Before you begin
Java 2 security uses several policy files to determine the granted permission for each Java program. See Java 2 security policy files for the list of available policy files supported by WebSphere Application Server Version 6.0.x. The was.policy file is an application-specific policy file for WebSphere Application Server enterprise applications. It is embedded in the enterprise archive (EAR) file (META-INF/was.policy). The was.policy file is located in:install_root/profiles/profile_name/config/cells/cell_name/applications/
ear_file_name/deployments/application_name/META-INF/was.policy
Changes made in these files are replicated to other nodes in the Network Deployment cell.
Symbol | Definition |
---|---|
file:${application} | file:${application} |
file:${jars} | Permissions apply to all utility Java archive (JAR) files within the application |
file:${ejbComponent} | Permissions apply to enterprise bean resources within the application |
file:${webComponent} | Permissions apply to Web resources within the application |
file:${connectorComponent} | Permissions apply to connector resources within the application |
grant codeBase "file:${application}" {
permission java.lang.RuntimePermission "stopThread";
permission java.lang.RuntimePermission "modifyThread";
permission java.lang.RuntimePermission "modifyThreadGroup";
};
"file:DefaultWebApplication.war" {
permission java.security.SecurityPermission "printIdentity";
};
grant codeBase "file:IncCMP11.jar" {
permission java.io.FilePermission
"${user.install.root}${/}bin${/}DefaultDB${/}-",
"read,write,delete";
};
Symbol | Definition |
---|---|
${app.installed.path} | Path where the application is installed |
${was.module.path} | Path where the module is installed |
${current.cell.name} | Current cell name |
${current.node.name} | Current node name |
${current.server.name} | Current server name |
Why and when to perform this task
If the default permissions for the enterprise application (union of the permissions defined in the java.policy file, the server.policy file and the app.policy file) are enough, no action is required. If an application has specific resources to access, update the was.policy file. The first two steps assume that you are creating a new policy file.Steps for this task
For more information, see Adding the was.policy file to applications.
The following instructions describe how to import a was.policy file.Result
The updated was.policy file is applied to the application after the application restarts.Example
java.policyserver.policyapp.policywas.policyjava.security.AccessControlExceptionjava.security.AccessControlException: access denied (java.io.FilePermission C:\WebSphere\AppServer\java\jre\lib\ext\mail.jar read)When a Java program receives this exception and adding this permission is justified, add a permission to the was.policy file: grant codeBase "file:<user client installed location>" { permission java.io.FilePermission "C:\WebSphere\AppServer\java\jre\lib\ext\mail.jar", "read"; };.
To determine whether to add a permission, refer to the article, Access control exception.
What to do next
Restart all applications for the updated app.policy file to take effect.Related concepts
Access control exception
Java 2 security policy files
Related tasks
Migrating security configurations from previous releases
Configuring spi.policy files
Configuring library.policy files
Adding the was.policy file to applications
Importing enterprise applications