Re: socket permission catalina.policy question

[Jean-Francois Arcand]

Euh...Can you post your catalina.policy file? Maybe another permissions is conflicting with the one you try to define. I'm doing some tests here without any problems...

-- Jeanfrancois

Andrew Cheng wrote:

Sorry, I forgot to mention that a guy on the project decided
to be clever and he put the application in a directory next
to (not inside) webapps.

So inside ${catalina.home} there is myApplication and there is
webapps.

Inside myApplication is a bunch of servlets inside their own
directories.

The servlet I want to grant permission to is myServlet.

Are you saying to do this?
grant codeBase "file:${catalina.home}/myApplication/myServlet/-" {
permission java.net.SocketPermission "the.third.machine:8080", "accept,
connect,listen, resolve";
};

I have done it and it still gets a socket permission exception.

-----Original Message-----

You need to add

webapps/

after ${catalina.home}/

;-)

-- Jeanfrancois



Andrew Cheng wrote:

You need to add the something like that:

grant codeBase "file:${catalina.home}/ <<<your app>>/-" {
permission java.net.SocketPermission "dbhost.mycompany.com:5432",
"connect";
permission java.net.SocketPermission "*.noaa.gov:80", "connect";
};

-- Jeanfrancois

Thanks for the quick reply!
But I have *already* done this and it still does not work.

the file to download is http://the.third.machine:8080/my.dtd

and in catalina.policy I have:

grant codeBase "file:${catalina.home}/myApplication/-" {
permission java.net.SocketPermission "the.third.machine:8080", "accept,
connect,
listen, resolve";
};

grant codeBase "file:${catalina.home}/path/to/my.jar" {
permission java.security.AllPermission;
permission java.net.SocketPermission "the.third.machine:8080", "accept,
connect,
listen, resolve";
};

grant codeBase "file:${catalina.home}/path/to/my.jar!/-" {
permission java.security.AllPermission;
};

-----Original Message-----
From: Jean-Francois Arcand [mailto:jfarcand@;apache.org]
Sent: Thursday, October 17, 2002 10:20 AM
To: Tomcat Users List
Subject: Re: socket permission catalina.policy question


You need to add the something like that:

grant codeBase "file:${catalina.home}/webapps/<<<your app>>/-" {
permission java.net.SocketPermission "dbhost.mycompany.com:5432",
"connect";
permission java.net.SocketPermission "*.noaa.gov:80", "connect";
};

-- Jeanfrancois

Andrew Cheng wrote:

Quick question:

I have an applet that communicates with a servlet. The

servlet tries to

download a DTD file from a third machine. It gets a socket permission
access denied exception.

I have wrapped the line of code in the servlet that downloads

the file with

a privileged block.

The line of code calls a method inside a jar file. I have used

the policy

tool to grant all permissions to this jar file. I have even

tried granting

all permissions to all code temporarily!

I have made sure to use the "-security" option when starting

tomcat. I have

double checked this by looking at the log file and seeing that

the security

manager is being used.

However, my servlet still gets a socket permission access denied

exception.

The file I am trying to download is definitely downloadable from

the machine

that the servlet is running on. Please tell me what I have

forgotten to do.

Thanks in advance,
Andrew
grant {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/_____/-" {
permission java.net.SocketPermission "_____:8080", "accept, connect,
listen, resolve";
};

grant codeBase "file:${catalina.home}/_____/jdom.jar" {
permission java.security.AllPermission;
permission java.net.SocketPermission "_____:8080", "accept, connect,
listen, resolve";
};

grant codeBase "file:${catalina.home}/_____/jdom.jar!/-" {
permission java.security.AllPermission;
};


--
To unsubscribe, e-mail:

<mailto:tomcat-user-unsubscribe@;jakarta.apache.org>

For additional commands, e-mail:

<mailto:tomcat-user-help@;jakarta.apache.org>

--
To unsubscribe, e-mail:
<mailto:tomcat-user-unsubscribe@;jakarta.apache.org>
For additional commands, e-mail:
<mailto:tomcat-user-help@;jakarta.apache.org>


--
To unsubscribe, e-mail:

<mailto:tomcat-user-unsubscribe@;jakarta.apache.org>

For additional commands, e-mail:

<mailto:tomcat-user-help@;jakarta.apache.org>

--
To unsubscribe, e-mail: <mailto:tomcat-user-unsubscribe@;jakarta.apache.org>
For additional commands, e-mail: <mailto:tomcat-user-help@;jakarta.apache.org>