---- As we all know, Java language has a perfect security framework, from programming language, compiler, interpreter to Java virtual machine, can ensure that Java system is not invalidated or hostile compiler, basically, It is guaranteed that the Java code operates in a scheduled rule. However, when we need to pass these restrictions, for example, read and write files, listening, and reading Sockets, exiting Java systems, etc., you must use a digital signature or security policy file (* .policy). ---- In an enterprise internal network, this paper proposes a simple way to use the security policy file to set Java program permissions. Due to the location, utility and security of each computer in the internal network, it is more convenient to use the security policy file to set the Java permissions, software installation, setting, upgrade, and migration, but also, and numbers. The signature is used in conjunction, and more importantly, you can subdivide the permissions of each Java program, which is flexible and convenient. I. Concept of security policies in Java - the security policy of the Java application environment, detail the license for different resources owned by different code, is expressed by a policy object. In order to allow Applets (or running an application in SecurityManager) to perform protected behaviors, such as reading and writing, Applets, the APPLET (or Java application) must obtain the license for the operation, the security policy file is used to implement these licenses . ---- Policy object may have multiple entities, although there can be only a role at all times. The currently installed Policy object, can be changed by calling the getPolicy method in the program or by calling the setPolicy method. Policy object evaluates the entire policy, returns an appropriate Permissions object, detail those that can access those resources. ---- Policy file can be stored in a formatable ASCII file, or binary files of the Policy class, or in the database. This article only discusses the form of a formatted ASCII file. II. POLICY file format ---- In order to better understand the following, it is recommended to refer to /jdk1.2/jre/lib/security/java.policy file and /jdk1.2/jre/lib/security/java.policy file The content of the security / java.security file. ---- 1. The syntax format of the Policy file and the description ---- a policy file is essentially a record list, which may contain a "keystore" record, and contain zero or more "GRANT" records. The format is as follows: keystore "some_keystore_url", "keystore_type"; grant [SignedBy "signer_names"] [, CodeBase "URL"] {Permission permission_class_name [ "target_name"] [, "action"] [, SignedBy "signer_names"]; Permission ...}; ---- 1.1 "KeyStore" Record ---- a KeyStore is a private key (private key) database and a corresponding digital signature, such as an X.509 certificate. There may be only one KeyStore record in the policy file (or may not contain this record), which can appear anywhere other than the GRANT record in the file.
The keystores specified in the Policy profile are used to find the public key of the signature, if any GRANT record specifies the signator (signer_names), then the KeyStore record must appear in the Policy configuration file. ---- "Some_KeyStore_URL" means the keystore's URL location, "KeyStore_Type" means the type of KeyStore. The second option is optional, if not specified, the type assumes that it is determined by the "KeyStore.Type" property in the secure properties file (java.security). The KeyStore type defines the storage and data format of KeyStore information, which is used to protect the algorithm of private key and KeyStore integrity in KeyStore. The default type supported by Sun Microsystems is "JKS". ---- 1.2 "Grant" Record ---- Each Grant record in the Policy file contains a CODESource and its Permission (license). ---- Each grant record in the Policy file follows the following format to keep the word "GRANT", indicating that a new record start, "permission" is another reserved word, used in the record to mark a new The start of the license. Each GRANT record grants a set of permission to be a codase. ---- Permission_class_name must be a qualified and existing class name, such as Java.io.FilePermission, cannot use abbreviations (for example, FILEPERMISSION). ---- Target_name is used to specify the location of the target class, and the action is used to specify the permissions owned by the target class. ---- target_name You can specify the class name (which can be an absolute or relative path), the directory name, or the following wildcard: all files in directory / * Directory * All files of the current directory Directory / - Directory All File, including subdirectory - all files in the current directory, including all files in the subdirectory "All Files" file system for java.io.filePermission, Action can be: Read, Write, delete, and Execute. For java.net.socketpermission, Action can be: Listen, Accept, Connect, Read, Write.
--- 1.3 Property Expansion ---- Property Expansion ---- Property Extension Similar to the variable extensions used in the shell, its format is: "$ {some.property}" actual use: Permission Java.io.filepermission "$ {user.home}", "read"; "$ {user.home}" value is "D: / Project", so the following statement is the same as the above statement: Permission Java.io.filepermission "D: / Project", "Read"; 3. Instance ---- When the policy is initialized, load the system policy, then add the user policy, if both do not exist, use the default Policy, the original sandbox model. ---- The default location of the system Policy file is: {java.home} /lib/security/java.policy (Solaris) {java.home} /lib/security/java.policy (Windows) User Policy File The provincial location is: {user.home} /. Java.policy (Solaris) {user.home} /. Java.policy (windows) ---- actually, in actual use, we may not like the above Complex, especially when not using digital signatures. At this time, we can learn from JDK 1.2 to our home-made /jdk1.2/jre/lib/security/java.policy file, according to our needs, this article is a detailed description of the digital signature Usage of security policy files. ---- Here, it is a complete .java.policy file used in Windows 95/98 / NT. In the file, the use of the "permission" record is used in the form of a note.
// for lanservertalk.java and lanclienttalk.javagrant {// Permissions to the system and user directory "Read" permission java.util.propertypermission "user.dir", "read"; permission java.util.propertypermission "user.home" , "read"; permission java.util.propertypermission "java.home", "read"; permission java.util.propertypermission "java.class.path", "read"; permission java.util.propertypermission "user.name" , "read"; // authority to operate the thread and the thread group permission java.lang.RuntimePermission "modifyThread"; permission java.lang.RuntimePermission "modifyThreadGroup"; // various operating Socket port authority permission java.net.SocketPermission "-", "listen"; permission java.net.socketpermission "-", "accept"; permission java.net.socketpermission "-", "connect"; permission java.net.socketpermission "-", "read"; Permission java.net.socketpermission "-" - "," write "; // read and write permission permission java.io.filepermission" - "," read "; permission java.io.filepermission" - "," Write "; / / Exit system authority, such as system.exit (0) permission java.lang.RuntimePermission "exitvm";}; 4. Java.policy file usage ---- For Windows 95/98 / NT, use .java. The method of the Policy file mainly has two kinds. ---- 1. Using the default directory - we can simply edit the .java.policy file to the HOME directory of Windows 95/98 / NT, at this time, all applets (or Java applications) may have some The same permissions, is simple, but not flexible (for example, for java.io.filepermission, Target_name its target class must use absolute path), if not used in the enterprise internal network, there may be a certain security hazard. ---- 2. Specify in the command line - at the command line, if we want to pass a policy file to AppletViewer, you can also use the "-j-djava.security.policy" parameter to specify the position: appletViewer -j-djava.security .policy = purl myapplet ---- pURL is the location of the policy file.
