Signing Code and Granting It Permissions

Observe the Restricted Application

The last part of the Quick Tour of Controlling Applications lesson shows how an application can be run under a security manager by invoking the interpreter with the new "-Djava.security.manager" command-line argument.

But what if the application to be invoked resides inside a JAR file?

How To Execute an Application Inside a Signed JAR File

One of the interpreter options is the "-cp" (for "classpath") option, where you specify a search path for application classes and resources.

Thus, for example, to execute the Count application inside the sCount.jar JAR file, specifying the file C:\TestData\data as its argument, you could type the following (while in the directory containing sCount.jar):

java -cp sCount.jar Count C:\TestData\data

How To Execute an Application Inside a Signed JAR File With a Security Manager

To execute the application with a security manager, simply add "-Djava.security.manager", as in

java -Djava.security.manager -cp sCount.jar Count C:\TestData\data

When you run this command, you should get an exception:

Exception in thread "main" java.security.AccessControlException: access denied (
java.io.FilePermission C:\TestData\data read)
    at java.security.AccessControlContext.checkPermission(Compiled Code)
    at java.security.AccessController.checkPermission(Compiled Code)
    at java.lang.SecurityManager.checkPermission(Compiled Code)
    at java.lang.SecurityManager.checkRead(Compiled Code)
    at java.io.FileInputStream.(Compiled Code)
    at Count.main(Compiled Code)

This AccessControlException is reporting that the application does not have permission to read the file C:\TestData\data. This exception is raised because an application running under a security manager cannot read a file or access other resources unless it has explicit permission to do so.

Signing Code and Granting It Permissions