IBM WebSphere V5.0 Security - CGISecurity

A grant entry can be defined according to the following grammar:grant [SignedBy “signer_names”] [, CodeBase “URL”] {permission permission_class_name [ “target_name” ] [, “action”][,SignedBy “signer names”];...};Each grant entry consists of a CodeSource and its permissions, where aCodeSource conists of a URL and a set of certificates and the grant entryincludes a URL and a list of signer names.Property expansion is possible in the policy files and in the security propertiesfile.Example 8-4 Sample policy filekeystore “c:\keystores\mykey.jks”, “jks”grant codeBase “http://java.sun.com/*“, signedBy “WebDeveloper” {permission java.io.FilePermission “/files/*”, “read”;permission java.io.FilePermission “${user.home}”, “read,write”;}When the JVM is loading a new class, the following algorithm is used to cehckthe policy settings for that particulas class:1. Match the public keys, if code is signed2. If a key is not recognized in the policy, ignore the key. If every key is ignored,treat the code as unsigned.3. If the keys are matched, or no signer was specified, try to match all URLs inthe policy for the keys.4. If either key or URL is not matched, use built-in default permission, which isthe original sandbox permission.Policy files in runtimeThe following list will show how the policy files can be specified for a Javaruntime and where those policy files are located.► System policy file is located at:{java.home}/lib/security/java.policy► User policy file is located at:{user.home}/.java.policy► Policy file locations are also specified in the security properties file, located at:{java.home}/lib/security/java.securityChapter 8. Programmatic security 201