Accessing web application JAR files from applet

Question

I've got an applet which is part of a web application.
All the web application JARs are in the webapps/myappl/WEB-INF/lib directory, and I
can't seem to place anything in that directory on the archive attribute of <OBJECT> tag.
I'm running into trouble because I'm sending objects from the servlet to the applet and keep getting classnot found during deserialization because I've missed some jar file on the archive attribute. I've had to copy lots of jar files up to where the codebase in the HTML file is to make this run. My question is this.
Is it better to just change the tomcat security policy file (catalina.policy in tomcat conf directory) so that the JARs are directly accessible and I don't have to copy them from WEB-INF/lib???? Has anyone done this before? What would the line look like?
I'm assuming that I have to follow the instructions (THAT I DON'T UNDERSTAND)
at the bottom of the policy file. Can someone help me out here????
should I have something like
grant codeBase "file:${catalina.home}/webapps/myappl/WEB-INF/classes/-"
{ permission java.security.AllPermission; };
grant codeBase "file:${catalina.home}/webapps/myappl/WEB-INF/lib/-"
{ permission java.security.AllPermission; };
Will this allow me to place references to jar files (and the classes directory) in the archive attribute, such as
<OBJECT .....  >
    <param name="archive" value="../WEB-INF/lib/applet.jar,../WEB-INF/lib/someapp.jar,../WEB-INF/classes" />trailer for catalina.policy is
// You can assign additional permissions to particular web applications by
// adding additional "grant" entries here, based on the code base for that
// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
// Different permissions can be granted to JSP pages, classes loaded from
// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
// directory, or even to individual jar files in the /WEB-INF/lib/ directory.
// For instance, assume that the standard "examples" application
// included a JDBC driver that needed to establish a network connection to the
// corresponding database and used the scrape taglib to get the weather from
// the NOAA web server.  You might create a "grant" entries like this:
// The permissions granted to the context root directory apply to JSP pages.
// grant codeBase "file:${catalina.home}/webapps/examples/-" {
//   permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
//   permission java.net.SocketPermission "*.noaa.gov:80", "connect";
// The permissions granted to the context WEB-INF/classes directory
// grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/classes/-" {
// The permission granted to your JDBC driver
// grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/lib/driver.jar" {
//   permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
// The permission granted to the scrape taglib
// grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/lib/scrape.jar" {
//   permission java.net.SocketPermission "*.noaa.gov:80", "connect";
// };

Answer 1

Thank you for your reply.
As I mentioned in my first post I had seen a couple of posts mentioning ServletContext before, but dismissed them as I am not using any servlets of my own. However, since you showed me exactly how it was used I realised I could probably just use a dummy servlet to get this information.
The following page suggests a couple of techniques for doing just this.
http://www.jguru.com/forums/view.jsp?EID=1087411
So I think that's me sorted, cheers.