Java Dynamic Management Kit 3.2 Programming Guide | ||||
---|---|---|---|---|
![]() | ![]() | Chapter 13. Class and Library Loading Service | ![]() | ![]() |
The RMI class and library loading service supports code signing. On the class server side, this involves:
Creating an entry in the keystore for the signer
Generating public and private keys for the signer using keytool
Exporting the certificate using keytool
Creating the code signing directive file required by the class server
Running the class server providing the code signing directive file
On the agent side, class signing involves the following:
Importing the signer's certificate into the keystore using keytool
Defining the security policies using policytool
Running the application with the security manager provided with JavaŽ 2 SDK
Example 13-10 shows the policy file entry for classes coming from an RMI class server with codebase rmi://myHost:1099/NetClassServer and signed by tester. This entry grants two permissions, the first one grants read access to all files in the directory /tmp and the second one grants access to the objects registered in the framework.
Example 13-10. Example Policy File Entry
grant signedBy "tester" { permission java.io.FilePermission "/tmp/*", "read"; permission com.sun.jaw.reference.agent.cmf.FrameworkPermission "accessObjects"; }; |
Note - The codebase of the RMI class server cannot be used to identify the source of the code in the grant clause of the policy file. This is because the RMI protocol is not supported by the java.net.URL class. Only the signer can be used to identify the classes coming from an RMI class server.
![]() | ![]() | ![]() |
Security Manager | ![]() | M-Let, Bootstrap and Launcher Services |