We Keep Coding

In openjdk, security policies are not taking effect

In redhat-openjdk:1.8.0, jvm java.policy and custom.policy file's java.version is being effective on the activeprocess
I've configured the java process to use java security manager and it uses Apache server to run the process. So Apache client look for "java.version" read permission in default and/or custom policy file.
I've included ready property permission, yet i'm getting weird AccessControlException.
Exception i'm seeing is:
java.lang.RuntimeException: java.util.concurrent.ExecutionException: java.lang.RuntimeException: java.security.AccessControlException: access denied ("java.util.PropertyPermission" "java.version" "read")
I've right permissions in place Property permission entry in jvm/secruity/java.policy
permission java.util.PropertyPermission "java.version", "read";
and in custom.policy ( -Djava.security.manager -Djava.security.policy=custom.policy), file path fully-qualified, i just shortened for better understanding):
permission java.util.PropertyPermission "java.version", "read";
Expectation is to run java process with out issues, but that's not happening.
Edit 1:
I've also tried enforcing all permission using below line:
grant{
permission java.security.AllPermission;
};
But seems like it is still not working. I've also tried using '==' while setting up policy file, which mean
`If you use
java -Djava.security.manager -Djava.security.policy==someURL SomeApp
(note the double equals) then just the specified policy file will be used; all the ones indicated in the security properties file will be ignored.`
As per jdk 8 doc
Any help is much appreciated.

Looks to me that the policy is not in effect. In case you have multiple JDK releases installed, are you sure that you've modified the default policy for the same release that you are running with? I'd start by granting AllPermissions just to make sure that the policy is in effect, and then focus on the permission line itself.

Block some permissions and grant other permissions in java security policy

I want to implement a security policy file in the following way :-
Restrict access to all files except for files in 3 directories, i.e. if code accesses files from these 3 directories, it should be allowed but file access for any other directory is restricted.
Grant all other permissions to the code base.
How can I proceed for creating policy file for this requirement.

You need to create next policy file (yourPolicy.policy):
grant codeBase "file:/location_of_your_code/-" {
permission java.io.FilePermission "/tmp/f1/*", "read, write";
permission java.io.FilePermission "/tmp/f2/*", "read, write";
permission java.io.FilePermission "/tmp/f3/*", "read, write";
};
And launch your code with next arguments:
java -Djava.security.manager -Djava.security.policy=yourPolicy.policy YourClassName
It will restrict access of your java program to only these three folders.
About requirement “grant all other permissions” it seems that you can’t grant all permissions and override some specific permissions (grant access to only three folders) using java policy syntax. Thus you need explicitly specify all permissions that you want to grant to your application.

Modify SecurityManager

Hey stackoverflow community!
I'm writing a small program. In this program code, written in a Web-Interface, is compiled and run.
Now I want the written code from the web-interface to have just a few permissions, like reading a file in a specific directory, while my own code has all permissions.
I just looked up the SecurityManager and found a way to carry this out by using the codeBase attribute of the Policy-File. My idea was to give my code all permissions so the written code has no permissions.
grant codeBase "file:/PATH/-" {
permission java.security.AllPermission;
};
grant {
};
PATH points to the root directory of my program (with bin/src as subfolder).
It works until i'm invoking javax.tools.JavaCompiler.CompilationTask.call() to compile the given code, although the file has the required permissions:
An exception has occurred in the compiler (1.8.0_05). Please file a bug at the Java Developer Connection (Report a Bug or Request a Feature) after checking the Bug Parade for duplicates. Include your program and the following diagnostic in your report. Thank you.
java.security.AccessControlException: access denied ("java.util.PropertyPermission" "nonBatchMode" "read")
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:457)
at java.security.AccessController.checkPermission(AccessController.java:884)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
at java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1294)
at java.lang.System.getProperty(System.java:714)
at com.sun.tools.javac.main.Main.compile(Main.java:445)
at com.sun.tools.javac.api.JavacTaskImpl.doCall(JavacTaskImpl.java:129)
at com.sun.tools.javac.api.JavacTaskImpl.call(JavacTaskImpl.java:138)
.
.
.
I don't want to create a .java- and a .class-file for every typed code. For this reasen I used a ClassLoader with the following URI:
URI.create( "string:///" + className + Kind.CLASS.extension )
Trying to avoid the use of the "signedBy"-attriutes is important because it's difficult to sign .jar-files in Eclipse.
These are my questions:
1) Does anyone have an idea why the compiler throws an AccessControlException, although all needed rights are allowed?
2) Does anyone have an idea how to modify the SecurityManager this way?
3) Is it possible to seperate the included code from my own code at all?
4) Is the SecurityManager the right solution to my problem at all?
Thanks for reading and answering!

How to grant file read/write permission in a Security Manager policy file for variable parent directories

I'm learning to use Security Manager, and I'm getting this error when I run my unit tests:
Exception in thread "main" java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Users\[username]\AppData\Local\NetBeans\Cache\7.4\executor-snippets\junitvmwatcher1469887727677239882.properties" "write")
It's simple enough grant permission to that directory. The problem is I run this code on different computers. Ideally, I'd like to do something like this:
permission java.io.FilePermission "*/NetBeans/Cache/7.4/-", "write";
But apparently SecurityManager doesn't recognize wildcard characters at the beginning of the path. I've tried using both an asterisk and a dash. Neither works.
Basically, I'd like to get my tests to run without needing to hard-code an absolute path. Is there another way to achieve this?

You can use property expansion in policy files:
For example, permission java.io.FilePermission "${user.home}", "read";
will expand "${user.home}" to use the value of the "user.home" system property.
Could you set:
permission java.io.FilePermission "${user.home}/AppData/Local/NetBeans/-", "write";
to get what you wanted?

Java RMI: Client security policy

grant {
permission java.security.AllPermission;
};
This works.
grant file:///- {
permission java.security.AllPermission;
};
This does not work. Could someone please explain to me why?

The syntax should be:
grant codeBase "file:///-" {
...
};
See the docs. Note the semicolon.
Be very careful assigning permissions to code.
Are you sure the codebase should be a file URL (normal for development, not for production...).

The directive "grant { permission }" means grant the permission to all code no matter where it came from. In other words, when there is no codebase specified, the code could be loaded from the network or the file system.
The second directive (if it worked) would only apply to the local file system. It would be specifying all files (recursively) on the local file system. I'm not sure that "file:///" is a valid URL by itself. I know that file:///tmp/- works.