jsr-56 - Java Community Process Program

This environment is a subset of the Applet sandbox. Since only one application is run per JVM for an
application launched by a JNLP Client, the JNLP sandbox does not have to restrict access to, e.g.,
System.exit and ThreadGroup objects.
5.6 TRUSTED ENVIRONMENTS
This specification specifies two trusted environments, the all-permissions environment and an
environment that meets the security specifications of the J2EE Application Client environment. Both of
these environments provide unrestricted access to the network and local disk. Thus, an application can
intentionally or unintentionally harm the local system. An application must only be launched if it is
trusted.
The security element in the JNLP file is used to request the trusted environments:
All Permissions J2EE Application Client Permissions
The following requirements must be satisfied before a JNLP Client can grant an application these access
rights:
1. The application is signed.
2. The user and/or the JNLP Client trusts the certificate that is used to sign the application.
How a JNLP Client decides to trust a certificate is dependent on the particular implementation. Typically,
a JNLP Client would prompt the user to make a decision on whether to launch the application or not. The
decision can be based on the information stored in the certificate. The decision can be cached, so the
accept action is only required the first time the application is launched.
The application must be run with a SecurityManager installed. The following table lists the exact set
of permissions that must be granted to the application’s resources:
Security Permissions
All Permissions Environement
java.security.AllPermission
Target Action
J2EE Application Client Environment
java.awt.AWTPermission accessClipboard
java.awt.AWTPermission accessEventQueue
java.awt.AWTPermission showWindowWithoutWarningBanner
java.lang.RuntimePermission exitVM
java.lang.RuntimePermission loadLibrary
java.lang.RuntimePermission queuePrintJob
java.net.SocketPermission * connect
JSR-56 - Proposed Final Draft 36 of 74