Jeeves

Server Security Sandbox


  1. Goal
  2. Specification
  3. Implementation
  4. Verification

Goal

Jeeves is a dynamically configurable and dynamically extensible http web server. Servlets are the server-side analog of applets, and are used to extend the http server. Servlets come in four flavors:
Jeeves servlets
Some parts of Jeeves itself is implemented using servlets, which are granted full access.
Local servlets
Jeeves ships with demo servlets, which are by definition part of its trusted computed base, and which are granted full access.
Signed network servlets
Signed network servlets are granted limited access, which is set up and administered by the Jeeves administrator.

Signed network servlets are loaded by Jeeves' ServletClassLoader only when they are signed by an signature that is on the list of trusted signatures. The list of trusted signatures is created by the Jeeves administrator, ahead of time, using the ServletAdmin tool.

The Jeeves administrator can limit the capabilities granted to signed network servlets, or he/she can grant full access to particular servlets.

Unsigned network servlets
Unsigned network servlets are contained in a limited execution environment, known as the server sandbox.

Server Sandbox

The server sandbox protects access to these Jeeves resources.
  1. HTTP request objects
  2. HTTP response objects
  3. Files served by Jeeves
  4. Jeeves' own configuration files
  5. ACL entries
  6. Threads controlled by other servlets
  7. Capabilities context of other servlets
  8. Networking APIs

Specification

Work in progress

Implementation

Work in progress

Verification

Work in progress
jeeves@java.sun.com
Last modified: %G%