java.policy file permissions

Java2 security uses several policy files to determine the granted permission for each Java program.

See Java 2 security policy files for the list of available policy files that are supported by WAS.

The java.policy file is a global default policy file that is shared by all of the Java programs that run in the JVM on the node. A change to the java.policy file is local for the node. The default Java policy is picked up automatically. Syntax errors in the policy files cause the application server to fail. An updated java.policy file is applied to all the Java programs that run in all the JVMs on the local node. Restart the programs for the updates to take effect. Modifying this file is not recommended. If a specific change is required to some of the Java programs on a node and the java.policy file requires updating, carefully modify the java.policy file with the policy tool.

See Use PolicyTool to edit policy files for Java 2 security.

 

Default permissions for the java.policy file

The java.policy file is not a configuration file that is managed by the repository and the file replication service. Changes to this file are local and do not get replicated to the other machine. The java.policy file that is supplied by WAS is located at install_root/java/jre/lib/security/java.policy. This file contains these default permissions.

// Standard extensions get all permissions by default grant codeBase "file:${java.home}/lib/ext/*" {
        permission java.security.AllPermission;
};

// default permissions granted to all domains grant {
        
// Allows any thread to stop itself using the java.lang.Thread.stop()
        
// method that takes no argument.
        
// Note that this permission is granted by default only to remain
        
// backwards compatible.
        
// It is strongly recommended that you either remove this permission
        
// from this policy file or further restrict it to code sources
        
// specified, because Thread.stop() is potentially unsafe.
        
// See "http://java.sun.com/notes" for more information.
        
// permission java.lang.RuntimePermission "stopThread";

        
// allows anyone to listen on un-privileged ports
        permission java.net.SocketPermission "localhost:1024-", "listen";

        
// "standard" properties that can be read by anyone

        permission java.util.PropertyPermission "java.version", "read";
        permission java.util.PropertyPermission "java.vendor", "read";
        permission java.util.PropertyPermission "java.vendor.url", "read";
        permission java.util.PropertyPermission "java.class.version", "read";
        permission java.util.PropertyPermission "os.name", "read";
        permission java.util.PropertyPermission "os.version", "read";
        permission java.util.PropertyPermission "os.arch", "read";
        permission java.util.PropertyPermission "file.separator", "read";
        permission java.util.PropertyPermission "path.separator", "read";
        permission java.util.PropertyPermission "line.separator", "read";

        permission java.util.PropertyPermission "java.specification.version", "read";
        permission java.util.PropertyPermission "java.specification.vendor", "read";
        permission java.util.PropertyPermission "java.specification.name", "read";

        permission java.util.PropertyPermission "java.vm.specification.version","read";
        permission java.util.PropertyPermission "java.vm.specification.vendor","read";
        permission java.util.PropertyPermission "java.vm.specification.name", "read";
        permission java.util.PropertyPermission "java.vm.version", "read";
        permission java.util.PropertyPermission "java.vm.vendor", "read";
        permission java.util.PropertyPermission "java.vm.name", "read";
       };

If some Java programs on a node require permissions that are not defined as defaults in the java.policy file, consider updating the java.policy file. Most of the time, other policy files are updated instead of the java.policy file. The missing permission causes the creation of the , java.security.AccessControlException exception. The missing permission is listed in the exception data. For example:

java.security.AccessControlException: access denied (java.io.FilePermission C:\WebSphere\AppServer\java\jre\lib\ext\mail.jar read)

The previous two lines are one continuous line.

When a Java program receives this exception and adding this permission is justified, add a permission to the java.policy file. For example:

grant codeBase "file:user_client_installed_location" {    permission java.io.FilePermission 
"C:\WebSphere\AppServer\java\jre\lib\ext\mail.jar", "read"; };

To decide whether to add a permission, refer to Access control exception.

Restart all of the Java processes for the updated java.policy file to take effect.

---

 

Related concepts

Access control exception

 

Related tasks

Migrating, coexisting, and interoperating – Security considerations
Use PolicyTool to edit policy files for Java 2 security
Set static policy files in Java 2 security

 

Related

app.policy file permissions
server.policy file permissions
client.policy file permissions
filter.policy file permissions
Java 2 security policy files