java - Tomcat Security Exception: Access denied after SLF4J Migration -

java - Tomcat Security Exception: Access denied after SLF4J Migration -

i migrated applications log4j slf4j , logback. deploying application on tomcat 6, facing next security problem.

possible solution: solution have found, set permitall in catalina.policy. wont whenever possible.

grant { permission java.security.allpermission; };

stacktrace:

jun 23, 2014 8:05:39 org.apache.catalina.loader.webappclassloader findclass warnung: webappclassloader.findclassinternal(org.springframework.orm.jpa.entitymanagerfactoryutils) security exception: access denied ("java.io.filepermission" "c:\program files\tomcat 6\webapps\my-application\web-inf\classes\org\springframework\orm\jpa\entitymanagerfactoryutils.class" "read") java.security.accesscontrolexception: access denied ("java.io.filepermission" "c:\program files\tomcat 6\webapps\my-application\web-inf\classes\org\springframework\orm\jpa\entitymanagerfactoryutils.class" "read") @ java.security.accesscontrolcontext.checkpermission(accesscontrolcontext.java:372) @ java.security.accesscontroller.checkpermission(accesscontroller.java:559) @ java.lang.securitymanager.checkpermission(securitymanager.java:549) @ java.lang.securitymanager.checkread(securitymanager.java:888) @ java.io.file.exists(file.java:808) @ org.apache.naming.resources.filedircontext.file(filedircontext.java:785) @ org.apache.naming.resources.filedircontext.lookup(filedircontext.java:206) @ org.apache.naming.resources.proxydircontext.lookup(proxydircontext.java:299) @ org.apache.catalina.loader.webappclassloader.findresourceinternal(webappclassloader.java:2928) @ org.apache.catalina.loader.webappclassloader.findclassinternal(webappclassloader.java:2789) @ org.apache.catalina.loader.webappclassloader.findclass(webappclassloader.java:1159) @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1647) @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1526) @ org.springframework.orm.jpa.support.persistenceannotationbeanpostprocessor.postprocessbeforedestruction(persistenceannotationbeanpostprocessor.java:356) @ org.springframework.beans.factory.support.disposablebeanadapter.destroy(disposablebeanadapter.java:166) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroybean(defaultsingletonbeanregistry.java:487) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroysingleton(defaultsingletonbeanregistry.java:463) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroysingletons(defaultsingletonbeanregistry.java:431) @ org.springframework.context.support.abstractapplicationcontext.destroybeans(abstractapplicationcontext.java:1048) @ org.springframework.context.support.abstractapplicationcontext.refresh(abstractapplicationcontext.java:433) @ org.springframework.web.servlet.frameworkservlet.createwebapplicationcontext(frameworkservlet.java:442) @ org.springframework.web.servlet.frameworkservlet.createwebapplicationcontext(frameworkservlet.java:458) @ org.springframework.web.servlet.frameworkservlet.initwebapplicationcontext(frameworkservlet.java:339) @ org.springframework.web.servlet.frameworkservlet.initservletbean(frameworkservlet.java:306) @ org.springframework.web.servlet.httpservletbean.init(httpservletbean.java:127) @ javax.servlet.genericservlet.init(genericservlet.java:212) @ org.apache.catalina.core.standardwrapper.loadservlet(standardwrapper.java:1213) @ org.apache.catalina.core.standardwrapper.load(standardwrapper.java:1026) @ org.apache.catalina.core.standardcontext.loadonstartup(standardcontext.java:4421) @ org.apache.catalina.core.standardcontext.start(standardcontext.java:4734) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardhost.start(standardhost.java:840) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardengine.start(standardengine.java:463) @ org.apache.catalina.core.standardservice.start(standardservice.java:525) @ org.apache.catalina.core.standardserver.start(standardserver.java:754) @ org.apache.catalina.startup.catalina.start(catalina.java:595) @ sun.reflect.nativemethodaccessorimpl.invoke0(native method) @ sun.reflect.nativemethodaccessorimpl.invoke(nativemethodaccessorimpl.java:57) @ sun.reflect.delegatingmethodaccessorimpl.invoke(delegatingmethodaccessorimpl.java:43) @ java.lang.reflect.method.invoke(method.java:606) @ org.apache.catalina.startup.bootstrap.start(bootstrap.java:289) @ org.apache.catalina.startup.bootstrap.main(bootstrap.java:414) jun 23, 2014 8:05:39 org.apache.catalina.loader.webappclassloader findclass warnung: webappclassloader.findclassinternal(ch.qos.logback.classic.spi.throwableproxy) security exception: access denied ("java.io.filepermission" "c:\program files\tomcat 6\webapps\my-application\web-inf\classes\ch\qos\logback\classic\spi\throwableproxy.class" "read") java.security.accesscontrolexception: access denied ("java.io.filepermission" "c:\program files\tomcat 6\webapps\my-application\web-inf\classes\ch\qos\logback\classic\spi\throwableproxy.class" "read") @ java.security.accesscontrolcontext.checkpermission(accesscontrolcontext.java:372) @ java.security.accesscontroller.checkpermission(accesscontroller.java:559) @ java.lang.securitymanager.checkpermission(securitymanager.java:549) @ java.lang.securitymanager.checkread(securitymanager.java:888) @ java.io.file.exists(file.java:808) @ org.apache.naming.resources.filedircontext.file(filedircontext.java:785) @ org.apache.naming.resources.filedircontext.lookup(filedircontext.java:206) @ org.apache.naming.resources.proxydircontext.lookup(proxydircontext.java:299) @ org.apache.catalina.loader.webappclassloader.findresourceinternal(webappclassloader.java:2928) @ org.apache.catalina.loader.webappclassloader.findclassinternal(webappclassloader.java:2789) @ org.apache.catalina.loader.webappclassloader.findclass(webappclassloader.java:1159) @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1647) @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1526) @ ch.qos.logback.classic.spi.loggingevent.<init>(loggingevent.java:121) @ ch.qos.logback.classic.logger.buildloggingeventandappend(logger.java:440) @ ch.qos.logback.classic.logger.filterandlog_0_or3plus(logger.java:396) @ ch.qos.logback.classic.logger.log(logger.java:788) @ org.apache.commons.logging.impl.slf4jlocationawarelog.error(slf4jlocationawarelog.java:225) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroybean(defaultsingletonbeanregistry.java:490) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroysingleton(defaultsingletonbeanregistry.java:463) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroysingletons(defaultsingletonbeanregistry.java:431) @ org.springframework.context.support.abstractapplicationcontext.destroybeans(abstractapplicationcontext.java:1048) @ org.springframework.context.support.abstractapplicationcontext.refresh(abstractapplicationcontext.java:433) @ org.springframework.web.servlet.frameworkservlet.createwebapplicationcontext(frameworkservlet.java:442) @ org.springframework.web.servlet.frameworkservlet.createwebapplicationcontext(frameworkservlet.java:458) @ org.springframework.web.servlet.frameworkservlet.initwebapplicationcontext(frameworkservlet.java:339) @ org.springframework.web.servlet.frameworkservlet.initservletbean(frameworkservlet.java:306) @ org.springframework.web.servlet.httpservletbean.init(httpservletbean.java:127) @ javax.servlet.genericservlet.init(genericservlet.java:212) @ org.apache.catalina.core.standardwrapper.loadservlet(standardwrapper.java:1213) @ org.apache.catalina.core.standardwrapper.load(standardwrapper.java:1026) @ org.apache.catalina.core.standardcontext.loadonstartup(standardcontext.java:4421) @ org.apache.catalina.core.standardcontext.start(standardcontext.java:4734) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardhost.start(standardhost.java:840) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardengine.start(standardengine.java:463) @ org.apache.catalina.core.standardservice.start(standardservice.java:525) @ org.apache.catalina.core.standardserver.start(standardserver.java:754) @ org.apache.catalina.startup.catalina.start(catalina.java:595) @ sun.reflect.nativemethodaccessorimpl.invoke0(native method) @ sun.reflect.nativemethodaccessorimpl.invoke(nativemethodaccessorimpl.java:57) @ sun.reflect.delegatingmethodaccessorimpl.invoke(delegatingmethodaccessorimpl.java:43) @ java.lang.reflect.method.invoke(method.java:606) @ org.apache.catalina.startup.bootstrap.start(bootstrap.java:289) @ org.apache.catalina.startup.bootstrap.main(bootstrap.java:414) jun 23, 2014 8:05:39 org.apache.catalina.core.applicationcontext log schwerwiegend: standardwrapper.throwable java.lang.noclassdeffounderror: ch/qos/logback/classic/spi/throwableproxy @ ch.qos.logback.classic.spi.loggingevent.<init>(loggingevent.java:121) @ ch.qos.logback.classic.logger.buildloggingeventandappend(logger.java:440) @ ch.qos.logback.classic.logger.filterandlog_0_or3plus(logger.java:396) @ ch.qos.logback.classic.logger.log(logger.java:788) @ org.apache.commons.logging.impl.slf4jlocationawarelog.error(slf4jlocationawarelog.java:225) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroybean(defaultsingletonbeanregistry.java:490) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroysingleton(defaultsingletonbeanregistry.java:463) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroysingletons(defaultsingletonbeanregistry.java:431) @ org.springframework.context.support.abstractapplicationcontext.destroybeans(abstractapplicationcontext.java:1048) @ org.springframework.context.support.abstractapplicationcontext.refresh(abstractapplicationcontext.java:433) @ org.springframework.web.servlet.frameworkservlet.createwebapplicationcontext(frameworkservlet.java:442) @ org.springframework.web.servlet.frameworkservlet.createwebapplicationcontext(frameworkservlet.java:458) @ org.springframework.web.servlet.frameworkservlet.initwebapplicationcontext(frameworkservlet.java:339) @ org.springframework.web.servlet.frameworkservlet.initservletbean(frameworkservlet.java:306) @ org.springframework.web.servlet.httpservletbean.init(httpservletbean.java:127) @ javax.servlet.genericservlet.init(genericservlet.java:212) @ org.apache.catalina.core.standardwrapper.loadservlet(standardwrapper.java:1213) @ org.apache.catalina.core.standardwrapper.load(standardwrapper.java:1026) @ org.apache.catalina.core.standardcontext.loadonstartup(standardcontext.java:4421) @ org.apache.catalina.core.standardcontext.start(standardcontext.java:4734) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardhost.start(standardhost.java:840) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardengine.start(standardengine.java:463) @ org.apache.catalina.core.standardservice.start(standardservice.java:525) @ org.apache.catalina.core.standardserver.start(standardserver.java:754) @ org.apache.catalina.startup.catalina.start(catalina.java:595) @ sun.reflect.nativemethodaccessorimpl.invoke0(native method) @ sun.reflect.nativemethodaccessorimpl.invoke(nativemethodaccessorimpl.java:57) @ sun.reflect.delegatingmethodaccessorimpl.invoke(delegatingmethodaccessorimpl.java:43) @ java.lang.reflect.method.invoke(method.java:606) @ org.apache.catalina.startup.bootstrap.start(bootstrap.java:289) @ org.apache.catalina.startup.bootstrap.main(bootstrap.java:414) caused by: java.lang.classnotfoundexception: ch.qos.logback.classic.spi.throwableproxy @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1680) @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1526) ... 33 more jun 23, 2014 8:05:39 org.apache.catalina.core.standardcontext loadonstartup schwerwiegend: servlet /my-application threw load() exception java.lang.classnotfoundexception: ch.qos.logback.classic.spi.throwableproxy @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1680) @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1526) @ ch.qos.logback.classic.spi.loggingevent.<init>(loggingevent.java:121) @ ch.qos.logback.classic.logger.buildloggingeventandappend(logger.java:440) @ ch.qos.logback.classic.logger.filterandlog_0_or3plus(logger.java:396) @ ch.qos.logback.classic.logger.log(logger.java:788) @ org.apache.commons.logging.impl.slf4jlocationawarelog.error(slf4jlocationawarelog.java:225) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroybean(defaultsingletonbeanregistry.java:490) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroysingleton(defaultsingletonbeanregistry.java:463) @ org.springframework.beans.factory.support.defaultsingletonbeanregistry.destroysingletons(defaultsingletonbeanregistry.java:431) @ org.springframework.context.support.abstractapplicationcontext.destroybeans(abstractapplicationcontext.java:1048) @ org.springframework.context.support.abstractapplicationcontext.refresh(abstractapplicationcontext.java:433) @ org.springframework.web.servlet.frameworkservlet.createwebapplicationcontext(frameworkservlet.java:442) @ org.springframework.web.servlet.frameworkservlet.createwebapplicationcontext(frameworkservlet.java:458) @ org.springframework.web.servlet.frameworkservlet.initwebapplicationcontext(frameworkservlet.java:339) @ org.springframework.web.servlet.frameworkservlet.initservletbean(frameworkservlet.java:306) @ org.springframework.web.servlet.httpservletbean.init(httpservletbean.java:127) @ javax.servlet.genericservlet.init(genericservlet.java:212) @ org.apache.catalina.core.standardwrapper.loadservlet(standardwrapper.java:1213) @ org.apache.catalina.core.standardwrapper.load(standardwrapper.java:1026) @ org.apache.catalina.core.standardcontext.loadonstartup(standardcontext.java:4421) @ org.apache.catalina.core.standardcontext.start(standardcontext.java:4734) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardhost.start(standardhost.java:840) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardengine.start(standardengine.java:463) @ org.apache.catalina.core.standardservice.start(standardservice.java:525) @ org.apache.catalina.core.standardserver.start(standardserver.java:754) @ org.apache.catalina.startup.catalina.start(catalina.java:595) @ sun.reflect.nativemethodaccessorimpl.invoke0(native method) @ sun.reflect.nativemethodaccessorimpl.invoke(nativemethodaccessorimpl.java:57) @ sun.reflect.delegatingmethodaccessorimpl.invoke(delegatingmethodaccessorimpl.java:43) @ java.lang.reflect.method.invoke(method.java:606) @ org.apache.catalina.startup.bootstrap.start(bootstrap.java:289) @ org.apache.catalina.startup.bootstrap.main(bootstrap.java:414) jun 23, 2014 8:05:39 org.apache.catalina.loader.webappclassloader findclass warnung: webappclassloader.findclassinternal(org.apache.jasper.servlet.jspservlet) security exception: access denied ("java.io.filepermission" "c:\program files\tomcat 6\webapps\my-application\web-inf\classes\org\apache\jasper\servlet\jspservlet.class" "read") java.security.accesscontrolexception: access denied ("java.io.filepermission" "c:\program files\tomcat 6\webapps\my-application\web-inf\classes\org\apache\jasper\servlet\jspservlet.class" "read") @ java.security.accesscontrolcontext.checkpermission(accesscontrolcontext.java:372) @ java.security.accesscontroller.checkpermission(accesscontroller.java:559) @ java.lang.securitymanager.checkpermission(securitymanager.java:549) @ java.lang.securitymanager.checkread(securitymanager.java:888) @ java.io.file.exists(file.java:808) @ org.apache.naming.resources.filedircontext.file(filedircontext.java:785) @ org.apache.naming.resources.filedircontext.lookup(filedircontext.java:206) @ org.apache.naming.resources.proxydircontext.lookup(proxydircontext.java:299) @ org.apache.catalina.loader.webappclassloader.findresourceinternal(webappclassloader.java:2928) @ org.apache.catalina.loader.webappclassloader.findclassinternal(webappclassloader.java:2789) @ org.apache.catalina.loader.webappclassloader.findclass(webappclassloader.java:1159) @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1647) @ org.apache.catalina.loader.webappclassloader.loadclass(webappclassloader.java:1526) @ org.apache.catalina.core.standardwrapper.loadservlet(standardwrapper.java:1128) @ org.apache.catalina.core.standardwrapper.load(standardwrapper.java:1026) @ org.apache.catalina.core.standardcontext.loadonstartup(standardcontext.java:4421) @ org.apache.catalina.core.standardcontext.start(standardcontext.java:4734) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardhost.start(standardhost.java:840) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardengine.start(standardengine.java:463) @ org.apache.catalina.core.standardservice.start(standardservice.java:525) @ org.apache.catalina.core.standardserver.start(standardserver.java:754) @ org.apache.catalina.startup.catalina.start(catalina.java:595) @ sun.reflect.nativemethodaccessorimpl.invoke0(native method) @ sun.reflect.nativemethodaccessorimpl.invoke(nativemethodaccessorimpl.java:57) @ sun.reflect.delegatingmethodaccessorimpl.invoke(delegatingmethodaccessorimpl.java:43) @ java.lang.reflect.method.invoke(method.java:606) @ org.apache.catalina.startup.bootstrap.start(bootstrap.java:289) @ org.apache.catalina.startup.bootstrap.main(bootstrap.java:414) jun 23, 2014 8:05:39 org.apache.catalina.core.applicationcontext log information: marking servlet jsp unavailable jun 23, 2014 8:05:39 org.apache.catalina.core.standardcontext loadonstartup schwerwiegend: servlet /my-application threw load() exception java.security.accesscontrolexception: access denied ("java.lang.runtimepermission" "accessdeclaredmembers") @ java.security.accesscontrolcontext.checkpermission(accesscontrolcontext.java:372) @ java.security.accesscontroller.checkpermission(accesscontroller.java:559) @ java.lang.securitymanager.checkpermission(securitymanager.java:549) @ java.lang.class.checkmemberaccess(class.java:2237) @ java.lang.class.getdeclaredfields(class.java:1805) @ org.apache.catalina.util.defaultannotationprocessor.processannotations(defaultannotationprocessor.java:181) @ org.apache.catalina.core.standardwrapper.loadservlet(standardwrapper.java:1153) @ org.apache.catalina.core.standardwrapper.load(standardwrapper.java:1026) @ org.apache.catalina.core.standardcontext.loadonstartup(standardcontext.java:4421) @ org.apache.catalina.core.standardcontext.start(standardcontext.java:4734) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardhost.start(standardhost.java:840) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardengine.start(standardengine.java:463) @ org.apache.catalina.core.standardservice.start(standardservice.java:525) @ org.apache.catalina.core.standardserver.start(standardserver.java:754) @ org.apache.catalina.startup.catalina.start(catalina.java:595) @ sun.reflect.nativemethodaccessorimpl.invoke0(native method) @ sun.reflect.nativemethodaccessorimpl.invoke(nativemethodaccessorimpl.java:57) @ sun.reflect.delegatingmethodaccessorimpl.invoke(delegatingmethodaccessorimpl.java:43) @ java.lang.reflect.method.invoke(method.java:606) @ org.apache.catalina.startup.bootstrap.start(bootstrap.java:289) @ org.apache.catalina.startup.bootstrap.main(bootstrap.java:414) java.lang.reflect.invocationtargetexception @ sun.reflect.nativemethodaccessorimpl.invoke0(native method) @ sun.reflect.nativemethodaccessorimpl.invoke(nativemethodaccessorimpl.java:57) @ sun.reflect.delegatingmethodaccessorimpl.invoke(delegatingmethodaccessorimpl.java:43) @ java.lang.reflect.method.invoke(method.java:606) @ org.apache.catalina.startup.bootstrap.start(bootstrap.java:289) @ org.apache.catalina.startup.bootstrap.main(bootstrap.java:414) caused by: java.security.accesscontrolexception: access denied ("java.lang.runtimepermission" "setcontextclassloader") @ java.security.accesscontrolcontext.checkpermission(accesscontrolcontext.java:372) @ java.security.accesscontroller.checkpermission(accesscontroller.java:559) @ java.lang.securitymanager.checkpermission(securitymanager.java:549) @ java.lang.thread.setcontextclassloader(thread.java:1503) @ org.apache.catalina.core.standardcontext.unbindthread(standardcontext.java:5133) @ org.apache.catalina.core.standardcontext.start(standardcontext.java:4739) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardhost.start(standardhost.java:840) @ org.apache.catalina.core.containerbase.start(containerbase.java:1057) @ org.apache.catalina.core.standardengine.start(standardengine.java:463) @ org.apache.catalina.core.standardservice.start(standardservice.java:525) @ org.apache.catalina.core.standardserver.start(standardserver.java:754) @ org.apache.catalina.startup.catalina.start(catalina.java:595) ... 6 more

java tomcat slf4j logback