By default, Java applications have no security restrictions
placed on activities requested of the Java API. To use Java security
to protect a Java application from performing potentially unsafe actions,
you can enable a security manager for the JVM in which the application
runs.
About this task
The security manager enforces a security policy, which
is a set of permissions (system access privileges) that are assigned
to code sources. A default policy file is supplied with the Java platform.
However, to enable Java applications to run successfully in CICS when
Java security is active, you must specify an additional policy file
that gives CICS the permissions it requires to run the application.
You
must specify this additional policy file for each kind of JVM that
has a security manager enabled. CICS provides some examples that you
can use to create your own policies.
Procedure
- For applications that run in the OSGi framework of a JVM
server:
- Create a plug-in project in the CICS Explorer™ SDK and
select the supplied OSGi security agent example. This example
creates an OSGi middleware bundle called com.ibm.cics.server.examples.security in
your project that contains a security profile. This profile applies
to all OSGi bundles in the framework in which it is installed.
- In the project, select the example.permissions file
to edit the permissions for your security policy. This
file contains permissions that are specific to running applications
in a JVM server, including a check to ensure that applications do
not use the System.exit() method.
- Deploy the OSGi bundle to a suitable directory in zFS. CICS must have read and execute access to this directory.
- Create a policy file to give all permissions to the
Java launcher. An example policy called all.policy is
provided in the plug-in project. It is not included in the middleware
bundle, but you can copy it to a suitable directory in zFS. The policy file contains the following permissions:
grant {
permission java.security.AllPermission;
};
- Edit the JVM profile for the JVM server to add the OSGi
bundle to the OSGI_BUNDLES option before any other
bundles:
OSGI_BUNDLES=/u/bundles/com.ibm.cics.server.examples.security_1.0.0.jar,/usr/lpp/cicsts42/lib/com.ibm.cics.db2.jcc.jar
- Add the following Java environment variable to the JVM
profile to enable security in the OSGi framework:
org.osgi.framework.security=osgi
- Add the following Java security system property to the
JVM profile to specify the security policy:
-Djava.security.policy=/u/policies/all.policy
- Save your changes and enable the JVMSERVER resource
to install the middleware bundle in the JVM server.
- For applications that run in a pooled JVM, use the dfhjejbpl.policy file
to implement your security policy.
- Create a policy file for your application in the /usr/lpp/java/J6.0.1_64/lib/security/,
where java/J6.0.1_64 is
the location for the IBM® 64-bit SDK for z/OS®, Java Technology Edition.
The security manager always uses the default policy file java.policy that
is provided in this directory. If you want an application to use JDBC
or SQLJ, create a policy file to grant permissions to the JDBC driver.
You must use the JDBC 2.0 driver with Java security.
- Enable the security manager by adding the -Djava.security.manager system
property to the JVM profile. Use one of the following
formats:
- -Djava.security.manager=default
- -Djava.security.manager=""
- -Djava.security.manager=
- Specify your policy files by adding the -Djava.security.policy system
property to the JVM profile. The security manager uses
any policies set on this property in addition to the default security
policy.
Results
When the Java application is called, the JVM determines the
code source for the class and consults the security policy before
granting the class the appropriate permissions.