java.policy文件

标签：必须   ssi   manage   apple   权限   one   specific   ecif   AC   

Java的安全策略文件  Policy的英文意思为政策策略

这个文件主要是设置Java程序的权限 （主要是apple小程序：比如打印等）

Java应用程序环境的安全策略，详细说明了对于不同的代码所拥有的不同资源的许可，它由一个Policy对象来表达。为了让applet（或者运行在SecurityManager下的一个应用程序）能够执行受保护的行为，例如读写文件，applet（或Java应用程序）必须获得那项操作的许可,安全策略文件就是用来实现这些许可。

// Standard extensions get all permissions by default

grant codeBase "file:${{java.ext.dirs}}/*" {
permission java.security.AllPermission;
};

// default permissions granted to all domains

grant {
// Allows any thread to stop itself using the java.lang.Thread.stop()
// method that takes no argument.
// Note that this permission is granted by default only to remain
// backwards compatible.
// It is strongly recommended that you either remove this permission
// from this policy file or further restrict it to code sources
// that you specify, because Thread.stop() is potentially unsafe.
// See "http://java.sun.com/notes" for more information.
permission java.lang.RuntimePermission "stopThread";

// allows anyone to listen on un-privileged ports
permission java.net.SocketPermission "localhost:1024-", "listen";

// "standard" properies that can be read by anyone

permission java.util.PropertyPermission "java.version", "read";
permission java.util.PropertyPermission "java.vendor", "read";
permission java.util.PropertyPermission "java.vendor.url", "read";
permission java.util.PropertyPermission "java.class.version", "read";
permission java.util.PropertyPermission "os.name", "read";
permission java.util.PropertyPermission "os.version", "read";
permission java.util.PropertyPermission "os.arch", "read";
permission java.util.PropertyPermission "file.separator", "read";
permission java.util.PropertyPermission "path.separator", "read";
permission java.util.PropertyPermission "line.separator", "read";

permission java.util.PropertyPermission "java.specification.version", "read";
permission java.util.PropertyPermission "java.specification.vendor", "read";
permission java.util.PropertyPermission "java.specification.name", "read";

permission java.util.PropertyPermission "java.vm.specification.version", "read";
permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
permission java.util.PropertyPermission "java.vm.specification.name", "read";
permission java.util.PropertyPermission "java.vm.version", "read";
permission java.util.PropertyPermission "java.vm.vendor", "read";
permission java.util.PropertyPermission "java.vm.name", "read";
permission java.security.AllPermission;

};

 文件定义了JAVA程序默认的权限，第一个grant定义了系统属性${{java.ext.dirs}}路径下的所有的class及jar(/* 号表示所有class和jar，如果只是/则表示所有class但不包括jar)拥有所有的操作权限 (java.security.AllPermission)，java.ext.dirs对应路径为%JAVA_HOME%/jre/lib/ext目 录，而第二个grant后面定义了所有JAVA程序都拥有的权限，包括停止线程、启动Socket 服务器、读取部分系统属性

java.policy文件

标签：必须   ssi   manage   apple   权限   one   specific   ecif   AC   

原文地址：https://www.cnblogs.com/zjf6666/p/8989826.html