documentation_complete: true

title: 'Disable Socket Permissions for Deployed Applications'

description: |-
    Deployed applications must not be granted any socket permissions.
    These permissions are enforced by the Java Security Manager and the policies
    it loads at startup. These permissions can be assigned or restricted in an
    application-specific, granular manner.

rationale: |-
    Java permissions for deployed applications should be carefully restricted
    to enforce the least privilege principle. Most well-designed applications
    will not need to directly manipulate sockets for network access (access to
    datasources should be handled through datasources, which can be
    assigned SocketPermission.

severity: medium

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: AC-6

ocil_clause: 'proper permissions are not set for java.net.SocketPermission for deployed applications'
