AMQ-9201 - Update Jolokia default access configuration
(cherry picked from commit 6120169e563b55323352431dfe9ac67a8b4de6c2)
diff --git a/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml b/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml
index 8cad1cd..97b099a 100644
--- a/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml
+++ b/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml
@@ -22,9 +22,36 @@
<strict-checking/>
</cors>
- <!-- deny calling operations or getting attributes from these mbeans -->
+ <!-- By default don't allow write or exec operations -->
+ <commands>
+ <command>read</command>
+ <command>list</command>
+ <command>version</command>
+ <command>search</command>
+ </commands>
+
+ <allow>
+ <!-- Allow all operations for the broker itself -->
+ <mbean>
+ <name>org.apache.activemq:*</name>
+ <attribute>*</attribute>
+ <operation>*</operation>
+ </mbean>
+ <!-- Allow all operations for Jolokia Config -->
+ <mbean>
+ <name>jolokia:type=Config</name>
+ <operation>*</operation>
+ </mbean>
+ </allow>
+
+ <!-- deny all operations or getting attributes from these mbeans -->
<deny>
<mbean>
+ <name>org.apache.logging.log4j2:*</name>
+ <attribute>*</attribute>
+ <operation>*</operation>
+ </mbean>
+ <mbean>
<name>com.sun.management:type=DiagnosticCommand</name>
<attribute>*</attribute>
<operation>*</operation>
@@ -34,6 +61,11 @@
<attribute>*</attribute>
<operation>*</operation>
</mbean>
+ <mbean>
+ <name>jdk.management.jfr:type=FlightRecorder</name>
+ <attribute>*</attribute>
+ <operation>*</operation>
+ </mbean>
</deny>
</restrict>
