You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-user@db.apache.org by spykee <to...@yahoo.com> on 2014/07/21 21:21:10 UTC
java.security.AccessControlException: access denied
("java.lang.RuntimePermission" "getClassLoader")
Hi folks,
I have a problem and I hope someone can help me.
- I added a specific jar file in derby, and every time I execute a stored
procedure from that jar I encounter:
-- java.security.AccessControlException: access denied
("java.lang.RuntimePermission" "getClassLoader")
* I searched on internet a solution for this, and the problem reside in the
security policy.
* I don't want to use as an argument a specific security politicy
(-D...=myPolicy) while starting derby (network server).
* I searched my Java policy ( C:\Program Files\Java\jre8\lib\security ) and
I added the followings(java.policy file):
grant codeBase "file://C:/Program Files/Java/jdk1.8.0/db/lib/derby.jar"
{
permission java.lang.RuntimePermission "createClassLoader";
permission java.util.PropertyPermission "derby.*", "read";
permission java.lang.RuntimePermission "getClassLoader";
permission java.util.PropertyPermission "user.dir", "read";
permission java.lang.RuntimePermission "setContextClassLoader";
permission java.util.PropertyPermission "derby.*", "read";
permission java.util.PropertyPermission "derby.storage.jvmInstanceId",
"write";
permission java.io.FilePermission"C:/Users/myUser/.netbeans-derby",
"read,write,delete";
permission java.io.FilePermission"C:/Users/myUser/.netbeans-derby{/}-",
"read,write,delete";
};
I tried to use the Linux separator (/), the windows one(\) for the file
path... same errors on my Netbeans. I start/stop Apache Derby from Netbeans.
Can someone give me a hint ?
Cheers,
George
--
View this message in context: http://apache-database.10148.n7.nabble.com/java-security-AccessControlException-access-denied-java-lang-RuntimePermission-getClassLoader-tp140900.html
Sent from the Apache Derby Users mailing list archive at Nabble.com.
Re: java.security.AccessControlException: access denied ("java.lang.RuntimePermission"
"getClassLoader")
Posted by Rick Hillegas <ri...@oracle.com>.
Hi George,
Some responses inline...
On 7/22/14 12:21 PM, spykee wrote:
> Hi Rick,
>
> I tried to start it from the console& Netbeans, but I encountered the same
> errors ( I downloaded the latest Apache Derby, *10.10.2.0* - I'm using*
> Windows 8.1* ).
>
> What I did was :
>
> 1. Go on Apache Website and download the latest bin version.
> 2. Execute startNetworkServer.bat from the /bin directory.
The sample scripts in the bin directory boot the NetworkServer as the
JVM's main entry point. When you boot Derby this way, Derby installs a
SecurityManager using Derby's default server policy. That's the one I
attached to my previous response. This is described in the Server Guide
section titled "Basic Network Server security policy":
http://db.apache.org/derby/docs/10.10/adminguide/tadminnetservbasic.html
The security exception is raised because you have not granted sufficient
privilege to other, non-Derby code on your stack. In this case, the
log4j jar file. You need to do one of the following:
1) Boot the NetworkServer using your own policy file, based on the
policy file I attached to my previous message. Instructions on how to
customize this policy file can be found in the Server Guide section
titled "Network Server security". You will need to add a block of grants
for log4j. I don't know what other permissions it needs.
2) Or turn off the SecurityManager as described here:
http://db.apache.org/derby/docs/10.10/adminguide/tadminnetservopen.html
3) Or bring up the NetworkServer programatically as described here:
http://db.apache.org/derby/docs/10.10/adminguide/tadminconfig814963.html
> 3. Execute these with success( I tried both ways : using ij from console and
> Netbeans directly, but same errors):
> * CALL
> sqlj.install_jar('C:\\rlibraryStoredProcedures.jar','APP.rlibraryStoredProcedures',0);
> * CALL
> SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.classpath','APP.rlibraryStoredProcedures');
>
> * CREATE PROCEDURE deltaCollectorInsert(IN deltaColumn varchar(25),IN val1
> VARCHAR(5000), IN val2 varchar(5000),IN tableName varchar(25),
> IN tableCode varchar(25),IN pkColumn varchar(25), IN pkValue INT)
> LANGUAGE JAVA
> PARAMETER STYLE JAVA
> EXTERNAL NAME'com.rlibary.storedproc.DeltaCollector.deltaCollectorInsert';
>
> 4. Make a call to the stored procedure:
> * CALL
> deltaCollectorInsert('book','val1','val1','table','tableCode','pkColumn',1);
>
> Observe the errors from the attached file (derby_errors.txt)
> derby_errors.txt
> <http://apache-database.10148.n7.nabble.com/file/n140909/derby_errors.txt>
> :
>
>
> See also the attached Java class with the stored procedure:
> * DeltaCollector.java
> <http://apache-database.10148.n7.nabble.com/file/n140909/DeltaCollector.java>
>
> See my java.policy file from my JRE ( Java 8.0) in case this is important:
> * java.policy
> <http://apache-database.10148.n7.nabble.com/file/n140909/java.policy>
>
> Even with those errors my stored procedure is executed ( I ran it directly
> from console in order to insert rows in a single table), but I encountered a
> problem when using transaction between 2 tables.
> * I have an UPDATE trigger on table t1 which calls my mentioned stored
> procedure( which will insert a row in table2, @see my attached Java class).
> When I try to make an update, I encounter this.
> ******************************
> Error code 20000, SQL state 38000
> Update command failed: The exception 'java.sql.SQLException: Cannot issue
> rollback in a nested connection when there is a pending operation in the
> parent connection.' was thrown while evaluating an expression.
> *****************************
>
> Can you please help me with this ?
You cannot commit or rollback inside a trigger. This is described by the
Reference Guide section on "CREATE TRIGGER" (about 2/3s of the way down
the page, under the heading "triggeredSQLStatement"):
http://db.apache.org/derby/docs/10.10/ref/rrefsqlj43125.html
Hope this helps,
-Rick
> Cheers,
> George
>
>
>
> --
> View this message in context: http://apache-database.10148.n7.nabble.com/java-security-AccessControlException-access-denied-java-lang-RuntimePermission-getClassLoader-tp140900p140909.html
> Sent from the Apache Derby Users mailing list archive at Nabble.com.
>
Re: java.security.AccessControlException: access denied ("java.lang.RuntimePermission"
"getClassLoader")
Posted by Rick Hillegas <ri...@oracle.com>.
On 7/23/14 1:08 PM, spykee wrote:
> Hi Rick,
>
> Thank you for the tips. My problem was solved ( I used the fastest solution,
> -noSecurityManager).
>
> Sadly to say that Netbeans does not allow me to pass arguments for the
> Database and I have to use the console, and beside this, I used Squirrel to
> connect at my network server started using the .sh script. I have created a
> database using ij, but Squirrel ( actually Apache Derby Driver) complained
> about having an empty password/username ( How can this
> <https://wso2.org/jira/browse/DS-136> defect be fixed ? ).
Hi George,
If you haven't enabled Derby authentication (the default situation),
then you can just provide dummy credentials. I don't know how you
configure the credentials used by Squirrel.
Hope this helps,
-Rick
> Thanks again for helping me with this.
>
> Cheers,
> George
>
>
>
> --
> View this message in context: http://apache-database.10148.n7.nabble.com/java-security-AccessControlException-access-denied-java-lang-RuntimePermission-getClassLoader-tp140900p140925.html
> Sent from the Apache Derby Users mailing list archive at Nabble.com.
>
Re: java.security.AccessControlException: access denied
("java.lang.RuntimePermission" "getClassLoader")
Posted by spykee <to...@yahoo.com>.
Hi Rick,
Thank you for the tips. My problem was solved ( I used the fastest solution,
-noSecurityManager).
Sadly to say that Netbeans does not allow me to pass arguments for the
Database and I have to use the console, and beside this, I used Squirrel to
connect at my network server started using the .sh script. I have created a
database using ij, but Squirrel ( actually Apache Derby Driver) complained
about having an empty password/username ( How can this
<https://wso2.org/jira/browse/DS-136> defect be fixed ? ).
Thanks again for helping me with this.
Cheers,
George
--
View this message in context: http://apache-database.10148.n7.nabble.com/java-security-AccessControlException-access-denied-java-lang-RuntimePermission-getClassLoader-tp140900p140925.html
Sent from the Apache Derby Users mailing list archive at Nabble.com.
Re: java.security.AccessControlException: access denied
("java.lang.RuntimePermission" "getClassLoader")
Posted by spykee <to...@yahoo.com>.
Hi Rick,
I tried to start it from the console & Netbeans, but I encountered the same
errors ( I downloaded the latest Apache Derby, *10.10.2.0* - I'm using*
Windows 8.1* ).
What I did was :
1. Go on Apache Website and download the latest bin version.
2. Execute startNetworkServer.bat from the /bin directory.
3. Execute these with success( I tried both ways : using ij from console and
Netbeans directly, but same errors):
* CALL
sqlj.install_jar('C:\\rlibraryStoredProcedures.jar','APP.rlibraryStoredProcedures',0);
* CALL
SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.classpath','APP.rlibraryStoredProcedures');
* CREATE PROCEDURE deltaCollectorInsert(IN deltaColumn varchar(25),IN val1
VARCHAR(5000), IN val2 varchar(5000),IN tableName varchar(25),
IN tableCode varchar(25),IN pkColumn varchar(25), IN pkValue INT)
LANGUAGE JAVA
PARAMETER STYLE JAVA
EXTERNAL NAME'com.rlibary.storedproc.DeltaCollector.deltaCollectorInsert';
4. Make a call to the stored procedure:
* CALL
deltaCollectorInsert('book','val1','val1','table','tableCode','pkColumn',1);
Observe the errors from the attached file (derby_errors.txt)
derby_errors.txt
<http://apache-database.10148.n7.nabble.com/file/n140909/derby_errors.txt>
:
See also the attached Java class with the stored procedure:
* DeltaCollector.java
<http://apache-database.10148.n7.nabble.com/file/n140909/DeltaCollector.java>
See my java.policy file from my JRE ( Java 8.0) in case this is important:
* java.policy
<http://apache-database.10148.n7.nabble.com/file/n140909/java.policy>
Even with those errors my stored procedure is executed ( I ran it directly
from console in order to insert rows in a single table), but I encountered a
problem when using transaction between 2 tables.
* I have an UPDATE trigger on table t1 which calls my mentioned stored
procedure( which will insert a row in table2, @see my attached Java class).
When I try to make an update, I encounter this.
******************************
Error code 20000, SQL state 38000
Update command failed: The exception 'java.sql.SQLException: Cannot issue
rollback in a nested connection when there is a pending operation in the
parent connection.' was thrown while evaluating an expression.
*****************************
Can you please help me with this ?
Cheers,
George
--
View this message in context: http://apache-database.10148.n7.nabble.com/java-security-AccessControlException-access-denied-java-lang-RuntimePermission-getClassLoader-tp140900p140909.html
Sent from the Apache Derby Users mailing list archive at Nabble.com.
Re: java.security.AccessControlException: access denied ("java.lang.RuntimePermission"
"getClassLoader")
Posted by Rick Hillegas <ri...@oracle.com>.
Hi George,
I don't see this problem with release 10.10.2.0 when I run the network
server this way...
java org.apache.derby.drda.NetworkServerControl start -p 8246
...and run the following script...
connect 'jdbc:derby://localhost:8246/memory:db;create=true';
call sqlj.install_jar( 'helloWorld.jar', 'APP.HELLO_WORLD', 0 );
call syscs_util.syscs_set_database_property( 'derby.database.classpath',
'APP.HELLO_WORLD' );
create procedure helloWorld( args varchar( 32672 )... )
language java parameter style derby no sql
external name 'HelloWorld.main';
call helloWorld();
In this experiment, Derby uses the default server policy which is
bundled inside derbynet.jar at
org/apache/derby/drda/server.policy
I have attached that policy to this message. As you can see, that policy
does NOT grant the following permissions to any protection domain:
permission java.lang.RuntimePermission "getClassLoader";
permission java.lang.RuntimePermission "setContextClassLoader";
We might be able to say more if you could include the full stack trace
which you are seeing.
Thanks,
-Rick
On 7/21/14 12:21 PM, spykee wrote:
> Hi folks,
>
> I have a problem and I hope someone can help me.
>
> - I added a specific jar file in derby, and every time I execute a stored
> procedure from that jar I encounter:
> -- java.security.AccessControlException: access denied
> ("java.lang.RuntimePermission" "getClassLoader")
>
> * I searched on internet a solution for this, and the problem reside in the
> security policy.
> * I don't want to use as an argument a specific security politicy
> (-D...=myPolicy) while starting derby (network server).
> * I searched my Java policy ( C:\Program Files\Java\jre8\lib\security ) and
> I added the followings(java.policy file):
>
> grant codeBase "file://C:/Program Files/Java/jdk1.8.0/db/lib/derby.jar"
> {
> permission java.lang.RuntimePermission "createClassLoader";
> permission java.util.PropertyPermission "derby.*", "read";
> permission java.lang.RuntimePermission "getClassLoader";
> permission java.util.PropertyPermission "user.dir", "read";
> permission java.lang.RuntimePermission "setContextClassLoader";
> permission java.util.PropertyPermission "derby.*", "read";
> permission java.util.PropertyPermission "derby.storage.jvmInstanceId",
> "write";
> permission java.io.FilePermission"C:/Users/myUser/.netbeans-derby",
> "read,write,delete";
> permission java.io.FilePermission"C:/Users/myUser/.netbeans-derby{/}-",
> "read,write,delete";
> };
>
> I tried to use the Linux separator (/), the windows one(\) for the file
> path... same errors on my Netbeans. I start/stop Apache Derby from Netbeans.
>
> Can someone give me a hint ?
>
> Cheers,
> George
>
>
>
> --
> View this message in context: http://apache-database.10148.n7.nabble.com/java-security-AccessControlException-access-denied-java-lang-RuntimePermission-getClassLoader-tp140900.html
> Sent from the Apache Derby Users mailing list archive at Nabble.com.
>