A question about Phoenix security policies...

["Peter M. Goldstein" <pe...@yahoo.com>]

All,

This is a quick question about Java permissions in the current revision
of Phoenix.  We over at the James project have run into an issue with
certain configurations of James (specifically use of a database) that
seem to cause us to run afoul of the Java permissions.  This comes up on
our user list about once or twice a month, and the standard answer
that's been given is "set PHOENIX_SECURE to false".

IMHO, this isn't the best approach.  I'd like to get the policy elements
in the environment.xml to be correct.  Right now we have:

  <policy>
    <grant code-base="file:${app.home}${/}blocks${/}*">
      <permission class="java.security.AllPermission" />
    </grant>

    <grant code-base="file:${app.home}${/}lib${/}*">
      <permission class="java.security.AllPermission" />
    </grant>
  </policy>

This clearly isn't right, as neither the blocks or lib subdirectories of
${app.home} exist.  I suspect this is a holdover from an older version
of Phoenix.  With the latest Phoenix, what is the correct version of
this element for the most broadly granted permission?  Is it:

  <policy>
    <grant code-base="sar:lib${/}*">
      <permission class="java.security.AllPermission" />
    </grant>
  </policy>

If not, what is the correct form?  Any help (or pointers to appropriate
documentation) would be appreciated.  Thanks.

--Peter



--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

Re: A question about Phoenix security policies...

[Peter Donald <pe...@apache.org>]

On Mon, 26 Aug 2002 03:27, Peter M. Goldstein wrote:
>   <policy>
>     <grant code-base="sar:lib${/}*">
>       <permission class="java.security.AllPermission" />
>     </grant>
>   </policy>
>
> If not, what is the correct form?  Any help (or pointers to appropriate
> documentation) would be appreciated.  Thanks.

The most open grant is to do something like

    <policy>
      <grant code-base="sar:SAR-INF/lib/*">
        <permission class="java.security.AllPermission" />
      </grant>
    </policy>

which will grant all permissions to all jars in library. However a better 
position may be to just not define the <policy /> element, ie remove it from 
environment.xml descriptor. That should give all classes loaded from wherever 
AllPermissions

-- 
Cheers,

Peter Donald
--------------------------------------------
 Beer is proof that God loves us and wants 
 us to be happy. -- Benjamin Franklin
-------------------------------------------- 


--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>