java.policy grant codeBase

[Ruben Sal]

Hi,

I've a signed applet that deletes some temp files on a local machine.
The applet works fine when I add grant permissions on the .java.policy file.

grant {
  permission java.io.FilePermission "<<ALL FILES>>", "delete";
};

The problems begin when I specify a grant codeBase.
If I put:

grant codeBase="http://www.example.com/-" {
  permission java.io.FilePermission "<<ALL FILES>>", "delete";
};

This grant, I think, allows io.permissions for the applets placed on
"http://www.example.com/"; and subdirectories but it doesn't work.
Always I have an access denied error like this
"java.security.AccessControlException: access denied (java.io.FilePermission C:\xxxx delete)"

This applet is called from a Firefox browser.

Anyone know what is the problem?
Why it doesn't work when I set a grant codeBase?

Thanks

[Ulf Dittmer]

Welcome to JavaRanch.

The "=" character is not part of the policy file syntax, so it probably leads to this permission being ignored. Replace it with a space character.

[Ruben Sal]

Hi Ulf

Sorry, the codeBase is set without character "=", I paste it wrong before.

grant codeBase "http://www.example.com/-" {
  permission java.io.FilePermission "<<ALL FILES>>", "delete";
};

It doesn't work

I generate the java.policy with policytool.exe and I supose the sintax is correct, but I don't know.

I don't know if the problem can be in the java.security file.

[Yilmaz Ay]

Have you found a solution for this problem? I am having exactly the same problem.
I have checked my javapolicy file syntax several times to make sure that it is not my mistake.
I am pretty sure, everything is according to the spects as described on Sun's website.

However, adding a codebase after "grant" command makes all permissions disabled for some reasons.

without codebase grant { permission java.io.FilePermission ....... } works fine.

so, i think, there is something wrong with the codebase

here is my code snippet :

grant codeBase "http://rdo.speak2me.cn/-" {
permission java.io.FilePermission "C:\\Documents and Settings\\UserName\\SomeDirectory\\-", "read,write";
};

UserName\\SomeDirectory\\ is actually a real path, just did not want to display it here.

If anyone has any solution or any idea that might help me solve this problem, i appreciate your help.
Thanks

[Rafal Sasadeusz]

It's probably too late to help you but maybe someone will find my answer useful. I've had similar problem few days ago. It was caused by JavaScript code calling my applet. When you are calling "restricted" applet functions from JavaScript you will get "security exception" even if the applet is signed.

You need to use AccessControler to elevate privileges for JavaScript:
http://docs.oracle.com/javase/1.4.2/docs/api/java/security/AccessController.html

Granting permission as showed below will solve your problem as well because JavaScript codebase is null.

grant {
permission java.io.FilePermission "<<ALL FILES>>", "delete";
};

Regards,
Rafal

[Darryl Burke]

Since that link is for the API of an old, obsoleted Java version, here are the links for the later versions.
Java SE 6: http://docs.oracle.com/javase/6/docs/api/java/security/AccessController.html
Java SE 7: http://docs.oracle.com/javase/7/docs/api/java/security/AccessController.html

There's probably no difference in the API of this particular class, but there are several differences in the overall Java API.

Welcome to the Ranch, Rafal!