com.sun.jini.tool
Class DebugDynamicPolicyProvider

java.lang.Object
  extended byjava.security.Policy
      extended bynet.jini.security.policy.DynamicPolicyProvider
          extended bycom.sun.jini.tool.DebugDynamicPolicyProvider
All Implemented Interfaces:
net.jini.security.policy.DynamicPolicy

public class DebugDynamicPolicyProvider
extends net.jini.security.policy.DynamicPolicyProvider

Defines a DynamicPolicy that logs information about missing permissions, and optionally grants all permissions, which is FOR DEBUGGING ONLY. Do not use this security policy to grant all permissions in a production environment.

This class is intended to simplify the process of deciding what security permissions to grant to run an application. The usual approach to choosing which permissions to grant is to start by running the application with an empty security policy file. When the application fails with an exception message that identifies a missing permission, add that permission to the security policy file, and repeat the process. Although straight forward, this process can be time consuming if the application requires many permission grants.

Another approach is to set the value of the "java.security.debug" system property to "access,failure", which produces debugging output that describes permission grants and failures. Unfortunately, this approach produces voluminous output, making it difficult to determine which permission grants are needed.

This security policy permits another, hopefully more convenient, approach. When this class is specified as the security policy, and granting all permissions is enabled, it uses the standard dynamic security policy to determine what permissions are granted. If a permission is not granted by the standard policy, though, then rather than denying permission, this class logs the missing permission in the form required by the security policy file, and grants the permission, allowing the program to continue. In this way, developers can determine the complete set of security permissions required by the application.

Note that the information printed by this security policy may not be in the form you wish to use in your policy file. In particular, using system property substitutions and KeyStore aliases may produce a more portable file than one containing the exact entries logged. Note, too, that the information printed for signedBy fields specifies the principal name for X.509 certificates, rather than the KeyStore alias, which is not a valid security policy file format.

Using this security policy without granting all permissions is also useful since it prints information about security exceptions that were caught, but that might have an affect on program behavior.

This class uses uses the Logger named net.jini.security.policy to log information at the following levels:

To use this security policy, do the following:

Granting all permissions is disabled by default.

Make sure to specify a security manager, either by setting the java.security.manager system property, or putting the following code in the main method of the application:

 if (System.getSecurityManager() == null) {
     System.setSecurityManager(new SecurityManager());
 }
 

Author:
Tim Blackman <tjb@jini.org>

Constructor Summary
DebugDynamicPolicyProvider()
          Creates an instance of this class that wraps a default underlying policy, as specified by DynamicPolicyProvider().
DebugDynamicPolicyProvider(java.security.Policy basePolicy)
          Creates an instance of this class that wraps around the given non-null base policy object.
 
Method Summary
 void grant(java.lang.Class cl, java.security.Principal[] principals, java.security.Permission[] permissions)
          Log calls.
 boolean implies(java.security.ProtectionDomain pd, java.security.Permission perm)
          Always returns true, but logs unique requests
 
Methods inherited from class net.jini.security.policy.DynamicPolicyProvider
getGrants, getPermissions, getPermissions, grantSupported, refresh
 
Methods inherited from class java.security.Policy
getPolicy, setPolicy
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

DebugDynamicPolicyProvider

public DebugDynamicPolicyProvider()
                           throws net.jini.security.policy.PolicyInitializationException
Creates an instance of this class that wraps a default underlying policy, as specified by DynamicPolicyProvider().

Throws:
net.jini.security.policy.PolicyInitializationException - if unable to construct the base policy
java.lang.SecurityException - if there is a security manager and the calling context does not have adequate permissions to read the net.jini.security.policy.DynamicPolicyProvider.basePolicyClass security property, or if the calling context does not have adequate permissions to access the base policy class

DebugDynamicPolicyProvider

public DebugDynamicPolicyProvider(java.security.Policy basePolicy)
Creates an instance of this class that wraps around the given non-null base policy object.

Parameters:
basePolicy - base policy object containing information about non-dynamic grants
Throws:
java.lang.NullPointerException - if basePolicy is null
Method Detail

grant

public void grant(java.lang.Class cl,
                  java.security.Principal[] principals,
                  java.security.Permission[] permissions)
Log calls.


implies

public boolean implies(java.security.ProtectionDomain pd,
                       java.security.Permission perm)
Always returns true, but logs unique requests



Copyright © 2003 Sun Microsystems, Inc. All Rights Reserved.