Re: Permissions Utility

Bob,

Thanks for the info regarding DebugDynamicPolicyProvider; I was truly
unaware of it.  After receiving your note, I searched the jsk for info and
reviewed the Java code for the provider.  I think that it and the Bantam
security utility are very similar at a high level, both granting all
permissions to the application and conveying the requests to the developer,
but the practical usage is different. Here's what I see as the differences:

(1) the Bantam utility outputs a policy file to the console when the JVM is
terminated, whereas DebugDynamicPolicyProvider logs permission requests via
the Java logging api as they are received.  The two really are intended to
serve different purposes here, I think.  The Bantam utility is designed to
help the programmer easily put together a policy file, whereas the
DebugDynamicPolicyProvider is a general purpose tool for debugging security
issues. The developer would probably want to configure logging to segregate
DebugDynamicPolicyProvider output, if creating a new policy file.

(2) the Bantam utility is self-contained and runs using the command-line
Java agent interface, whereas the DebugDynamicPolicyProvider extends
DynamicPolicyProvider and has a dependency on Jini's tools.jar and
jsk-platform.jar.  This dependency is a liability for Bantam since services
run inside an existing Servlet engine and it's necessary to be very careful
with the classloader hierarchy.  It's a design constraint to have Bantam
WARs be self-contained, so putting Jini anything in a base classloader was
not desirable.  [also, not sure if it's possible to configure security
provider with a command line switch (to add DynamicPolicyProvider), but it's
worked out to be convenient to so as I've worked with the Bantam utility.]

To summarize the Bantam security utility: it's an agent that generates a
security policy file for the developer, based on permissions the application
had requested.  It's configured with a command-line option, works with any
Java application, and has no dependencies (other than Java 5).  A developer
(using Jini's normal service startup mechanism) could also build a security
policy file with DebugDynamicPolicyProvider and some log analysis, but I
think it would take a few more steps and a bit more time.  Thanks for your
question.

-Tom

--------------------------------------------------------------------------
Getting Started:     http://www.jini.org/wiki/Category:Getting_Started
Community Web Site:  http://jini.org
jini-users Archive:  http://archives.java.sun.com/archives/jini-users.html
Unsubscribing:       email "signoff JINI-USERS"  to [email protected]