Giving Applet Full Permission Without Policy File

[Darol]

I have a signed applet that needs the Java Plug-in to grant it full
permission to use system resources (files, sockets). I know that I can
do this by adding certificate info to the policy file, but I don't want
my users to have to modify their policy files. In short, how can my
applet get full permission without making any changes to the users'
policy file?

 

[Roedy Green]

I have a signed applet that needs the Java Plug-in to grant it full
permission to use system resources (files, sockets). I know that I can
do this by adding certificate info to the policy file, but I don't want
my users to have to modify their policy files. In short, how can my
applet get full permission without making any changes to the users'
policy file?

That is like asking how can I pick the policy file lock.

The whole point of the policy file is to stop signed applets from
running without permission or manual grant.

Imagine if there were an answer to your question. Pirates could use
it to hack every machine that ran an Applet. The loophole would have
to be quickly closed.

However, what you might do, is use a signed Applet to modify the
policy file. But that Applet has to be given a manual one-time grant.

 

[Andrew Thompson]

I have a signed applet that needs the Java Plug-in to grant it full
permission to use system resources (files, sockets).

If your applet is signed, the user should be asked if they
will accept the signature. If they do, the applet will be
granted full privileges.

...I know that I can
do this by adding certificate info to the policy file, but I don't want
my users to have to modify their policy files.

In other words, AFAIU, you should not need to adjust any
policy files even now.

Report back if that is correct. There is one more step you
can take to make sure the code is accepted as priviliged,
but I think it should not be necesary.

HTH

--
Andrew Thompson
physci.org 1point1c.org javasaver.com lensescapes.com athompson.info
"Her voice was soft and cool, her eyes were clear and bright, ..but she's
not there"
The Zombies 'She's Not There'

 

[Darol]

Full permission is not given simply if the user accepts the signed
applet if the applet has not been RSA-signed. I don't want to get an
official certificate and I don't want to create a test certificate,
which requires that the client user import this certificate. Ideally, I
would like the user to just accept a self-signed applet, which would
then be given full permission.

 

[Darol]

I'm not asking for a lock pick. My intent is to have the user accept a
self-signed applet, which is a permission grant.

 

[Andrew Thompson]

Full permission is not given simply if the user accepts the signed
applet if the applet has not been RSA-signed.

What does 'not been RSA-signed' mean? Self-signed?

Got an URL that suppports that self-signed certificates
(that are accepted by the user) get anything less than
full access/full privileges?

 

[Kenneth P. Turvey]

I'm not asking for a lock pick. My intent is to have the user accept a
self-signed applet, which is a permission grant.

The problem is that anyone could self sign their own applet. If the client
were to accept such a thing it would be completely open to anybody who
wanted to write malicious code.

 

[Roedy Green]

I'm not asking for a lock pick. My intent is to have the user accept a
self-signed applet, which is a permission grant.

In that case, there is nothing to do to the policy file.

 

[Roedy Green]

Ideally, I
would like the user to just accept a self-signed applet, which would
then be given full permission.

The way it works if you don't want to buy a certificate, is you create
a phony certificate (self signed) and sign your jar with it. When the
user gets it, he is asked if he is willing to accept your phony cert.
If he says "yes" then the Applet has full permission. If he says no,
you have only the unsigned Applet privileged. You can see the process
in action by going to http://mindprod.com/applets/wassup.html
where I have a self-signed Applet.

Anything else without a real certificate would require either
modifying the policy files of all the users or importing the
certificate as trusted in all the users' machines.

See http://mindprod.com/jgloss/certificate.html
http://mindprod.com/jgloss/keytool.html
http://mindprod.com/jgloss/signedapplets.html
http://mindprod.com/jgloss/jarsigner.html
for the gory details.

 

[Darol]

True, but that's the power I want to give my applet users. I understand
that this is a dangerous capability to give the user.

 

[Darol]

Yes, self-signed.

I haven't found a URL yet that allows self-signed certificates full
access.

 

[Darol]

Ok, I'll try your links. My applet did not get full permission with the
acceptance of the phony certificate.

 

[Andrew Thompson]

Ok, I'll try your links. My applet ...

Where is your applet? What is the URL I can visit to see it?

 

[Andrew Thompson]

I haven't found a URL yet that allows self-signed certificates full
access.

What does that mean? If you visited Roedy's Wassup applet
and clicked OK at the appropriate moment, it would gain
*full* access to your PC. It would not do anything
malevonelent with that privilege, but it is *able*
to do anything.

 

[Darol]

My applet is currently on a classified server so I can't let you access
it - wish I could.