JBoss Enterprise Application Platform 6.3 STIG Version Comparison

There are 3 differences between versions v2 r4 (April 24, 2024) (the "left" version) and v2 r6 (April 2, 2025) (the "right" version).

Check JBOS-AS-000025 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

Java permissions must be set for hosted applications.

Check Content

Obtain Enabling the Security Manager in JDK 24 is an error and if using JDK 24, this is not a finding. Note: Security Manager was deprecated in Java 17 and will be permanently removed in JDK 24. For additional information: <https://openjdk.org/jeps/486> Obtain documentation from the admin that identifies the applications hosted on the JBoss server as well as the corresponding rights the application requires. For example, if the application requires network socket permissions and file write permissions, document those requirements requirements. 1. should be documented. 1. Identify the JBoss installation as either domain or standalone and review the relevant configuration file. For domain installs: JBOSS_HOME/bin/domain.conf For standalone installs: JBOSS_HOME/bin/standalone.conf 2. Identify the location and name of the security policy by reading the JAVA_OPTS flag -Djava.security.policy=<file name> where <file name> will indicate name and location of security policy. If the application uses a policy URL, obtain the URL and policy file from system admin. 3. Review security policy and ensure hosted applications have the appropriate restrictions placed on them as per documented application functionality requirements. If the security policy does not restrict application access to host resources as per documented requirements, this is a finding.

Discussion

The Java Security Manager is a java class that manages the external boundary of the Java Virtual Machine (JVM) sandbox, controlling how code executing within the JVM can interact with resources outside the JVM. The JVM requires a security policy in order to restrict application access. A properly configured security policy will define what rights the application has to the underlying system. For example, rights to make changes to files on the host system or to initiate network sockets in order to connect to another system.

Fix

Configure Enabling the Security Manager in JDK 24 is an error and if using JDK 24, this is not a finding. Configure the Java security manager to enforce access restrictions to the host system resources in accordance with application design and resource requirements.