We Keep Coding

How to launch a .jar that needs elevated privileges?

I have a little .jar that executes a simple system administration task and so it needs to be run with elevated privilege. I've been researching this for hours and now know that it can be done in three ways:
1) ran from an elevated cmd prompt
2) convert the .jar to .exe and bundle it with a manifest file
3) use another .jar to launch my .jar and ask for permission.
Option 1) won't work for me because this will need to be deployed to other users that won't know how to do this. Option 2) isn't ideal because I chose to write this app in Java for its portability. This will likely be run on different systems and Java seems the most compatible. So that leaves Option 3) and is where my question comes in. I can't seem to sift through the multitude of info out there on how to accomplish creating a wrapper for my app. With my specs in mind what do you all recommend for creating a wrapper .jar that will prompt the user to allow my .jar to run? Thanks

On Windows, it is possible to run a Java application either as a desktop application, or as a Windows Service in the background. In the case of a Service, the Wrapper needs to be able to be installed, removed, started, stopped, have its status queried, etc. Depending on whether the application has a GUI or is meant to be run in a command window also determines how it will be run.
On Windows systems, the most way of launching the Wrapper is to make use of dedicated batch files to perform each action of controlling the Wrapper. This makes it possible for the end user to double click on the batch file icons or set up links in menus, just have a look if you have the java runtime env.
Nice tutorial: http://wrapper.tanukisoftware.com/doc/english/qna-service.html
Here it has some other possibilities, using Dedicated Batch File, Command Based Batch File or Standalone Binary : http://wrapper.tanukisoftware.com/doc/english/launch-win.html#dedicated

Think you can do this with .bat file. Make sure you have java runtime env, so that you can execute jar file using java -jar command.

If your looking to force the user to use elevated permissions then pure Java isn't going to cut it. I suggest you write native code and use the Java Native Interface (JNI)

Write to C:\Program Files from Java program

I have written a Java application that includes a self updater. The self updater loads new program versions from a web server and replaces the application files. While this works perfectly if the application is installed e.g. in the users home directory, it fails on windows machines if it's installed in the C:\Program Files folder. This is because the JVM is executed under the user’s account which has no write access to the program directory.
If a native program, e.g. an installer, tries to write to the program folder, usually a popup appears asking the user to permit the write operation. This doesn’t happen for java applications. Why?
Is there any way to achieve that a write operation of a Java program to a restricted folder brings up the security popup so that the user can permit access to that folder?
Thanks for your responses. According to the answers I see the following options:
Java Web Start
For me this is not an option for end users. I think that no one can expect from an ordinary end user to know what Java Web Start is, what it’s good for and how it’s used e.g. I doubt that an ordinary Windows user knows how to uninstall a Java Web Start application.
Use an exe-launcher with manifest to launch the Java application
As far as I understand this solution the exe-launcher would request extended execution right at application start. This is not exactly what I want, cause for my use case it would be sufficient to get extended rights if an update is available and not on every application start.
Perform the update operation by calling a native executable
One could call a native executable to let it perform the update operation. In this way the application would only request extended rights if an update is available. This sounds not bad but includes some native coding for Windows and doesn’t work on other platforms.
Install a launcher in program folder and the application in user home
One can place a launcher in the program folder that calls the application that is installed in the user’s home directory. In this way it would be possible to update the application in the user’s home folder.
I use InnoSetup for installing my application on Windows and as far as I can see it a split installation is hard to achieve with this installer and probably with other too.
Install the complete application in the user’s home directory
Because the user has write access to his home directory there is no problem at all. For me this looks like the best option cause of its simplicity.

If you are using inno setup compiler to generate your launcher, then you can change your app directory permission.
For example, if you need full control and want to update files under AppName/data folder
[Dirs]
Name: "{app}";
Name: "{app}\data"; Permissions: everyone-full
[Files]
Source: data\*; DestDir: {app}\data\; Flags: ignoreversion recursesubdirs createallsubdirs; Permissions: everyone-full

Unfortunately the increased permissions need to be requested when you first start the program, you cannot promote to them later. Programs that look like they do that are actually restarting themselves with the higher privs behind the scenes.
I had a problem like this a few years ago with a Java app and in the end I installed the application to the user data folder instead of program files as otherwise the auto-updating was a nightmare. You can still add it to the start menu so to a user it looks exactly like any other program.

Using "sudo" to elevate privilege (temporarily) when writing to /usr/shared/

I am developing an OSX application for school where multiple users of the same mac will able to launch the program based on shared configuration (i.e. database connection info).
By design, the normal user without administrative privilege should not be allowed to modify the configuration.
Based on unix convention, I am storing the configuration file under /usr/shared/, but this caused another problem:
- Even when logged in as administrator, application will not able to write to the location above. Users will have to launch the application with elevated privilege (using sudo) if they need to make changes to the configuration file.
My question is, whether using "sudo" to write to restricted area is a common practice in mac osx ?

I would say that using "sudo" on a Mac is only common practice for certain types of users, such as network administrators and users who like to do more than just use standard applications.
I certainly would not expect students and teachers to be using the terminal and sudo.
When developing OSX apps, Apple provides the Authorization Services, from the security framework, for the app to be able to separate privileged features from standard ones and prompt users for their credentials when required.
You will have seen this in the System Preferences panes, where you see the padlock icon. Any application can call upon these services, though I'm not sure if it's possible with Java. This is Apple's recommended method of handling a problem such as this, in addition to factoring out privileged tasks to a separate application with a function they term 'SMJobBless'.
Interestingly, the domain of your question maps directly onto Apple's described scenario of using this system for "Simple, Self-Restricted Applications".
With that being said, if only yourself or other network administrators are going to be modifying the config file, then I'd recommend leaving out any features in the app for modifying it and doing it directly with sudo and a text editor such as vi, when required.

Definitely, unless you chmod its privilege with sudo(root)

Web enabled .EXE

Is it possible for a website to automatically run an external .exe file upon visiting? That is, an .exe file that is not already on the client file system. If so how is this possible? Also, i've read about the use of HTA files or ActiveX components or Java in this process. Is it possible for a java applet to write code to a client's file system upon visiting a website? I understand this is a serious security concern, please enlighten me further. Thank you.

it's possible, the app (exe or applet) must be signed and granted permission by the user in order to run. even still the user's security policy may deny it, but it's possible..
java trusted applet info:
http://www-personal.umich.edu/~lsiden/tutorials/signed-applet/signed-applet.html
signed activex control:
http://dedjo.blogspot.com/2007/07/creating-exposing-and-signing-activex.html

It really sounds like what you need is a browser plugin;
check out FireBreath: http://firebreath.googlecode.com
it will allow you to create a c++ plugin that will run on almost any windows browser, and you can do whatever you need with it.
Note that the user will have to install the plugin/ActiveX control first, and that you need to be very careful with security considerations (i.e. make sure nobody can run arbitrary code on the remote computer)

File permissions in Android

I'm here just to ask something maybe very simple, I'm working with Files, FileOutputStream and FileInputStream, But I just want to get/set a few props from the file, I mean, the owner the file, the permissions read/write, etc.
Looking around I found the classes FileDescriptor and FilePermission but I don't have an idea of which I can use them, so I asking for some help about this; Actually I'm using the method setReadOnly() from the class File but that's now what I'm looking for.

There are a couple of issues here:
An application, by default, has unrestricted access to its own files (read/write/delete/'execute'...whatever execute means) but no access to any other application's files.
Android make it difficult to interact with other applications and their data except through Intents. Intents won't work for permissions because you're dependent on the application receiving the Intent to do/provide what you want; they probably weren't designed to tell anybody their files' permissions. There are ways around it, but only when the applications are desgned to operate in the same JVM (i.e. applications you have designed to operate in the same JVM together)
Your application can get and set permissions for its own files but cannot do that for anyone elses. To my knowledge there is no explicit concept of ownership exposed in the SDK, so you cannot find the owner of a file.
Android is based on the Linux kernel, but it's not Linux. It's been heavily optimized for running on mobile devices. If you have a machine where an application can only play in its own sandbox you can cut out things like permissions and ownership and get a smaller, faster operating system. The only permissions your files have are the one's you place (and enforce) on them. Other applications' files do not exist.

Android uses the standard Java API for handling files and file permissions. Here's a a page discussing permissions in Java.
Basically all you need to do is getting the FilePermission object of the file, then getting the PermissionCollection from the FilePermission object with the newPermissionCollection() method and then add or remove items to or from that collection.

Well...if you only want to SEE the permissions couldn't you just use "ls -l" ?