6.5. Java Security Policy Statements

A policy file specifies permissions to modules and deployed applications. Permissions are applied to deployed applications via the VFS protocol. See the following Oracle Java SE documentation page Default Policy Implementation and Policy File Syntax for further information at http://docs.oracle.com/javase/7/docs/technotes/guides/security/PolicyFiles.html

The following is an example of policy statements.

// Grant all to the jboss-modules.jar
grant codeBase "file:${jboss.home.dir}/jboss-modules.jar" {
  permission java.security.AllPermission;
};

// Standard extensions get all permissions by default
grant codeBase "file:${{java.ext.dirs}}/*" {
	permission java.security.AllPermission;
};

// Grant read PropertyPermission for all properties to a deployed EJB application
grant codeBase "vfs:/content/ejb-app.jar" {
  permission java.util.PropertyPermission "*", "read";
};

// Grant read FilePermission for all files to a web application
grant codeBase "vfs:/content/myapp.war/-" {
  permission java.io.FilePermission "/-", "read";
};

// Grant all to the jboss-modules.jar
grant codeBase "file:${jboss.home.dir}/jboss-modules.jar" {
  permission java.security.AllPermission;
};

// Standard extensions get all permissions by default
grant codeBase "file:${{java.ext.dirs}}/*" {
	permission java.security.AllPermission;
};

// Grant read PropertyPermission for all properties to a deployed EJB application
grant codeBase "vfs:/content/ejb-app.jar" {
  permission java.util.PropertyPermission "*", "read";
};

// Grant read FilePermission for all files to a web application
grant codeBase "vfs:/content/myapp.war/-" {
  permission java.io.FilePermission "/-", "read";
};

Copy to Clipboard

Toggle word wrap

Note

On Microsoft Windows Server, when specifying a FilePermission statement including a file path in a string, not a codeBase URL, you must replace single backslash characters with two backslash characters. This is because when file paths are parsed, a single backslash is interpreted as an escape character.

Note

Two VFS issues currently exist in JBoss EAP that require a workaround:

If you define a grant for a deployment on Microsoft Windows, instead of:
```
grant codeBase "vfs:/content/..." {
```
```
grant codeBase "vfs:/content/..." {
```
Copy to Clipboard Toggle word wrap
you must use:
```
grant codeBase "vfs:/${user.dir}/content/..." {
```
```
grant codeBase "vfs:/${user.dir}/content/..." {
```
Copy to Clipboard Toggle word wrap

If your application contains JSPs, then the permissions granted to the deployment using a VFS URL is not sufficient, and you will have to duplicate it with file-based URL. For example, if you have permission:

grant codeBase "vfs:/content/application.war/-" {
  permission java.util.PropertyPermission "*", "read";
};

grant codeBase "vfs:/content/application.war/-" {
  permission java.util.PropertyPermission "*", "read";
};

Copy to Clipboard

Toggle word wrap

then you also need to add the following:

grant codeBase "file:${jboss.home.dir}/standalone/tmp/work/jboss.web/default-host/application/-" {
  permission java.util.PropertyPermission "*", "read";
};

grant codeBase "file:${jboss.home.dir}/standalone/tmp/work/jboss.web/default-host/application/-" {
  permission java.util.PropertyPermission "*", "read";
};

Copy to Clipboard

Toggle word wrap

Module permissions are defined in module.xml (version 1.2 or higher). The following example demonstrates specifying module permissions.

<module xmlns="urn:jboss:module:1.2" name="org.jboss.custom.module">
 <permissions>
  <grant permission="java.io.FilePermission" name="/-" actions="read"/>
  <grant permission="java.lang.RuntimePermission" name="org.jboss.*"/>
 </permissions>

 <resources>
  <resource-root path="custom-module.jar" />
 </resources>
</module>

<module xmlns="urn:jboss:module:1.2" name="org.jboss.custom.module">
 <permissions>
  <grant permission="java.io.FilePermission" name="/-" actions="read"/>
  <grant permission="java.lang.RuntimePermission" name="org.jboss.*"/>
 </permissions>

 <resources>
  <resource-root path="custom-module.jar" />
 </resources>
</module>

Copy to Clipboard

Toggle word wrap

If there is no <permissions/> element, then AllPermission permission is granted to the module. If there is an empty <permissions/> element, then no permission is granted.

Report a bug

返回顶部

此内容没有您所选择的语言版本。

6.5. Java Security Policy Statements

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links