Network Deployment (Distributed operating systems), v8.0 > Develop and deploying applications > Develop security > Develop extensions to the WebSphere security infrastructure > Develop applications that use programmatic security > Protect system resources and APIs (Java 2 security) for developing applications > Configure Java 2 security policy files

Add the was.policy file to applications for Java 2 security

An application might need a was.policy file if it accesses resources that require more permissions than those granted in the default app.policy file. When Java 2 security is enabled for a WAS, all the applications that run on WAS undergo a security check before accessing system resources. An application might need a was.policy file if it accesses resources that require more permissions than those granted in the default app.policy file. By default, the product security reads an app.policy file that is located in each node and grants the permissions in the app.policy file to all the applications. Include any additional required permissions in the was.policy file. The was.policy file is only required if an application requires additional permissions.

The default policy file for all applications is specified in the app.policy file. This file is provided by the product security, is common to all applications, and you do not change this file. Add any new permissions that are required for an application in the was.policy file.

The app.policy file supplied by WAS resides at WAS_HOME/config/cells/profile/profile_name/config/cell_name/nodes/node_name/app.policy. The contents of the app.policy file are presented in the following example:

In the following code sample, the two permissions that are required by JavaMail are split onto two lines for illustration only. You actually enter the permission on one line.

// The following permissions apply to all the components under the application.

grant codeBase "file:${application}" {
   // The following are required by JavaMail

  permission java.io.FilePermission "
        ${was.install.root}${/}lib${/}activation-impl.jar", "read";

  permission java.io.FilePermission "
        ${was.install.root}${/}lib${/}mail-impl.jar","read";

  };
   // The following permissions apply to all utility .jar files  (other
   //  than enterprise beans JAR files) in the application.
grant codeBase "file:${jars}" {
  permission java.net.SocketPermission "*", "connect";
  permission java.util.PropertyPermission "*", "read";
};

// The following permissions apply to connector resources within the application grant codeBase "file:${connectorComponent}" {
  permission java.net.SocketPermission "*", "connect";
  permission java.util.PropertyPermission "*", "read";
};

// The following permissions apply to all the web modules (.war files)
// within the application.
grant codeBase "file:${webComponent}" {
  permission java.io.FilePermission "${was.module.path}${/}-", "read, write";
       //  where "was.module.path" is the path where the web module is
       //  installed. Refer to Dynamic policy concepts for other symbols.
  permission java.lang.RuntimePermission "loadLibrary.*";
  permission java.lang.RuntimePermission "queuePrintJob";
  permission java.net.SocketPermission "*", "connect";
  permission java.util.PropertyPermission "*", "read";
};

// The following permissions apply to all the EJB modules within the application.
grant codeBase "file:${ejbComponent}" {
 permission java.lang.RuntimePermission "queuePrintJob";
 permission java.net.SocketPermission "*", "connect";
 permission java.util.PropertyPermission "*", "read";
};

If additional permissions are required for an application or for one or more modules of an application, use the was.policy file for that application. For example, use codeBase of ${application} and add required permissions to grant additional permissions to the entire application. Similarly, use codeBase of ${webComponent} and ${ejbComponent} to grant additional permissions to all the web modules and all the enterprise bean modules in the application. We can assign additional permissions to each module (.war file or .jar file), as shown in the following example.

This example illustrates adding extra permissions for an application in the was.policy file:

In the following code sample, the permission for the EJB module was split onto two lines for illustration only. You actually enter the permission on one line.

// grant additional permissions to a web module
grant codeBase " file:aWebModule.war" {
 permission java.security.SecurityPermission "printIdentity";
};

// grant additional permission to an EJB module
grant codeBase "file:aEJBModule.jar"  {
    permission java.io.FilePermission "
       ${user.install.root}${/}bin${/}DefaultDB${/}-", "read,write,delete";
    // where, ${user.install.root} is the system property whose value is
    // located in the WAS_HOME directory.
 };

To use a was.policy file for the application, perform the following steps:

Procedure

1. Create a was.policy file using the policy tool. For more information on using the policy tool, see Use PolicyTool to edit policy files for Java 2 security.

2. Add the required permissions in the was.policy file using the policy tool.
3. Place the was.policy file in the application enterprise archive (EAR) file under the META-INF directory. Update the application EAR file with the newly created was.policy file by using the jar command.

4. Verify that the was.policy file is inserted and start an assembly tool.

5. Verify that the was.policy file in the application is syntactically correct. In an assembly tool, right-click the enterprise application module and click Run Validation.

Results

An application EAR file is now ready to run when Java 2 security is enabled.

Example

This step is required for applications to run properly when Java 2 security is enabled. If the was.policy file is not created and it does not contain required permissions, the application might not access system resources.

The symptom of the missing permissions is the java.security.AccessControlException exception. The missing permission is listed in the exception data, for example,

When an application program receives this exception and adding this permission is justified, include the permission in the was.policy file, for example,

The previous permission information lines are split for the illustration. Enter the permission on one line.

What to do next

Install the application.
Java EE connector security
Configure Java 2 security policy files

Related

Java 2 security policy files
Security: Resources for learning

+

Search Tips   |   Advanced Search