shutdownHooks";
permission java.lang.RuntimePermission "*", "writeFileDescriptor";
permission java.net.NetPermission "*", "read,write";
permission java.net.SocketPermission "*", "accept,connect,listen,resolve";
permission java.util.logging.LoggingPermission "control";
permission java.util.PropertyPermission "catalina.base", "read";
permission java.util.PropertyPermission "java.util.logging.config.class", "read";
permission java.util.PropertyPermission "java.util.logging.config.file", "read";
permission java.util.PropertyPermission "loader.home", "read,write";
permission java.util.PropertyPermission "org.apache.juli.AsyncMaxRecordCount", "read";
permission java.util.PropertyPermission "org.apache.juli.AsyncOverflowDropType", "read";
permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read";
permission java.util.PropertyPermission "*", "read,write";
permission java.util.PropertyPermission "*", "read,write";
permission javax.management.MBeanPermission "*", "*";
permission javax.management.MBeanServerPermission "*";
permission javax.management.MBeanTrustPermission "*";
};
If I run Spring-boot without the above Policy CMD works perfectly fine. Is there any permission I need to give to create TTY in the policy although I have added the following but still did not help.
permission java.io.FilePermission "/dev/*", "read, write,execute";
Any help or pointer would help. How can I give Permission to the Spring-Boot Application to create TTY when executing ProcessBuilder Runtime is used? Any pointer would be a great help!
I tried to edit /etc/sudoers but it did not help. This is what most online and StackOverflow links say to do but it is not helping to resolve the issue.