IBM WebSphere V5.0 Security - CGISecurity

►It is also possible to specify additional or different policy file when invokingexecution of an application, using the appropriate command line arguments,for example:java -Djava.security.manager -Djava.security.policy=MyPolicyURLMyApplicationWhen the policy file is specified using double equals, the specified policy filewill be used exclusively; for example:-Djava.security.policy==MyOnlyPolicyURLSecurity ExceptionsThe following exceptions ship with the Java V1.2 SDK:►►java.security.SecurityExceptionThis exception and its subclasses should be runtime exceptions (unchecked,not declared) that are likely to cause the execution of a program to stop. Suchan exception is thrown when security violation is detected, for example whentrying to access an unauthorized resource.java.security.GeneralSecurityExceptionThis is a subclass of java.lang.Exception (must be declared or caught) that isthrown in other cases. Such an exception is thrown when a security-related(but not vital) problem is detected. For example: passing an invalid key.Secure class loadingThe dynamic class loading is one of the strength of the Java platform, because itprovides the ability to install components at runtime. It is also critical in providingsecurity because the class loader is responsible for locating and fetching theclass file, consulting the security policy, and defining the class object with theappropriate permissions.The java.security.SecureClassLoader is a subclass and an implementation of theabstract java.lang.ClassLoader class. Other classloaders subclass theSecureClassLoader to provide different class loading facilities for variousapplictions.Debugging securityUse the -Djava.security.debug=access,failure argument in the virtual machine.This flag will dump the name of permission checks that are failing.202 IBM WebSphere V5.0 Security Handbook