From the Java Spring-Boot Application, I am invoking the following and it works when Java Security POLICY is not set. But when Java Security Policy is set it does not work and gives the error message
sudo: no tty present and no askpass program specified.
In terminally, this C cmd works without sudo same user shell but in Java execution, it returns an above error.
C program can run any system cmd or sudo cmd I am not sure it is black box to me.
Process process;try{ ProcessBuilder builder = new ProcessBuilder(new String[] {"/opt/xxx/util/cmd","-S"}); builder.redirectErrorStream(true); process = builder.start(); StreamReaderThread streamReader = new StreamReaderThread(process.getInputStream()); streamReader.start(); int shellExitStatusCode = process.waitFor(); streamReader.join(); String output = streamReader.getResult()!=null ? streamReader.getResult().getBuffer():null;}catch(Exception e){ logger.error("ERROR",e);}finally{ process.destroy();}public class StreamReaderThread extends Thread{ private InputStream is=null; private StringWriter sw=null; public StreamReaderThread(InputStream is) { this.is = is; sw = new StringWriter(30000); } public void run(){ BufferedReader inReader=null; try { inReader = new BufferedReader(new InputStreamReader(is)); char[] buf = new char[1024]; int nRead; while ( (nRead = inReader.read(buf, 0, buf.length)) > 0 ) { sw.write(buf, 0, nRead); } } catch (IOException e) { LOG.error("Error",e); }finally { // close the input stream try { if(inReader!=null){ inReader.close(); } } catch (Exception ioe) { LOG.warn("Error while closing the input stream", ioe); } } } public StringWriter getResult(){ return sw; } }
Based on this: Even after editing, /etc/sudoers with the following still complain "sudo: no tty present and no askpass program specified". I have verified that this cmd works on the terminal.
USERNAME ALL = NOPASSWD: /opt/xxx/util/cmd *
Java Security Policy: (/dev/* read/write/execute but still did not help).
grant{ permission java.io.FilePermission "bin/libtcnative-1.so", "read"; permission java.io.FilePermission "/dev/*", "read,write,execute"; permission java.io.FilePermission "/etc/hostname", "read"; permission java.io.FilePermission "/etc/hosts", "read"; permission java.io.FilePermission "/etc/issue", "read"; permission java.io.FilePermission "/etc/motd.tail", "read"; permission java.io.FilePermission "/etc/netwrok/interfaces", "read"; permission java.io.FilePermission "/etc/ntp/*", "read"; permission java.io.FilePermission "/etc/ntp", "read"; permission java.io.FilePermission "/etc/resolv.conf", "read"; permission java.io.FilePermission "/etc/rsyslogd", "read"; permission java.io.FilePermission "${java.io.tmpdir}/-", "read,write,execute,delete"; permission java.io.FilePermission "loader.properties", "read,write"; permission java.io.FilePermission "/META-INF/MANIFEST.MF", "read"; permission java.io.FilePermission "/opt/versa/etc/*", "read"; permission java.io.FilePermission "/opt/xxx/util/cmd", "read,write, execute"; permission java.lang.reflect.ReflectPermission "*", "read,write"; permission java.lang.RuntimePermission "*"; permission java.lang.RuntimePermission "exitVM.*", "*"; permission java.lang.RuntimePermission "getClassLoader"; permission java.lang.RuntimePermission "getProtectionDomain"; permission java.lang.RuntimePermission "*", "readFileDescriptor"; permission java.lang.RuntimePermission "setContextClassLoader"; permission java.lang.RuntimePermission "shutdownHooks"; permission java.lang.RuntimePermission "*", "writeFileDescriptor"; permission java.net.NetPermission "*", "read,write"; permission java.net.SocketPermission "*", "accept,connect,listen,resolve"; permission java.util.logging.LoggingPermission "control"; permission java.util.PropertyPermission "catalina.base", "read"; permission java.util.PropertyPermission "java.util.logging.config.class", "read"; permission java.util.PropertyPermission "java.util.logging.config.file", "read"; permission java.util.PropertyPermission "loader.home", "read,write"; permission java.util.PropertyPermission "org.apache.juli.AsyncMaxRecordCount", "read"; permission java.util.PropertyPermission "org.apache.juli.AsyncOverflowDropType", "read"; permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read"; permission java.util.PropertyPermission "*", "read,write"; permission java.util.PropertyPermission "*", "read,write"; permission javax.management.MBeanPermission "*", "*"; permission javax.management.MBeanServerPermission "*"; permission javax.management.MBeanTrustPermission "*";};
If I run Spring-boot without the above Policy CMD works perfectly fine. Is there any permission I need to give to create TTY in the policy although I have added the following but still did not help.
permission java.io.FilePermission "/dev/*", "read, write,execute";
Any help or pointer would help. How can I give Permission to the Spring-Boot Application to create TTY when executing ProcessBuilder Runtime is used? Any pointer would be a great help!
I tried to edit /etc/sudoers but it did not help. This is what most online and StackOverflow links say to do but it is not helping to resolve the issue.