The java.security File
Many parameters of the default sandbox are controlled by entries in the java.security file. This file ($JREHOME/lib/security/java.security) can be edited by system administrators, which is particularly effective when it is shared by several end users (though end users, of course, can administer it themselves if required).
That file has several entries that we’ll examine throughout this book; an annotated version of it appears in Appendix A. In terms of the default sandbox, here are the important entries:
policy.expandProperties=true policy.allowSystemProperty=true policy.url.1=file:${java.home}/lib/security/java.policy policy.url.2=file:${user.home}/.java.policy
When we say that there are two default policy files, it’s
because of the entries in this file (note that the Java property
java.home
expands to what we’ve been
calling JREHOME). If you would prefer a different set of policy files
to be used by default, you can edit the
java.security file and change the URLs that are
used. You may specify any number of URLs, but they must be numbered
consecutively beginning with 1.
As we’ve seen, users can specify any number of policy files on
the command line as well. To prevent users from specifying additional
policy files, set the allowSystemProperty
property to false
. A site that has that value
set to false, removes the user’s
.java.policy entry from this file, and makes the
java.security file uneditable by end users has established a sandbox that cannot be modified ...
Get Java Security, 2nd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.