The Default Sandbox
And now, putting this all together, let’s examine the default sandbox of various Java environments:
- Java applications
For applications invoked via the Java command line, the sandbox is initially disabled. To enable the sandbox, you must specify the
java.security.managerproperty like this:
java -Djava.security.manager <other args>
Applications may also enable the sandbox programatically by installing a security manager, as we discuss in Chapter 4.
Once enabled, the security manager will use the two default policy files to determine the parameters of the sandbox. You can specify an additional policy file to be used with the
You can specify a full URL (e.g., with an
file:protocol) or simply list a filename. If you want the given policy file to be the only policy file used (bypassing the ones in $JREHOME/lib/security and the user’s home directory), specify two equals signs:
Putting this all together, here’s how we would run the class
PayrollAppin the default sandbox with additional permissions loaded from the file java.policy in the local directory:
java -Djava.security.manager \
The appletviewer installs a security manager programatically; it cannot be disabled. It will use the standard policy files; to use additional policy files, specify the appropriate policy ...