Re: Service Start Framework Permissions vs Service Permission

Bob Scheifler wrote:
>> I'm trying to recall how the split policy works in service starter.  
>> Is the service only granted what it's policy specifies in the policy 
>> file passed into NonActivatableServiceDescriptor (and the others), or 
>> does it also get the permissions granted on the command line that 
>> start.jar is started with?
> 
> If you mean LoaderSplitPolicyProvider, then from its javadoc:
> 
> Each LoaderSplitPolicyProvider instance wraps two underlying policy 
> providers:
>  - a class-loader specific policy provider, consulted for permission
>    queries/grants pertaining to that class loader, any child class loaders
>    that delegate to it, or the null class loader, and
>  - a default policy provider, consulted for all other operations (aside
>    from refresh, which applies to both policies).

Right, I read that.  I am trying to understand what that really means.  I have a 
service that is doing Subject.doAs() and in that block, using 
AccessControllerContext.checckPermission() with a context that points at the 
services policy and classpath.  The output from java.security.debug=all shows a 
grant of AllPermission.  Here's the visible output following the trace showing 
the call to AccessControlContext.checkPermission.

I don't see the granted permission visible here...

Gregg Wonderly

access: domain 0 ProtectionDomain  (file:/home/edge/classes/new/cytetech5.jar 
<no signer certificates>)
 
com.sun.jini.start.ActivateWrapper$ExportClassLoader[importURLs=[file:/home/edge/classes/oncytesvc.jar, 
file:/home/edge/classes/postgresql.jar, file:/home/edge/classes/startnow.jar, 
file:/home/edge/classes/jsc-platform.jar, 
file:/home/edge/classes/new/cytetech5.jar, 
file:/home/edge/classes/serviceui.jar],exportURLs=[http://xxx:8080/oncytesvc-dl.jar, 
http://xxx:8090/jsk-dl.jar],parent=sun.misc.Launcher$AppClassLoader@9664a1,id=61cf6f19-0178-469e-8022-4a6eac51d670]
  (principals com.sun.security.auth.UnixNumericUserPrincipal "503",
com.sun.security.auth.UnixNumericGroupPrincipal "507",
com.sun.security.auth.UnixNumericGroupPrincipal "506",
com.sun.security.auth.UnixNumericGroupPrincipal "505",
com.sun.security.auth.UnixNumericGroupPrincipal "503",
com.sun.security.auth.UnixPrincipal "gregg")

  java.security.Permissions@1e6ee98 (
  (java.io.FilePermission /home/edge/classes/new/cytetech5.jar read)
)


access: domain 1 ProtectionDomain  (file:/home/edge/classes/oncytesvc.jar <no 
signer certificates>)
 
com.sun.jini.start.ActivateWrapper$ExportClassLoader[importURLs=[file:/home/edge/classes/oncytesvc.jar, 
file:/home/edge/classes/postgresql.jar, file:/home/edge/classes/startnow.jar, 
file:/home/edge/classes/jsc-platform.jar, 
file:/home/edge/classes/new/cytetech5.jar, 
file:/home/edge/classes/serviceui.jar],exportURLs=[http://xxx:8080/oncytesvc-dl.jar, 
http://xxx:8090/jsk-dl.jar],parent=sun.misc.Launcher$AppClassLoader@9664a1,id=61cf6f19-0178-469e-8022-4a6eac51d670]
  (principals com.sun.security.auth.UnixNumericUserPrincipal "503",
com.sun.security.auth.UnixNumericGroupPrincipal "507",
com.sun.security.auth.UnixNumericGroupPrincipal "506",
com.sun.security.auth.UnixNumericGroupPrincipal "505",
com.sun.security.auth.UnixNumericGroupPrincipal "503",
com.sun.security.auth.UnixPrincipal "gregg")

  java.security.Permissions@9ac272 (
  (java.io.FilePermission /home/edge/classes/oncytesvc.jar read)
)


access: access allowed (com.cytetech.dcm.svc.ServiceAccessPermission 
com.cytetech.dcm.data.DataAccess.getSite)

Gregg

--------------------------------------------------------------------------
Getting Started:     http://www.jini.org/wiki/Category:Getting_Started
Community Web Site:  http://jini.org
jini-users Archive:  http://archives.java.sun.com/archives/jini-users.html
Unsubscribing:       email "signoff JINI-USERS"  to [email protected]