Few Java programmers truly enjoy dealing with permissions and polcies.
When using RMI, I would often come across examples that essentially told
you what to do to grant all permissions to every class used. This
is not the optimal situation; this is more of a throwback to the Java 1.1
security model of all or nothing. We're likely to see many improvements
as Java continues to evolve.
But in the mean time, we have policytool. This is a rudimentary GUI interface for editing policy files.
- Apparently, the book authors are not terribly excited about policytool. Not only did their comments cast a shadow on the GUI, but they also failed to tell you how to start it.
- I went to the \bin\ directory of my JDK implementation and entered policytool. Here's what I got:
Nothing too sexy. So I chose File-Open, found the java.policy file, and it looks like this:
Again, nothing too sexy. So I decided to make my own file.
File-New
File-Save As brandan.policy
Then I chose to add a new FilePermission to all classes in the fantasy
jar file brandan.jar:
And I gave it the SQL setLog permission, whatever that does. :)
Then I realized the darned thing outsmarted me. I attempted to get the source of the brandan.policy file. But when I clicked "Done", it informed me that there is no file "brandan.jar" and it did not add these entries to my file.
Sooooo, I gave it a directory for an old project which I am no longer using. The brandan.policy file now looks like this:
/* AUTOMATICALLY GENERATED ON Wed Apr 23 01:48:04 EDT 2003*/
/* DO NOT EDIT */
grant codeBase "file:C:\Projects\Chapter4\" {
permission java.io.FilePermission "<<ALL FILES>>",
"write, read, delete";
permission java.sql.SQLPermission "setLog";
};
Thankfully it told me not to edit this file. I suppose that's because it thinks I like policytool.
Kidding aside, policytool does have its merits:
- You don't have to remember syntax.
- You don't have to remember the names of the classes or their properties, since they are provided for you in the file.
- Generally, this helps you prevent making syntax errors.