V2R6 changes
JBoss Enterprise Application Platform 6.3 STIG V2R6 (2025-04-02) replaced V2R5 (2024-10-24): 2 checks updated. It has 67 checks, against 67 in V2R5.
V2R6 checklistV2R5 checklist Compare V2R5 and V2R6 in STIG Compare
- 0 added
- 0 removed
- 2 updated
Updated fields: Check text 2Fix text 2Discussion 2
Updated in V2R6 (2)
V-213496CAT IJava permissions must be set for hosted applications.Check text, Fix text, Discussion
Check text
Enabling the Security Manager in JDK 24 is an error and if using JDK 24, this is not a finding.
Note: Security Manager was deprecated in Java 17 and will be permanently removed in JDK 24.
For additional information: <https://openjdk.org/jeps/486>
Obtain documentation from the admin that identifies the applications hosted on the JBoss server as well as the corresponding rights the application requires. For example, if the application requires network socket permissions and file write permissions, document those requirements should be documented.
1. Identify the JBoss installation as either domain or standalone and review the relevant configuration file.
For domain installs: JBOSS_HOME/bin/domain.conf
For standalone installs: JBOSS_HOME/bin/standalone.conf
2. Identify the location and name of the security policy by reading the JAVA_OPTS flag -Djava.security.policy=<file name> where <file name> will indicate name and location of security policy. If the application uses a policy URL, obtain the URL and policy file from system admin.
3. Review security policy and ensure hosted applications have the appropriate restrictions placed on them as per documented application functionality requirements.
If the security policy does not restrict application access to host resources as per documented requirements, this is a finding.
Fix text
Enabling the Security Manager in JDK 24 is an error and if using JDK 24, this is not a finding. Configure the Java security manager to enforce access restrictions to the host system resources in accordance with application design and resource requirements.
Discussion
The Java Security Manager is a java class that manages the external boundary of the Java Virtual Machine (JVM) sandbox, controlling how code executing within the JVM can interact with resources outside the JVM.
The JVM requires a security policy in order to restrict application access. A properly configured security policy will define what rights the application has to the underlying system. For example, rights to make changes to files on the host system or to initiate network sockets in order to connect to another system.
V-213497CAT IThe Java Security Manager must be enabled for the JBoss application server.Check text, Fix text, Discussion
Check text
Enabling the Security Manager in JDK 24 is an error and if using JDK 24, this is not a finding.
Note, Security Manager was deprecated in Java 17 and will be permanently removed in JDK 24.
For additional information: <https://openjdk.org/jeps/486>
To determine if the Java Security Manager is enabled for JBoss, you must examine the startup commands must be examined. JBoss can be configured to run in either "domain" or a "standalone" mode. JBOSS_HOME is the variable home directory for the JBoss installation. Use relevant OS commands to navigate the file system.
A1. For a managed domain installation, review the domain.conf and domain.conf.bat files:
JBOSS_HOME/bin/domain.conf
JBOSS_HOME/bin/domain.conf.bat
In domain.conf file, ensure there is a JAVA_OPTS flag that loads the Java Security Manager as well as a relevant Java Security policy. The following is an exampleExample:
JAVA_OPTS="$JAVA_OPTS -Djava.security.manager -Djava.security.policy==$PWD/server.policy -Djboss.home.dir=/path/to/JBOSS_HOME -Djboss.modules.policy-permissions=true"
In domain.conf.bat file, ensure JAVA_OPTS flag is set. The following is an exampleExample:
set "JAVA_OPTS=%JAVA_OPTS% -Djava.security.manager -Djava.security.policy==/path/to/server.policy -Djboss.home.dir=/path/to/JBOSS_HOME -Djboss.modules.policy-permissions=true"
B2. For a standalone installation, review the standalone.conf and standalone.conf.bat files:
JBOSS_HOME/bin/standalone.conf
JBOSS_HOME/bin/standalone.conf.bat
In the standalone.conf file, ensure the JAVA_OPTS flag is set. The following is an exampleExample:
JAVA_OPTS="$JAVA_OPTS -Djava.security.manager -Djava.security.policy==$PWD/server.policy -Djboss.home.dir=$JBOSS_HOME -Djboss.modules.policy-permissions=true"
In the standalone.conf.bat file, ensure the JAVA_OPTS flag is set. The following is an exampleExample:
set "JAVA_OPTS=%JAVA_OPTS% -Djava.security.manager -Djava.security.policy==/path/to/server.policy -Djboss.home.dir=%JBOSS_HOME% -Djboss.modules.policy-permissions=true"
If the security manager is not enabled and a security policy not defined, this is a finding.
Fix text
Enabling the Security Manager in JDK 24 is an error and if using JDK 24, this is not a finding. For a domain installation: Enable the respective JAVA_OPTS flag in both the domain.conf and the domain.conf.bat files. For a standalone installation: Enable the respective JAVA_OPTS flag in both the standalone.conf and the standalone.conf.bat files.
Discussion
The Java Security Manager is a java class that manages the external boundary of the Java Virtual Machine (JVM) sandbox, controlling how code executing within the JVM can interact with resources outside the JVM.
The Java Security Manager uses a security policy to determine whether a given action will be
permitted or denied.
To protect the host system, the JBoss application server must be run within the Java Security Manager.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R6 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.