Download the JDK
Search the Tutorials
Hide the TOC
Trail: Security Features in Java SE
Lesson: Quick Tour of Controlling Applets
Section: Set up a Policy File to Grant the Required Permission
Quick Tour of Controlling Applets
Observe Applet Restrictions
Set up a Policy File to Grant the Required Permission
Start Policy Tool
Grant the Required Permission
Save the Policy File
See the Policy File Effects
Home Page > Security Features in Java SE > Quick Tour of Controlling Applets
« Previous • Trail • Next »
Grant the Required Permission

> To grant the `WriteFile` applet permission to create and to write to the `writetest` file, you must create a policy entry granting this permission. To create a new entry, click on the Add Policy Entry button in the main Policy Tool window. This displays the Policy Entry dialog box as shown in the following figure.

> This figure has been reduced to fit on the page.
> Click the image to view it at its natural size.

> A policy entry specifies one or more permissions for code from a particular code source - code from a particular location (URL), code signed by a particular entity, or both.

> The CodeBase and the SignedBy text boxes specify which code you want to grant the permission(s) you will be adding in the file.

> - A CodeBase value indicates the code source location; you grant the permission(s) to code from that location. An empty CodeBase entry signifies "any code" -- it does not matter where the code originates.

> - A SignedBy value indicates the alias for a certificate stored in a keystore. The public key within that certificate is used to verify the digital signature on the code. You grant permission to code signed by the private key corresponding to the public key in the keystore entry specified by the alias. The SignedBy entry is optional; omitting it signifies "any signer" -- it does not matter whether the code is signed, or by whom.

> If you have both a CodeBase and a SignedBy entry, the permission(s) are granted only to code that is both from the specified location and signed by the named alias.

> To grant `WriteFile` the permission it needs, you can grant permission to all code from the location (URL) where `WriteFile.class` is stored.

> Type the following URL into the CodeBase text box of the Policy Entry dialog box:

> >     http://java.sun.com/docs/books/tutorial/security/tour1/examples/

> Note: This is a URL. Therefore, it must always use slashes as separators, not backslashes.

> Leave the SignedBy text box blank, since you aren't requiring the code to be signed.

> > Note: To grant the permission to any code (`.class` file) not just from the directory specified previously but from the `security` directory and its subdirectories, type the following URL into the CodeBase box:

> > >     http://java.sun.com/docs/books/tutorial/security/-

> You have specified where the code comes from (the CodeBase), and that the code does not have to be signed (since there is no SignedBy value). Now you are ready to grant permissions to that code.

> Click on the Add Permission button to display the Permissions dialog box.

> This figure has been reduced to fit on the page.
> Click the image to view it at its natural size.
> Follow these steps to grant code from the specified CodeBase permission to write (and thus also to create) the file named `writetest`.
> 1. Choose File Permission from the Permission drop-down list. The complete permission type name (`java.io.FilePermission`) now displays in the text box to the right of the drop-down list.

> 2. Type the following in the text box to the right of the list labeled Target Name to specify the file named `writetest`:

>    >     writetest

> 3. Specify write access by choosing the `write` option from the Actions drop-down list.
> The Permissions dialog box now looks like the following.

> This figure has been reduced to fit on the page.
> Click the image to view it at its natural size.

> Click on the OK button. The new permission displays in a line in the Policy Entry dialog. So now the policy entry window looks like this.

> This figure has been reduced to fit on the page.
> Click the image to view it at its natural size.

> You have now specified this policy entry, so click on the Done button in the Policy Entry dialog. The Policy Tool window now contains a line representing the policy entry, showing the `CodeBase` value.

> This figure has been reduced to fit on the page.
> Click the image to view it at its natural size.

« Previous • Trail • Next »
Previous page: Start Policy Tool
Next page: Save the Policy File