From c436841461dd1a547a42d5c752d7984730f12214 Mon Sep 17 00:00:00 2001
From: Mike Hearn <mike@r3cev.com>
Date: Thu, 10 Mar 2016 18:13:43 +0100
Subject: [PATCH] Restrict Jolokia JMX access

---
 src/main/resources/jolokia-access.xml | 38 +++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 src/main/resources/jolokia-access.xml

diff --git a/src/main/resources/jolokia-access.xml b/src/main/resources/jolokia-access.xml
new file mode 100644
index 0000000000..2b20fa0c93
--- /dev/null
+++ b/src/main/resources/jolokia-access.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!--
+  ~ Copyright 2015 Distributed Ledger Group LLC.  Distributed as Licensed Company IP to DLG Group Members
+  ~ pursuant to the August 7, 2015 Advisory Services Agreement and subject to the Company IP License terms
+  ~ set forth therein.
+  ~
+  ~ All other rights reserved.
+  -->
+
+<restrict>
+    <http>
+        <method>post</method>
+        <method>get</method>
+    </http>
+
+    <commands>
+        <command>read</command>
+        <command>list</command>
+    </commands>
+
+    <!-- allow anyone to force a garbage collection -->
+    <allow>
+        <mbean>
+            <name>java.lang:type=Memory</name>
+            <operation>gc</operation>
+        </mbean>
+    </allow>
+
+    <!-- in case we ever end up using c3pio connection pooling, this example from the docs prevents the password being exported -->
+    <deny>
+        <mbean>
+            <name>com.mchange.v2.c3p0:type=PooledDataSource,*</name>
+            <attribute>properties</attribute>
+        </mbean>
+    </deny>
+
+</restrict>
\ No newline at end of file