Changing Permissions for an Application

The default policy for each domain limits the permissions of J2EE deployed applications to the minimal set of permissions required for these applications to operate correctly. Do not add extra permissions to the default set (the grant block with no codebase, which applies to all code). Instead, add a new grant block with a codebase specific to the applications requiring the extra permissions, and only add the minimally necessary permissions in that block.

If you develop multiple applications that require more than this default set of permissions, you can add the custom permissions that your applications need. The com.sun.aas.instanceRoot variable refers to the domain-dir. For example:

grant "file:${com.sun.aas.instanceRoot}/applications/j2ee-apps/-" { ... }

You can add permissions to stub code with the following grant block:

grant "file:${com.sun.aas.instanceRoot}/generated/-" { ... }

In general, you should add extra permissions only to the applications or modules that require them, not to all applications deployed to a domain. For example:

grant "file:${com.sun.aas.instanceRoot}/applications/j2ee-apps/MyApp/-" { ... }

For a module:

grant "file:${com.sun.aas.instanceRoot}/applications/j2ee-modules/MyModule/-" { ... }

Do not add extra permissions to the default set (the grant block with no codebase, which applies to all code). Instead, add a new grant block with a codebase specific to the application requiring the extra permissions, and only add the minimally necessary permissions in that block.

Do not add java.security.AllPermission to the server.policy file for application code. Doing so completely defeats the purpose of the security manager, yet you still get the performance overhead associated with it.

As noted in the J2EE specification, an application should provide documentation of the additional permissions it needs. If an application requires extra permissions but does not document the set it needs, contact the application author for details.

As a last resort, you can iteratively determine the permission set an application needs by observing AccessControlException occurrences in the server log. If this is not sufficient, you can add the -Djava.security.debug=failure JVM option to the domain. For details, see the Sun Java System Application Server Enterprise Edition 8.2 Administration Guide or the Sun Java System Application Server Enterprise Edition 8.2 Administration Reference.

You can use the J2SE standard policytool or any text editor to edit the server.policy file. For more information, see:

http://java.sun.com/docs/books/tutorial/security1.2/tour2/index.html

For detailed information about the permissions you can set in the server.policy file, see:

http://java.sun.com/j2se/1.4/docs/guide/security/permissions.html

The Javadoc for the Permission class is at:

http://java.sun.com/j2se/1.4/docs/api/java/security/Permission.html