Moving picketbox to Github
by Stuart Douglas
Hi,
Are there any plans to move Picketbox to github? It makes it much easer for people outside the security team to submit fixes etc.
Stuart
11 years, 8 months
Permission API, Implementation and Quickstart
by Anil Saldhana
Hi Shane/Pedro,
can we have a discussion on the Permission API,Implementation and
Quickstart on this mailing list to see if we have any feedback from the
other teams? Since it will be an important feature for the next beta
release, I just want to get people to have a peek at it. ;)
Regards,
Anil
11 years, 11 months
Java Security Policy with denying rules
by Ondra Lukas
Hi,
I've implemented Java Security Manager and Policy for using denying rules and I think that maybe someone will be interested in it. Standard Java Policy [1] uses only granting permissions and there are cases when denying rules are more comfortable than granting rules. I would like to know your opinion and get some feedback if you'll be interested. Project is called Prograde (Policy Rules Of GRanting And DEnying) and you can use it as maven artifact:
<dependency>
<groupId>net.sourceforge.pro-grade</groupId>
<artifactId>pro-grade</artifactId>
<version>1.0</version>
</dependency>
Project is also available through github [2] and some tests are in progradeTests project [3].
In the README files of these two github projects is some information about using policy with denying rules. Usage is similar as with standard policy, but you can write also deny entry (keyword "deny") instead of grant. There is a new entry named "priority" which is set to grant or deny value - it says whether grant or deny rule is used if they are in conflict. Some examples of policy files are used in [3].
I think that the main advantage of this type of policy rules and Prograde project is simplification of testing. Sometimes you want to know what behavior will your application have in case that some specific permission isn't granted. In this case you need to grant everything except that permission, so a denying rule is the best option.
There are also some imperfections, but I think that they are not so important:
- Prograde is not able to work with general expansion [4]. (property expansion works fine)
- Path used in codebase entry must contain only a-z, A-Z, 0-9 and some symbols defined in encodeSpecialCharacters protected method of net.sourceforge.prograde.policy.ProgradePolicyFile class.
I am planning to fix it in future releases.
I hope Prograde will be helpful for somebody and I'll be happy for every feedback.
Best regards,
Ondrej Lukas
[1] http://docs.oracle.com/javase/7/docs/technotes/guides/security/PolicyFile...
[2] https://github.com/olukas/pro-grade
[3] https://github.com/olukas/progradeTests
[4] http://docs.oracle.com/javase/7/docs/technotes/guides/security/PolicyFile...
11 years, 11 months
