Mailing-List: contact derby-dev-help@db.apache.org; run by ezmlm
Precedence: bulk
Reply-To: <derby-dev@db.apache.org>
Received-SPF: neutral (asf.osuosl.org: local policy)
Message-ID: <44DA1A81.3030102@sbcglobal.net>
Date: Wed, 09 Aug 2006 10:25:21 -0700
From: Kathey Marsden <kmarsdenderby@sbcglobal.net>
Reply-To: kmarsdenderby@sbcglobal.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
 rv:1.7.13) Gecko/20060414
MIME-Version: 1.0
To: derby-dev@db.apache.org
Subject: Re: Security Manager Testing coverage if user code does not have
 access to the database directory
References: <44D9EB37.6020503@sbcglobal.net> <44D9F48F.2020600@apache.org>
 <44D9FBC2.9030805@sbcglobal.net> <44DA0793.5060709@apache.org>
In-Reply-To: <44DA0793.5060709@apache.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Daniel John Debrunner wrote:

> someone (I
>think you) had already prepared it by running the network server under
>the security manager.
>
>  
>
You know since you brought this up, I have an ancient history question 
for you.    I did put that in many years ago.
At the time I  thought network server offered a good framework for 
testing  under security manager because we could start the server with 
restricted permissions and then get  some security manager coverage for 
Derby embedded through Network Server.    As you started working on 
bringing embedded on-line and getting the specific jar permissions 
separated, you had indicated that really the old network server testing  
didn't add much in terms of coverage, but I was always very confused by 
that, because looking back at the policy file, I see that permissions 
were restricted on the server side and I do recall the effort popping 
several bugs.  Still, I think I must have a core misunderstanding of  
security manager and wonder if you might be willing to elaborate your 
assessment  for my edification.

Thanks

Kathey