Java security policy file

M

michaelp

Hello!

i am implementing a little RMI application, and trying to use a security
manager to grant permission to classes in my codebase.

I think I understand the principles, as well as the syntax of the policy
file.

The server starts o.k. when there is no security manager.

When I plug in the following code
if (System.getSecurityManager() == null) {
System.setSecurityManager(new SecurityManager());
}

I get security exceptions.

I have tried to fix those in the security policy file, but whatever I do
or do not do, the error messages (with the security manger enabled)
remains the same.

I have also tried to deliberately put faulty syntax in my security
policy, but java does not seem to react, making me suspect the security
file is ignored. Running with -verbose didnt help either.

Is there a way to dig into the error and find out what's going on?

Thanks!

Below are some extracts.

policy file (somewhat desperately overpopulated):

grant codeBase "file:/home/michaelp/rmiDB/" {
permission java.security.AllPermission ;
};
grant codeBase "file:/home/michaelp/rmiDB/rmi/" {
permission java.security.AllPermission ;
};
grant codeBase "file:/home/michaelp/rmiDB/server/" {
permission java.security.AllPermission ;
};
grant codeBase
"file:/home/michaelp/rmiDB/mysql-connector-java-3.1.12-bin.jar" {
permission java.security.AllPermission ;
};

command line:
java -classpath .:mysql-connector-java-3.1.12-bin.jar
-Djava.security.policy=server.policy
-Djava.rmi.server.codebase=file:/home/michaelp/rmiDB/
server.RMIServer

stack trace:
java.lang.ExceptionInInitializerError
at java.util.TimeZone$1.run (TimeZone.java:114)
at java.security.AccessController.doPrivileged
(AccessController.java:96)
at java.util.TimeZone.defaultZone (TimeZone.java:100)
at java.util.TimeZone.getDefault (TimeZone.java:1295)
at com.mysql.jdbc.Connection.<init> (Connection.java:1433)
at com.mysql.jdbc.NonRegisteringDriver.connect
(NonRegisteringDriver.java:266)
at java.sql.DriverManager.getConnection (DriverManager.java:164)
at java.sql.DriverManager.getConnection (DriverManager.java:188)
at rmi.DB_util.doConnect (DB_util.java:45)
at rmi.JDBC_lag_RMIImpl.<init> (JDBC_lag_RMIImpl.java:25)
at server.RMIServer.main (RMIServer.java:30)
Caused by: java.security.AccessControlException: permission not granted
at java.security.AccessControlContext.checkPermission
(AccessControlContext.java:122)
at java.security.AccessController.checkPermission
(AccessController.java:76)
at java.lang.SecurityManager.checkPermission (SecurityManager.java:337)
at java.lang.SecurityManager.checkLink (SecurityManager.java:496)
at java.lang.Runtime.loadLibrary (Runtime.java:171)
at java.lang.System.loadLibrary (System.java:175)
at java.util.VMTimeZone.<clinit> (VMTimeZone.java:55)
at java.util.TimeZone$1.run (TimeZone.java:114)
...10 more
java.security.AccessControlException: permission not granted
at java.security.AccessControlContext.checkPermission
(AccessControlContext.java:122)
at java.security.AccessController.checkPermission
(AccessController.java:76)
at java.lang.SecurityManager.checkPermission (SecurityManager.java:337)
at java.lang.SecurityManager.checkLink (SecurityManager.java:496)
at java.lang.Runtime.loadLibrary (Runtime.java:171)
at java.lang.System.loadLibrary (System.java:175)
at java.util.VMTimeZone.<clinit> (VMTimeZone.java:55)
at java.util.TimeZone$1.run (TimeZone.java:114)
at java.security.AccessController.doPrivileged
(AccessController.java:96)
at java.util.TimeZone.defaultZone (TimeZone.java:100)
at java.util.TimeZone.getDefault (TimeZone.java:1295)
at com.mysql.jdbc.Connection.<init> (Connection.java:1433)
at com.mysql.jdbc.NonRegisteringDriver.connect
(NonRegisteringDriver.java:266)
at java.sql.DriverManager.getConnection (DriverManager.java:164)
at java.sql.DriverManager.getConnection (DriverManager.java:188)
at rmi.DB_util.doConnect (DB_util.java:45)
at rmi.JDBC_lag_RMIImpl.<init> (JDBC_lag_RMIImpl.java:25)
at server.RMIServer.main (RMIServer.java:30)
 
T

Tom Hawtin

I use 1.6.0
Click to expand...

Sun's 1.6? I can't find that source file in the source or that class
file in any JRE jar.

Are you sure you are not picking another Java runtime? For instance, the
GNU Java effort. If you add -showversion to the command line (before the
class name), it should display the exact version.

Doing a google for VMTimeZone seems to indicate that you are using the
GNU. So, I suggest specifying the full path to java in the command line
(and perhaps removing the GNU implementation).

Tom Hawtin
 
L

Lew

Tom said:
Sun's 1.6? I can't find that source file in the source or that class
file in any JRE jar.

Are you sure you are not picking another Java runtime? For instance, the
GNU Java effort. If you add -showversion to the command line (before the
class name), it should display the exact version.

Doing a google for VMTimeZone seems to indicate that you are using the
GNU. So, I suggest specifying the full path to java in the command line
(and perhaps removing the GNU implementation).
Click to expand...

I thought it was illegal to write classes in the java[x] packages unless you
were Sun.
 
T

Tom Hawtin

Lew said:
Tom said:
Doing a google for VMTimeZone seems to indicate that you are using the
GNU. So, I suggest specifying the full path to java in the command
line (and perhaps removing the GNU implementation).
Click to expand...

I thought it was illegal to write classes in the java[x] packages unless
you were Sun.
Click to expand...

Illegal in the sense that the specs say not to. Non-Sun JSRs can add
public classes to java[x].

Presumably VMTimeZone is a package-private class. That doesn't change
the API, so it's okay.

Tom Hawtin
 
L

Lew

Tom said:
I thought it was illegal to write classes in the java[x] packages
unless you were Sun.
Click to expand...
Click to expand...

Tom said:
Illegal in the sense that the specs say not to. Non-Sun JSRs can add
public classes to java[x].

Presumably VMTimeZone is a package-private class. That doesn't change
the API, so it's okay.
Click to expand...

I thought it was literally illegal, in that it violates the trademark on "Java".
 
T

Tom Hawtin

Lew said:
I thought it was literally illegal, in that it violates the trademark on
"Java".
Click to expand...

I am not a lawyer: I don't believe the GNU Java implementation claims to
be Java(TM). I understand that Microsoft had a contract with Sun which
did impose restrictions, and that Microsoft was found in court to have
broken some of those clauses.

Tom Hawtin
 
L

Lew

Tom said:
I am not a lawyer: I don't believe the GNU Java implementation claims to
be Java(TM). I understand that Microsoft had a contract with Sun which
did impose restrictions, and that Microsoft was found in court to have
broken some of those clauses.
Click to expand...

You were right about package-private classes being permissible, as I read the
license for the Java specification from the Sun web site,
Sun also grants you a ... license ,,,
to create and/or distribute an Independent Implementation of the Specification
that: ...
(b) does not modify, subset, superset or otherwise extend
the Licensor Name Space, or include any public or protected packages,
classes, Java interfaces, fields or methods within the Licensor Name Space
other than those required/authorized by the Specification or Specifications being implemented
Click to expand...

If the Gnu version were not Java then we would be powerless to help in a Java
newsgroup.
 
E

Esmond Pitt

Lew said:
If the Gnu version were not Java then we would be powerless to help in a
Java newsgroup.
Click to expand...

The Gnu 'Java' is sufficiently unlike Java that I invariably recommend
it be deleted and replaced with a Sun or IBM JRE when found, and that
invariably fixed whatever the problem is.
 
M

Matej Cepl

The Gnu 'Java' is sufficiently unlike Java that I invariably
recommend it be deleted and replaced with a Sun or IBM JRE when
found, and that invariably fixed whatever the problem is.
Click to expand...

Does this announcement from gcc.gnu.org/java changes something in
your opinion?

January 8, 2007
We've merged the gcj-eclipse branch to svn trunk. The
merge changes gcj to use the Eclipse compiler as a front end,
enabling all 1.5 language features. This merge also brings in
a new, generics-enabled version of Classpath, including some
new tools. This new code will appear in GCC 4.3.

Matej
 
L

Lew

Matej said:
Does this announcement from gcc.gnu.org/java changes something in
your opinion?

January 8, 2007
We've merged the gcj-eclipse branch to svn trunk. The
merge changes gcj to use the Eclipse compiler as a front end,
enabling all 1.5 language features. This merge also brings in
a new, generics-enabled version of Classpath, including some
new tools. This new code will appear in GCC 4.3.
Click to expand...

No.
 
M

Mark Thornton

Matej said:
Does this announcement from gcc.gnu.org/java changes something in
your opinion?

January 8, 2007
We've merged the gcj-eclipse branch to svn trunk. The
merge changes gcj to use the Eclipse compiler as a front end,
enabling all 1.5 language features. This merge also brings in
a new, generics-enabled version of Classpath, including some
new tools. This new code will appear in GCC 4.3.

Matej
Click to expand...

It will be a while before that is the version commonly found. For
example an up to date copy of Suse 10.2 has ClassPath 0.92. Many
installations will have even older versions, and those older versions
are the ones on which the impression of 'not working' is based.
It is only in the past 6 months or so that there has been any chance of
my own code working on ClassPath (although as my latest work targets 1.6
that is probably won't work either).

Mark Thornton
 
E

Esmond Pitt

Matej said:
Does this announcement from gcc.gnu.org/java changes something in
your opinion?
Click to expand...

No. If it is now compatible with Sun Java it will be self-incompatible,
and in either case it can't be of any practical use.
 
?

=?ISO-8859-1?Q?Arne_Vajh=F8j?=

Matej said:
Does this announcement from gcc.gnu.org/java changes something in
your opinion?

January 8, 2007
We've merged the gcj-eclipse branch to svn trunk. The
merge changes gcj to use the Eclipse compiler as a front end,
enabling all 1.5 language features. This merge also brings in
a new, generics-enabled version of Classpath, including some
new tools. This new code will appear in GCC 4.3.
Click to expand...

Will it be certified ?

Arne
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

axis and tomcat security manager 0
Tomcat: Strange error 2
spring / log4j security permission 1
log4j and required security policy entries 0
Extending SecurityManager gives ExceptionInInitializerError 0
Applet and policy file questions 6
RMI - Trying a simple example 0
java.rmi.server.codebase clarification 1

Members online

Total: 33 (members: 1, guests: 32)
Robots: 654

Forum statistics

Threads
473,769
Messages
2,569,582
Members
45,057
Latest member
KetoBeezACVGummies

Latest Threads

Top