2.4. Run JBoss EAP 6 Within the Java Security Manager

Procedure 2.2. Configure the Java Security Manager for JBoss EAP 6

1. Open the Configuration File

   Open the configuration file for editing. The configuration file you need to edit depends on whether you use a Managed Domain or standalone server, as well as your operating system.

   • Managed Domain

     • For Linux: EAP_HOME/bin/domain.conf
     • For Windows: EAP_HOME\bin\domain.conf.bat

   • Standalone Server

     • For Linux: EAP_HOME/bin/standalone.conf
     • For Windows: EAP_HOME\bin\standalone.conf.bat

2. Enable the Java Security Manager

   Use one of the methods below to enable the Java Security Manager:
   • Use the -secmgr option with your JBoss EAP 6 server startup script.
   • Uncomment the SECMGR="true" line in the configuration file:

     • On Linux:

       # Uncomment this to run with a security manager enabled
       SECMGR="true"

     • On Windows:

       rem # Uncomment this to run with a security manager enabled
       set "SECMGR=true"

3. Specify the Java Security Policy

   You can use -Djava.security.policy to specify the exact location of your security policy. It should go onto one line only, with no line break. Using == when setting -Djava.security.policy specifies that the security manager will use only the specified policy file. Using = specifies that the security manager will use the specified policy combined with the policy set in the policy.url section of JAVA_HOME/lib/security/java.security.
   In your relevant JBoss EAP 6 configuration file, add your security policy Java options. If you are using a Managed Domain, ensure that this is inserted before where PROCESS_CONTROLLER_JAVA_OPTS and HOST_CONTROLLER_JAVA_OPTS are set.

   • On Linux:

     JAVA_OPTS="$JAVA_OPTS -Djava.security.policy==$JBOSS_HOME/bin/server.policy -Djboss.home.dir=$JBOSS_HOME"

   • On Windows:

     set "JAVA_OPTS=%JAVA_OPTS% -Djava.security.policy==%JBOSS_HOME%\bin\server.policy -Djboss.home.dir=%JBOSS_HOME%"

4. Start the Domain or Server

   Start the domain or server as normal.