I want to implement a security policy file in the following way :-
Restrict access to all files except for files in 3 directories, i.e. if code accesses files from these 3 directories, it should be allowed but file access for any other directory is restricted.
Grant all other permissions to the code base.
How can I proceed for creating policy file for this requirement.
You need to create next policy file (yourPolicy.policy):
grant codeBase "file:/location_of_your_code/-" {
permission java.io.FilePermission "/tmp/f1/*", "read, write";
permission java.io.FilePermission "/tmp/f2/*", "read, write";
permission java.io.FilePermission "/tmp/f3/*", "read, write";
};
And launch your code with next arguments:
java -Djava.security.manager -Djava.security.policy=yourPolicy.policy YourClassName
It will restrict access of your java program to only these three folders.
About requirement “grant all other permissions” it seems that you can’t grant all permissions and override some specific permissions (grant access to only three folders) using java policy syntax. Thus you need explicitly specify all permissions that you want to grant to your application.
Related
I'm trying to enforce a security policy, giving Java classes signed by a certain signer certain permissions. My security policy file looks as following:
// ========== SYSTEM CODE PERMISSIONS =========================================
grant codeBase "file:${java.home}/conf/*" {
permission java.security.AllPermission;
};
// These permissions apply to all shared system extensions
grant codeBase "file:${java.home}/jre/lib/ext/*" {
permission java.security.AllPermission;
};
// These permissions apply to all shared system extensions
grant codeBase "file:${java.home}/lib/ext/*" {
permission java.security.AllPermission;
};
// ========== CLASS PERMISSIONS =========================================
keystore "file:/C:/Program Files/Java/openjdk-12/lib/security/cacerts";
keystorePasswordURL "file:/C:/Shared/Team/java-jar-signed/keystore.password";
grant signedBy "mycompany" {
permission java.security.AllPermission;
permission java.io.FilePermission "C:\\*", "read,write,execute";
permission java.io.FilePermission "C:\\", "read,write,execute";
};
The Keystore cacerts contains a certificate with the alias mycompany. The JAR file im testing the security policy with has been signed with the private key of that certificate. When I execute the JAR file with
java -Djava.security.manager -Djava.security.policy=rules.policy -Djava.security.debug=access -cp ReadC-signed.jar ReadC
I get
access: access denied ("java.io.FilePermission" "C:\" "read")
When I use codeBase "path/to/jar" instead of signedBy "mycompany" it works perfectly fine. Does anybody know what could be going wrong here?
I am investigating java security manager. I see that 'grant' is required attribute for *.policy file and it is global. But how it will behave in case if I add 'grant codeBase' for the same resoure. For example:
grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/log4j-1.2.17.jar!/-" {
permission java.io.FilePermission "${catalina.base}/logs/-", "delete";
};
grant {
permission java.io.FilePermission "${catalina.base}/logs/-", "write";
};
Will log4j-1.2.17.jar has a permission to delete files in the log folder?
Can 'grant codeBase' override 'grant' section?
Thank you!
I'm learning to use Security Manager, and I'm getting this error when I run my unit tests:
Exception in thread "main" java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Users\[username]\AppData\Local\NetBeans\Cache\7.4\executor-snippets\junitvmwatcher1469887727677239882.properties" "write")
It's simple enough grant permission to that directory. The problem is I run this code on different computers. Ideally, I'd like to do something like this:
permission java.io.FilePermission "*/NetBeans/Cache/7.4/-", "write";
But apparently SecurityManager doesn't recognize wildcard characters at the beginning of the path. I've tried using both an asterisk and a dash. Neither works.
Basically, I'd like to get my tests to run without needing to hard-code an absolute path. Is there another way to achieve this?
You can use property expansion in policy files:
For example, permission java.io.FilePermission "${user.home}", "read";
will expand "${user.home}" to use the value of the "user.home" system property.
Could you set:
permission java.io.FilePermission "${user.home}/AppData/Local/NetBeans/-", "write";
to get what you wanted?
I am working on an HTML page that is using Javascript to interact with a Java applet. The HTML page, javascript files, and .jar file for the applet will be deployed locally to a folder on the user's filesystem.
(Implmenting this as a standalone Java application is not an option here; for various reasons I will not explain here).
The applet needs to do local file i/o. As such, I'm attempting to tweek the settings in the user's .java.policy file to permit this.
I have found the following setup is the only one that works:
grant
{
permission java.io.FilePermission "<<ALL FILES>>", "read";
permission java.io.FilePermission "<<ALL FILES>>", "write";
};
This is not ideal, as that it grants all applets permissions to read write all files. Naturally I would prefer to isolate to the particular code base. However I could not find a "grant codeBase" syntax that works.
I have tried:
grant codeBase "file:/C:/Files/FileIOApplet/-" {
permission java.io.FilePermission "<<ALL FILES>>", "read";
permission java.io.FilePermission "<<ALL FILES>>", "write";
};
grant codeBase "file:///-" {
permission java.io.FilePermission "<<ALL FILES>>", "read";
permission java.io.FilePermission "<<ALL FILES>>", "write";
};
grant codeBase "file:${user.home}/-"
{
permission java.io.FilePermission "<<ALL FILES>>", "read";
permission java.io.FilePermission "<<ALL FILES>>", "write";
};
This is running using this configuration:
Firefox 3.6.10
Java 1.6 update 25
Windows 7 64 bit
Where I am I going wrong in setting up this .java.policy file?
I am pretty rusty to the Java world, especially working with applets - so your expertise is appreciated!
To connect an Applet with access here are the policy tool settings:
Go to policyTool, you will find it in following path:
java->jdk1.3->bin->policyTool Application
There appears Policy Tool window.
In the Policy Tool window select the "Add Policy Entry" button.
This will take you to Policy Entry window
There enter the CodeBase as "file:/path of your java bin". For example
CodeBase file:/c:/java/jdk1.3/bin/
Now press "Add Permission" button in the Policy Entry window.
This will take you to the "Permissions" window
There Select "All permission" from permission drop down list box.
And click "ok".
Now again press the "Add Permission" button in the Policy Entry window.
Now Select "Select "RunTimepermission" from permission drop down list box.
Now in the Target Name drop down list box select "accessClassInpackage", in the text box enter accessClassInpackage.sun.jdbc.odbc
Now click "ok".
Now click "done" in "Policy Entry" window.
Now in the Policy Entry window file->save
Save it in "bin" of your Java installation.
Remember the name...
for example say..
appletpermission
'save'
Now you have a created policy file for access
Now to compile your java file at the command prompt
javac programname.java
To run your program type the following at the cmd prompt:
appletviewer -J-Djava.security.policy=appletpermission programname.java
Now everything is done.
don't waste your time with syntax, use the policy tool instead :
click here : Policy Tool
grant {
permission java.security.AllPermission;
};
This works.
grant file:///- {
permission java.security.AllPermission;
};
This does not work. Could someone please explain to me why?
The syntax should be:
grant codeBase "file:///-" {
...
};
See the docs. Note the semicolon.
Be very careful assigning permissions to code.
Are you sure the codebase should be a file URL (normal for development, not for production...).
The directive "grant { permission }" means grant the permission to all code no matter where it came from. In other words, when there is no codebase specified, the code could be loaded from the network or the file system.
The second directive (if it worked) would only apply to the local file system. It would be specifying all files (recursively) on the local file system. I'm not sure that "file:///" is a valid URL by itself. I know that file:///tmp/- works.