Java Security, 2nd Edition

The java.security File

Many parameters of the default sandbox are controlled by entries in the java.security file. This file ($JREHOME/lib/security/java.security) can be edited by system administrators, which is particularly effective when it is shared by several end users (though end users, of course, can administer it themselves if required).

That file has several entries that we’ll examine throughout this book; an annotated version of it appears in Appendix A. In terms of the default sandbox, here are the important entries:

policy.expandProperties=true
policy.allowSystemProperty=true
policy.url.1=file:${java.home}/lib/security/java.policy
policy.url.2=file:${user.home}/.java.policy

When we say that there are two default policy files, it’s because of the entries in this file (note that the Java property java.home expands to what we’ve been calling JREHOME). If you would prefer a different set of policy files to be used by default, you can edit the java.security file and change the URLs that are used. You may specify any number of URLs, but they must be numbered consecutively beginning with 1.

As we’ve seen, users can specify any number of policy files on the command line as well. To prevent users from specifying additional policy files, set the allowSystemProperty property to false. A site that has that value set to false, removes the user’s .java.policy entry from this file, and makes the java.security file uneditable by end users has established a sandbox that cannot be modified ...