Applet signing Questions

[Roedy Green]

Is there a direct way to know if the user granted your signing
permission as an Applet?

I see Sun coding things like this:

java.security.PrivilegedAction pa =
new GetPropertyAction("file.encoding");

String csn = (String)AccessController.doPrivileged(pa);


What are they up to? Are there circumstances when I should do
something similar? When I call a Sun method that uses such code, do I
need a signed Applet?

 

[Andrew Thompson]

Is there a direct way to know if the user granted your signing
permission as an Applet?

boolean privileged = true;
try {
// try something permitted only
// in signed (and accepted) applets
System.getProperties();
} catch(Exception e) {
// either this applet is not signed,
// or the user refused permission
privileged = false;
}
....

HTH

 

[Pete Barrett]

Is there a direct way to know if the user granted your signing
permission as an Applet?

You want the AccessController.checkPermission(permission) method. It's
static, and throws an exception when the specific permission isn't
granted. So I might writre something like:

FilePermission permission = new FilePermission("C:/-", "write");
try
{
AccessController.checkPermission(permission);
// Add Save button only if can write to disk
panel.add(new JButton("Save"));
}
catch (AccessControlException e)
{
}

I see Sun coding things like this:

java.security.PrivilegedAction pa =
new GetPropertyAction("file.encoding");

String csn = (String)AccessController.doPrivileged(pa);


What are they up to? Are there circumstances when I should do
something similar?

Yes. This is how you invoke the privileged action (actually writing to
the disk, in the above example) that your users have allowed you to do
when they gave permission when the signed applet first loaded.

When I call a Sun method that uses such code, do I
need a signed Applet?

Not necessarily. If the JVM the applet is running on has a
SecurityManager which allows the action (which normally means a policy
file which allows it), then the applet doesn't need to be signed. But
since that's not normally the case, as a general rule, yes, you do.


Pete Barrett