Java 2 security uses several policy files to determine the granted permission for each Java program.
This file contains these default permissions:
grant codeBase "file:${was.install.root}/java/ext/*" {
permission java.security.AllPermission;
};
// JDK classes
grant codeBase "file:${was.install.root}/java/ext/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/java/tools/ibmtools.jar" {
permission java.security.AllPermission;
};
grant codeBase "file:/QIBM/ProdData/Java400/jdk14/lib/tools.jar" {
permission java.security.AllPermission;
};
// WebSphere system classes
grant codeBase "file:${was.install.root}/lib/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/plugins/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/classes/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/installedConnectors/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${user.install.root}/installedConnectors/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/installedChannels/-" {
permission java.security.AllPermission;
};
// J2EE 1.4 permissions for client container applications
// in $WAS_HOME/installedApps
grant codeBase "file:${user.install.root}/installedApps/-" {
//Application client permissions
permission java.awt.AWTPermission "accessClipboard";
permission java.awt.AWTPermission "accessEventQueue";
permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
permission java.lang.RuntimePermission "exitVM";
permission java.lang.RuntimePermission "loadLibrary";
permission java.lang.RuntimePermission "queuePrintJob";
permission java.net.SocketPermission "*", "connect";
permission java.net.SocketPermission "localhost:1024-", "accept,listen";
permission java.io.FilePermission "*", "read,write";
permission java.util.PropertyPermission "*", "read";
};
// J2EE 1.4 permissions for client container - expanded ear file code base
grant codeBase "file:${com.ibm.websphere.client.applicationclient.archivedir}/-" {
permission java.awt.AWTPermission "accessClipboard";
permission java.awt.AWTPermission "accessEventQueue";
permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
permission java.lang.RuntimePermission "exitVM";
permission java.lang.RuntimePermission "loadLibrary";
permission java.lang.RuntimePermission "queuePrintJob";
permission java.net.SocketPermission "*", "connect";
permission java.net.SocketPermission "localhost:1024-", "accept,listen";
permission java.io.FilePermission "*", "read,write";
permission java.util.PropertyPermission "*", "read";
};
grant codeBase "file:${was.install.root}/java/ext/*" {
permission java.security.AllPermission;
};
// JDK classes
grant codeBase "file:${was.install.root}/java/ext/-" {
permission java.security.AllPermission;
};
// Allow to use additional ibm jdk extensions with j9
grant codeBase "file:${was.install.root}/java/extj9/-" {
permission java.security.AllPermission;
};
// Allow to use sun and ibm tools
grant codeBase "file:${was.install.root}/java/tools/-" {
permission java.security.AllPermission;
};
// WebSphere system classes
grant codeBase "file:${was.install.root}/lib/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/plugins/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/classes/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/installedConnectors/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${user.install.root}/installedConnectors/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/installedChannels/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${was.install.root}/util/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${user.install.root}/lib/-" {
permission java.security.AllPermission;
};
grant codeBase "file:${user.install.root}/classes/-" {
permission java.security.AllPermission;
};
// J2EE 1.4 permissions for client container applications in $WAS_HOME/installedApps
grant codeBase "file:${user.install.root}/installedApps/-" {
//Application client permissions
permission java.awt.AWTPermission "accessClipboard";
permission java.awt.AWTPermission "accessEventQueue";
permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
permission java.lang.RuntimePermission "exitVM";
permission java.lang.RuntimePermission "loadLibrary";
permission java.lang.RuntimePermission "queuePrintJob";
permission java.net.SocketPermission "*", "connect";
permission java.net.SocketPermission "localhost:1024-", "accept,listen";
permission java.io.FilePermission "*", "read,write";
permission java.util.PropertyPermission "*", "read";
};
// J2EE 1.4 permissions for client container - expanded ear file code base
grant codeBase "file:${com.ibm.websphere.client.applicationclient.archivedir}/-" {
permission java.awt.AWTPermission "accessClipboard";
permission java.awt.AWTPermission "accessEventQueue";
permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
permission java.lang.RuntimePermission "exitVM";
permission java.lang.RuntimePermission "loadLibrary";
permission java.lang.RuntimePermission "queuePrintJob";
permission java.net.SocketPermission "*", "connect";
permission java.net.SocketPermission "localhost:1024-", "accept,listen";
permission java.io.FilePermission "*", "read,write";
permission java.util.PropertyPermission "*", "read";
};
All of the client containers and applets on the local node are granted the updated permissions when they start. If some client containers or applets on a node require permissions that are not defined as defaults in the java.policy file and the default client.policy file, update the client.policy file. The missing permission creates the java.security.AccessControlException exception. The missing permission is listed in the exception data, for example,
java.security.AccessControlException: access denied (java.io.FilePermission C:\WebSphere\AppServer\java\jre\lib\ext\mail.jar read)
java.security.AccessControlException: access denied (java.io.FilePermission app_server_root/Base/lib/mail-impl.jar read)
The previous two lines of the example are one continuous line, but presented as such for illustrative purposes only.
grant codebase "file:user_client_installed_location" {permission
java.io.FilePermission "C:\WebSphere\AppServer\java\jre\lib\ext\mail.jar", "read"; };
grant codebase "file:user_client_installed_location" { permission
java.io.FilePermission "app_server_root/lib/mail-impl.jar", "read"; };
To decide whether to add a permission, refer to Access control exception for Java 2 security.
If you update the policy file, you must restart the browser and any client applications.