Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8132244

Warn users about implications of using java.security.policy== option in security guides

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not an Issue
    • Icon: P4 P4
    • 11
    • None
    • docs

        The java.security.policy system property allows the user to append (with "=") or override (with "==") a policy file. The "==" option should be used with care, as it overrides the built-in JRE policy file which grants a set of default permissions designed to provide a secure out of the box configuration for the JRE. Overriding this policy may cause strange behavior (JRE code may not be granted the right permissions) and should only be done by experienced users. Currently, there is no such warning in our guides, so we should add one to the following guides:

        * Default Policy Implementation and Policy File Syntax
           http://docs.oracle.com/javase/8/docs/technotes/guides/security/PolicyFiles.html
           (the section: "Specifying an Additional Policy File at Runtime")
        * Java Security Architecture
           http://docs.oracle.com/javase/8/docs/technotes/guides/security/spec/security-spec.doc3.html#a23883

              rgallard Raymond Gallardo
              mullan Sean Mullan
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: