|
||||||||||
| PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
| SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD | |||||||||
java.lang.Objectjava.security.Policy
net.jini.security.policy.DynamicPolicyProvider
com.sun.jini.tool.DebugDynamicPolicyProvider
Defines a DynamicPolicy that logs information about missing
permissions, and optionally grants all permissions, which is FOR
DEBUGGING ONLY. Do not use this security policy to grant all permissions
in a production environment.
This class is intended to simplify the process of deciding what security permissions to grant to run an application. The usual approach to choosing which permissions to grant is to start by running the application with an empty security policy file. When the application fails with an exception message that identifies a missing permission, add that permission to the security policy file, and repeat the process. Although straight forward, this process can be time consuming if the application requires many permission grants.
Another approach is to set the value of the
"java.security.debug" system property to
"access,failure", which produces debugging output that
describes permission grants and failures. Unfortunately, this approach
produces voluminous output, making it difficult to determine which
permission grants are needed.
This security policy permits another, hopefully more convenient, approach. When this class is specified as the security policy, and granting all permissions is enabled, it uses the standard dynamic security policy to determine what permissions are granted. If a permission is not granted by the standard policy, though, then rather than denying permission, this class logs the missing permission in the form required by the security policy file, and grants the permission, allowing the program to continue. In this way, developers can determine the complete set of security permissions required by the application.
Note that the information printed by this security policy may not be in the
form you wish to use in your policy file. In particular, using system
property substitutions and KeyStore aliases may produce a more
portable file than one containing the exact entries logged. Note, too, that
the information printed for signedBy fields specifies the
principal name for X.509 certificates, rather than the
KeyStore alias, which is not a valid security policy file
format.
Using this security policy without granting all permissions is also useful since it prints information about security exceptions that were caught, but that might have an affect on program behavior.
This class uses uses the Logger named
net.jini.security.policy to log information at the following
levels:
WARNING - Permissions that were needed but not
granted by the policy file.
FINE - Also include stack traces.
FINER - All permissions granted, with stack traces
for ones not granted by the policy file, and dynamic grants.
FINEST - All permissions granted, with all stack
traces, and dynamic grants. jre/lib/security/security/java.security file to contain the
line:
or create a separate file with containing that line and specify it as the value of thepolicy.provider=com.sun.jini.tool.DebugDynamicPolicyProvider
java.security.properties system property.
com.sun.jini.tool.DebugDynamicPolicyProvider.grantAll security
property to true by adding the following line to the security
properties file:
com.sun.jini.tool.DebugDynamicPolicyProvider.grantAll=true
Granting all permissions is disabled by default.
Make sure to specify a security manager, either by setting the
java.security.manager system property, or putting the following
code in the main method of the application:
if (System.getSecurityManager() == null) {
System.setSecurityManager(new SecurityManager());
}
| Constructor Summary | |
DebugDynamicPolicyProvider()
Creates an instance of this class that wraps a default underlying policy, as specified by DynamicPolicyProvider(). |
|
DebugDynamicPolicyProvider(java.security.Policy basePolicy)
Creates an instance of this class that wraps around the given non- null base policy object. |
|
| Method Summary | |
void |
grant(java.lang.Class cl,
java.security.Principal[] principals,
java.security.Permission[] permissions)
Log calls. |
boolean |
implies(java.security.ProtectionDomain pd,
java.security.Permission perm)
Always returns true, but logs unique requests |
| Methods inherited from class net.jini.security.policy.DynamicPolicyProvider |
getGrants, getPermissions, getPermissions, grantSupported, refresh |
| Methods inherited from class java.security.Policy |
getPolicy, setPolicy |
| Methods inherited from class java.lang.Object |
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
| Constructor Detail |
public DebugDynamicPolicyProvider()
throws net.jini.security.policy.PolicyInitializationException
DynamicPolicyProvider().
net.jini.security.policy.PolicyInitializationException - if unable to construct the base
policy
java.lang.SecurityException - if there is a security manager and the calling
context does not have adequate permissions to read the
net.jini.security.policy.DynamicPolicyProvider.basePolicyClass
security property, or if the calling context does not
have adequate permissions to access the base policy classpublic DebugDynamicPolicyProvider(java.security.Policy basePolicy)
null base policy object.
basePolicy - base policy object containing information about
non-dynamic grants
java.lang.NullPointerException - if basePolicy is
null| Method Detail |
public void grant(java.lang.Class cl,
java.security.Principal[] principals,
java.security.Permission[] permissions)
public boolean implies(java.security.ProtectionDomain pd,
java.security.Permission perm)
|
||||||||||
| PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
| SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD | |||||||||