We Keep Coding

In openjdk, security policies are not taking effect

In redhat-openjdk:1.8.0, jvm java.policy and custom.policy file's java.version is being effective on the activeprocess
I've configured the java process to use java security manager and it uses Apache server to run the process. So Apache client look for "java.version" read permission in default and/or custom policy file.
I've included ready property permission, yet i'm getting weird AccessControlException.
Exception i'm seeing is:
java.lang.RuntimeException: java.util.concurrent.ExecutionException: java.lang.RuntimeException: java.security.AccessControlException: access denied ("java.util.PropertyPermission" "java.version" "read")
I've right permissions in place Property permission entry in jvm/secruity/java.policy
permission java.util.PropertyPermission "java.version", "read";
and in custom.policy ( -Djava.security.manager -Djava.security.policy=custom.policy), file path fully-qualified, i just shortened for better understanding):
permission java.util.PropertyPermission "java.version", "read";
Expectation is to run java process with out issues, but that's not happening.
Edit 1:
I've also tried enforcing all permission using below line:
grant{
permission java.security.AllPermission;
};
But seems like it is still not working. I've also tried using '==' while setting up policy file, which mean
`If you use
java -Djava.security.manager -Djava.security.policy==someURL SomeApp
(note the double equals) then just the specified policy file will be used; all the ones indicated in the security properties file will be ignored.`
As per jdk 8 doc
Any help is much appreciated.

Looks to me that the policy is not in effect. In case you have multiple JDK releases installed, are you sure that you've modified the default policy for the same release that you are running with? I'd start by granting AllPermissions just to make sure that the policy is in effect, and then focus on the permission line itself.

Tomcat Denying access to resource file in exploded war directory

We have a WAR application deployed on Tomcat 7.0.65. This application uses a library that has a bunch of polygon.txt files in it's resource directory. Whenever the library is invoked it throws a file permission exception on the jar file in the exploded war directory.
here is the error:
Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/var/lib/tomcat7/webapps/**/WEB-INF/lib/table-service-1.37.jar" "read")
at org.apache.catalina.loader.WebappClassLoaderBase.getResourceAsStream(WebappClassLoaderBase.java:1659) ~[catalina-7.0.65.jar:7.0.65]
at com.**.PropertyGeometryDAO.initialize(PropertyGeometryDAO.java:47) ~[table-service-1.37.jar:?]
Thrown at this line in the code:
try (InputStream stream = getClass().getClassLoader().getResourceAsStream(fileName))
Here is the catalina.policy file defining the permissions:
permission java.io.FilePermission "/usr/share/tomcat7/webapps/*", "read";
We also have separate WAR's deployed on the same Tomcat using the same library that are working just fine.

The exception is for
"/var/lib/tomcat7/webapps/**/WEB-INF/lib/table-service-1.37.jar"
but your permission is for
permission java.io.FilePermission "/usr/share/tomcat7/webapps/*", "read";

How to grant file read/write permission in a Security Manager policy file for variable parent directories

I'm learning to use Security Manager, and I'm getting this error when I run my unit tests:
Exception in thread "main" java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Users\[username]\AppData\Local\NetBeans\Cache\7.4\executor-snippets\junitvmwatcher1469887727677239882.properties" "write")
It's simple enough grant permission to that directory. The problem is I run this code on different computers. Ideally, I'd like to do something like this:
permission java.io.FilePermission "*/NetBeans/Cache/7.4/-", "write";
But apparently SecurityManager doesn't recognize wildcard characters at the beginning of the path. I've tried using both an asterisk and a dash. Neither works.
Basically, I'd like to get my tests to run without needing to hard-code an absolute path. Is there another way to achieve this?

You can use property expansion in policy files:
For example, permission java.io.FilePermission "${user.home}", "read";
will expand "${user.home}" to use the value of the "user.home" system property.
Could you set:
permission java.io.FilePermission "${user.home}/AppData/Local/NetBeans/-", "write";
to get what you wanted?

Granting access to anything on a path in the Java policy file

I'm dealing with a badly-behaved library (JRuby) which tries to read the entire universe and then fails to deal with the SecurityException as well, thus fails to start up at all.
Caused by: org.jruby.exceptions.RaiseException: (LoadError) library `java' could not be loaded: java.security.AccessControlException: access denied ("java.io.FilePermission" "/Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Home/lib/ant-javafx.jar" "read")
I don't mind JRuby (or any other library, for that matter) reading the entire universe, though, so I am trying to figure out how to add this to the grants. This jar file turns out to be on the java.class.path, but I can't figure out the rule to grant the permission.
Taking examples from other policy files I have seen in the past, I have been trying things like this:
grant {
permission java.io.FilePermission "${{java.class.path}}", "read, execute";
permission java.io.FilePermission "${{java.class.path}}/-", "read, execute";
};
But it makes no difference whatsoever, so I suspect this ${{...}} syntax only works for the codeBase.
Is there a way to do it for file permissions as well?

Console don't let my applet run because of a file

I am working in an applet. It works perfect with Eclipse but when I try to run from Console it gives me this stack trace:
C:\Course Technology\src>appletviewer TestJAlienHunt.html
Path for file entered D:\Course Technology\AssignmentFinal\scoreFile.txt java.security.AccessControlException: access denied ("java.io.FilePermission" "D:\Course Technology\AssignmentFinal\scoreFile.txt" "read")
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)
at java.security.AccessController.checkPermission(AccessController.java:555)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
at sun.nio.fs.WindowsPath.checkRead(WindowsPath.java:792)
at sun.nio.fs.WindowsFileSystemProvider.checkAccess(WindowsFileSystemProvider.java:360)
at java.nio.file.Files.exists(Files.java:2311)
at ReadFile.fileExists(ReadFile.java:47)
at JAlienHunt.readScore(JAlienHunt.java:187)
at JAlienHunt.init(JAlienHunt.java:73)
at sun.applet.AppletPanel.run(AppletPanel.java:434)
at java.lang.Thread.run(Thread.java:722)
The file has permission to read and write, why I am getting this?

An applet needs to be digitally signed by you and trusted by the end user before it can access the local file system on the user's computer.
I highlight user's computer because that is where any File will equate to. There is no option for getting a File pointing to the server. If this is read only and the server hosts the resource, access it by URL.