client.policy file permissions


Java2 security uses several policy files to determine the granted permission for each Java program.

For the list of available policy files that are supported by WAS, see Java 2 security policy files.

This file contains these default permissions:

grant codeBase "file:${was.install.root}/java/ext/*" {
  permission java.security.AllPermission;
};


// JDK classes grant codeBase "file:${was.install.root}/java/ext/-" {
  permission java.security.AllPermission;
}; grant codeBase "file:${was.install.root}/java/tools/ibmtools.jar" {
  permission java.security.AllPermission;
}; grant codeBase "file:/QIBM/ProdData/Java400/jdk14/lib/tools.jar" {
  permission java.security.AllPermission;
};


// WebSphere system classes grant codeBase "file:${was.install.root}/lib/-" {
  permission java.security.AllPermission;
}; grant codeBase "file:${was.install.root}/plugins/-" {
  permission java.security.AllPermission;
}; grant codeBase "file:${was.install.root}/classes/-" {
  permission java.security.AllPermission;
}; grant codeBase "file:${was.install.root}/installedConnectors/-" {
  permission java.security.AllPermission;
}; grant codeBase "file:${user.install.root}/installedConnectors/-" {
  permission java.security.AllPermission;
};
 grant codeBase "file:${was.install.root}/installedChannels/-" {
  permission java.security.AllPermission;
};


// J2EE 1.4 permissions for client container WAS applications 

// in $WAS_HOME/installedApps grant codeBase "file:${user.install.root}/installedApps/-" {
  
//Application client permissions
  permission java.awt.AWTPermission "accessClipboard";
  permission java.awt.AWTPermission "accessEventQueue";
  permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
  permission java.lang.RuntimePermission "exitVM";
  permission java.lang.RuntimePermission "loadLibrary";
  permission java.lang.RuntimePermission "queuePrintJob";
  permission java.net.SocketPermission "*", "connect";
  permission java.net.SocketPermission "localhost:1024-", "accept,listen";
  permission java.io.FilePermission "*", "read,write";
  permission java.util.PropertyPermission "*", "read";

};


// J2EE 1.4 permissions for client container - expanded ear file code base grant codeBase "file:${com.ibm.websphere.client.applicationclient.archivedir}/-" {
  permission java.awt.AWTPermission "accessClipboard";
  permission java.awt.AWTPermission "accessEventQueue";
  permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
  permission java.lang.RuntimePermission "exitVM";
  permission java.lang.RuntimePermission "loadLibrary";
  permission java.lang.RuntimePermission "queuePrintJob";
  permission java.net.SocketPermission "*", "connect";
  permission java.net.SocketPermission "localhost:1024-", "accept,listen";
  permission java.io.FilePermission "*", "read,write";
  permission java.util.PropertyPermission "*", "read";
};

All of the client containers and applets on the local node are granted the updated permissions when they start. If some client containers or applets on a node require permissions that are not defined as defaults in the java.policy file and the default client.policy file, update the client.policy file. The missing permission creates the java.security.AccessControlException exception. The missing permission is listed in the exception data, for example,

java.security.AccessControlException: access denied (java.io.FilePermission
C:\WebSphere\AppServer\java\jre\lib\ext\mail.jar read)

The previous two lines of sample code are one continuous line, but presented as such for illustrative purposes only.

When a client program receives this exception and adding this permission is justified, add a permission to the client.policy file, for example, grant codebase "file:user_client_installed_location" { permission java.io.FilePermission "C:\WebSphere\AppServer\java\jre\lib\ext\mail.jar", "read"; };.

To decide whether to add a permission, refer to Access control exception.

If we update the policy file, restart the browser and any client applications.



 

Related concepts


Access control exception

 

Related tasks


Migrating, coexisting, and interoperating – Security considerations
Set static policy files in Java 2 security

 

Related


app.policy file permissions
server.policy file permissions
filter.policy file permissions
java.policy file permissions
Java 2 security policy files