10.14 Do not run applications as privileged

Information

Setting the privileged attribute for an application changes the class loader to the Server class loader instead of the Shared class loader.

Rationale:

Running an application in privileged mode allows an application to load the manager libraries.

Solution

Set the privileged attribute in all context.xml files to false unless it is required as for the manager application:

<Context ... privileged='false' />

Default Value:

By default, privileged has a value of false.

References:

https://tomcat.apache.org/tomcat-8.0-doc/config/context.html

See Also

https://workbench.cisecurity.org/files/2506

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CSCv7|4.7

Plugin: Unix

Control ID: 86395a8926ca6cb877ce21607e8ac723585a3165c0ba4229c3a1afb73545d94f