The actual implementation is fairly trivial | public class SecurityPolicy | { | /** Whether to install the security manager */ | private SecurityManager securityManager; | | /** The policy url */ | private URL policyURL; | | /** | * Get the securityManager. | * | * @return the securityManager. | */ | public SecurityManager getSecurityManager() | { | return securityManager; | } | | /** | * Set the securityManager. | * | * @param securityManager the securityManager. | */ | public void setSecurityManager(SecurityManager securityManager) | { | this.securityManager = securityManager; | } | | /** | * Get the policyURL. | * | * @return the policyURL. | */ | public URL getPolicyURL() | { | return policyURL; | } | | /** | * Set the policyURL. | * | * @param policyURL the policyURL. | */ | public void setPolicyURL(URL policyURL) | { | this.policyURL = policyURL; | } | | @Start | public void start() | { | if (policyURL != null) | System.setProperty("java.security.policy", policyURL.toExternalForm()); | Policy.getPolicy().refresh(); | | if (securityManager != null) | System.setSecurityManager(securityManager); | } | | public void stop() | { | if (securityManager != null) | System.setSecurityManager(null); | } | } | with xml config | <bean name="SecurityPolicy" class="org.jboss.system.server.security.SecurityPolicy"> | <property name="securityManager"><javabean xmlns="urn:jboss:javabean:2.0" class="java.lang.SecurityManager"/></property> | <property name="policyURL">${jboss.server.config.url}/java.policy</property> | </bean> | I guess for management purposes, it would be better to have the policies defined directly in that xml using our own policy implementation? e.g. being able change policies from the profile service or management console? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4187499#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...