[ https://issues.apache.org/jira/browse/FELIX-5911?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16628697#comment-16628697 ]
Timothy Ward commented on FELIX-5911: ------------------------------------- This permission request seems wrong. By default the OSGi framework should grant access to the bundle storage area ([see the security section in the core specification title|[https://osgi.org/specification/osgi.core/7.0.0/framework.security.html#framework.security.impliedpermissions]).] I'm not sure why the bundle should need to request other file permissions at all. I would also really like to see reflection removed as it really shouldn't be necessary. The bundle is in complete control of the serialization, so I'm not sure why it hasn't been written purely using DataInput/DataOutput. There aren't any cycles, and none of the default serialisation behaviour is in use. To my mind this could (and should) all be re-implemented without any need for reflection, even while maintaining backward compatibility with existing saved data. Finally, the additional permissions needed when the "configurator.initial" property is set need to be granted by the person launching the framework. They know that they have set security on, and what they have sent the configurator.initial property to. The Configurator bundle shouldn't be opening up the base options for this. > [Configurator] request FilePermission <<ALL FILES>> > --------------------------------------------------- > > Key: FELIX-5911 > URL: https://issues.apache.org/jira/browse/FELIX-5911 > Project: Felix > Issue Type: Bug > Components: Configurator > Affects Versions: configurator-1.0.4, configurator-1.0.6 > Reporter: Christoph Nölle > Assignee: Carsten Ziegeler > Priority: Major > Fix For: configurator-1.0.8 > > > Configurator currently requests > (java.io.FilePermission "-" "read,write,execute,delete") > in its permissions.perm file (the "-" means all files and subfolders within > and below the current working dir). However, the bundle tries to access files > in the bundle storage area as well, whose location we cannot anticipate here. > It can be configured by means of a framework property, for instance. The > correct permission would be > (java.io.FilePermission "<<ALL FILES>>" "read,write,execute,delete") -- This message was sent by Atlassian JIRA (v7.6.3#76005)