db-derby-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Knut Anders Hatlen (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (DERBY-6438) Explicitly grant SocketPermission "listen" in default server policy
Date Thu, 16 Jan 2014 12:22:20 GMT

    [ https://issues.apache.org/jira/browse/DERBY-6438?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13873317#comment-13873317

Knut Anders Hatlen commented on DERBY-6438:

The JVM security change is described in the JDK 7u51 release notes under the header "Change
in Default Socket Permissions": http://www.oracle.com/technetwork/java/javase/7u51-relnotes-2085002.html

The JDK release notes also have a more specific section about the problems this change causes
for the Derby network server (look for "Additional permission needed to run Java DB network
server") and how to resolve them. The Derby release note for this issue could probably contain
much of the same information.

> Explicitly grant SocketPermission "listen" in default server policy
> -------------------------------------------------------------------
>                 Key: DERBY-6438
>                 URL: https://issues.apache.org/jira/browse/DERBY-6438
>             Project: Derby
>          Issue Type: Improvement
>          Components: Network Server
>    Affects Versions:
>            Reporter: Knut Anders Hatlen
>            Assignee: Knut Anders Hatlen
>             Fix For:,,,,,,
>         Attachments: d6438-1a.diff
> The network server needs SocketPermission "listen" on the port that it listens to, but
this permission is not granted by the basic server policy that's installed by default. This
doesn't cause any problems in most cases, since the JVM's default policy grants all code bases
SocketPermission "listen" on a range of ports, and Derby's network server port is within that
> Still, the network server should not rely on this fact. It is possible to run the network
server on any port, not only those ports that happen be in the range that's given carte blanche
by the platform's default policy. The network server will however not be able to run on those
ports with the basic policy currently, only with a custom policy or with the security manager
> The default policy should make this permission explicit.

This message was sent by Atlassian JIRA

View raw message