Disable IO in java app (not java -D)

Question

I don't want any program to be allowed anything more than a standard applet except when it is specified in a policy.
The code (posted below) listens to my policy file when run as an applet but ignores the java.security and java.policy when started with java.
The command "java test" gives me no exceptions at all, the default (I guess) is to allowe java apps to do what they want.
So my question is can I set the security or policy so it won't allowe anything unless specified in a policy file?
import java.util.Properties;
import java.applet.Applet;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
public class test extends Applet implements Runnable {
            public test(){
                new Thread(this).start();
         public static void main(String argv1[]) {
              new test();
            public void run(){
                 try{
                      System.out.println("java.home is: " + System.getProperty("java.home"));
                      System.out.println("user.home is: " + System.getProperty("user.home"));
                          File fle = new File(System.getProperty("user.home") + System.getProperty("file.separator") + "sometext.txt");
                             FileOutputStream outFile = new FileOutputStream(fle);
               outFile.write("hello, this is written by Java".getBytes());
               outFile.close();
                          FileInputStream inFile = new FileInputStream(fle);
                          int b = inFile.read();
                  while(b!=-1){
                               System.out.print((char) b);
                               b = inFile.read();
                      inFile.close();
                 }catch(Exception e){
                      e.printStackTrace();
// java.security:
security.provider.1=sun.security.provider.Sun
security.provider.2=com.sun.net.ssl.internal.ssl.Provider
security.provider.3=com.sun.rsajca.Provider
security.provider.4=com.sun.crypto.provider.SunJCE
security.provider.5=sun.security.jgss.SunProvider
securerandom.source=file:/dev/random
login.configuration.provider=com.sun.security.auth.login.ConfigFile
policy.provider=sun.security.provider.PolicyFile
policy.url.1=file:${java.home}/lib/security/java.policy
# the following line gives me an opportunity to give special prifs to programms and applets
# policy.url.2=file:${java.home}/lib/security/localApplet.policy
# don't want to allowe the user to change policy
# policy.allowSystemProperty=true
policy.expandProperties=true
policy.ignoreIdentityScope=false
keystore.type=jks
system.scope=sun.security.provider.IdentityDatabase
package.access=sun.
ssl.KeyManagerFactory.algorithm=SunX509
ssl.TrustManagerFactory.algorithm=SunX509
networkaddress.cache.negative.ttl=10
java.policy:
// you guessed correct thisone is empty

Answer 1

Thanx for taking the time to respond.
Sorry, I see my pref post was wrong. The code is OK but the java.policy looks loke this:
// Standard extensions get all permissions by default
//grant codeBase "file:${java.home}/lib/ext/*" {
//     permission java.security.AllPermission;
// default permissions granted to all domains
grant {
     permission java.lang.RuntimePermission "usePolicy";
};The usePolicy means that applets allways use policy to see what permissions they have.
Compiled test.class and made a html file containter:
<applet code="test.class" width="100" height="100"></applet>
When I run: appletviewer test.htm
Sure enough I get a security exception:
java.security.AccessControlException: access denied (java.util.PropertyPermission java.home read)
when I run the same code like this:
java test.class there is no exception at all, I was wondering how can I force all classes to use policy?
I think you can set your applications security manager to anything you
want.
If you can work out the Applets security manager class, you should be
able to instantiate it and set it for your application.I didn't work out the Applets security manager if you are referring to: security.provider.1=sun.security.provider.Sun in the java.security.
I just configured the policy.
Sorry for the wrong info in my pref post that might have you thinking I rewrote/subclassed the security provider.
http://java.sun.com/docs/books/tutorial/security1.2/tour2/step2.html
Tells me how to use -D but there is nothing on allways forcing policy on any class.