Security confusion

[stixwix]

Hi,

Using Java as it comes 'out the box', the following runs ok:
System.getProperty("user.home");

But if I sub-class SecurityManager thus:
class MySecurityManager extends SecurityManager {}

and then set this up in main:
System.setSecurityManager(new MySecurityManager());

Then the getProperty call throws an access exception.

If i edit the java.policy file to specifically allow this call then it
is ok (this property isn't in the default 'allowed' list).

This implies that the default SecurityManager doesn't use the
java.policy file but I know it does because if you leave a syntax error
in the file you get an exception.

What am I missing here?

Regards,
Andy

 

[Chris Smith]

If i edit the java.policy file to specifically allow this call then it
is ok (this property isn't in the default 'allowed' list).

This implies that the default SecurityManager doesn't use the
java.policy file

Huh? If editing the java.policy file works, then obviously
SecurityManager does use the file. (Yes, it does, by the way).

--
www.designacourse.com
The Easiest Way To Train Anyone... Anywhere.

Chris Smith - Lead Software Developer/Technical Trainer
MindIQ Corporation

 

[stixwix]

The point is that if I don't declare my own SecurityManager, I don't
need to edit the java.policy file - the call does not throw an
exception (even though this property is not in the policy file's
default list of permissions).

Once I have declared MySecurityManager to be 'the daddy', then the only
way to get the call to work is to explicitly add this call to the
policy file.

cheers

 

[Paulus de Boska]

In standalone applications there is no default securitymanager . You
can appoint one, as in : System.setSecurityManager.... , that will
enforce the policy files. More on this here :
http://javalessons.com/cgi-bin/fun/java-tutorials-main.cgi?ses=ao789

category 'Advanced', lesson 'Policy files'

 

[Chris Smith]

The point is that if I don't declare my own SecurityManager, I don't
need to edit the java.policy file - the call does not throw an
exception (even though this property is not in the policy file's
default list of permissions).

I was under the impression that you didn't have a security manager at
all for the first test (as you said, "Java as it comes 'out the box'").
If you set a security manager for the first test, then that's very odd
indeed, and I don't have an explanation for you.

--
www.designacourse.com
The Easiest Way To Train Anyone... Anywhere.

Chris Smith - Lead Software Developer/Technical Trainer
MindIQ Corporation

 

[stixwix]

Ahhh, the penny drops....
Thanks.