It's not a secret anymore!*
The moose likes JForum and the fly likes Running JForum with Security Policy Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of Murach's Java Servlets and JSP this week in the Servlets forum!
JavaRanch » Java Forums » Products » JForum
Bookmark "Running JForum with Security Policy" Watch "Running JForum with Security Policy" New topic
Author

Running JForum with Security Policy

Migrated From Jforum.net
Ranch Hand

Joined: Apr 22, 2012
Posts: 17424
I am running JForum on Tomcat with the security manager. It took a while for me to get the security policy created. I basically ran with security debugging on and granted permissions when I saw access errors. I did this until it ran without errors. I have been running a couple of days without access errors so this is pretty close to everything you need. The security is relatively fine grained but in general I gave permissions to all classes and libraries within the application directory to work within the application directory at the access level they needed. I could have given the permissions to specific classes but this would have taken even longer and been more complicated to manage. I think this provides a reasonable security policy. Let me know if you have any suggestions for improvement. I am posting here as a starting point for others.


[originally posted on jforum.net by parisila]
 
Consider Paul's rocket mass heater.
 
subject: Running JForum with Security Policy
 
Similar Threads
Problems with security policies for Axis2 in Tomcat
Expression request.getParameter is undefined on line 97, column 94 in default/post_show.htm.
acces denied
Tomcat Java2 Security Issue: modifyThread and modifyThreadGroup
acces denied java.io.FilePermission