Please Help java.policy signedBy can't access file local

Question

i create keystore and signjar in web applet
run tomcat access file in local but not acess file denied
i goto edit file java.policy
grant {
     permission java.security.AllPermission;
can access file
but put SignedBy cannot access file
grant SignedBy fuangchai{
     permission java.security.AllPermission;
Please help me example file keystore,applet.jar,java.policy
to signedby access file local in webapplet
env JDE 1.5 ,javascript yui 2.8 ,prototype js,tomcat6
File html
<object classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93"
codebase="http://java.sun.com/update/1.5.0/jinstall-1_5-windows-i586.cab#Version=5,0,0,5"
width="1" height="1" >
<param name=code value="com.arg.aes.test.FileDirectoryBS.class" >
<param name=archive value="app.jar">
<param name=codebase value="." >
<param name="type" value="application/x-java-applet;version=1.5">
<param name="scriptable" value="true">
<param name="mayscript" value="true">
<param name="debug" value="false">
<comment>
<embed name="myApplet" id="myApplet"
type="application/x-java-applet;version=1.5"
code="com.arg.aes.test.FileDirectoryBS.class"
archive="app.jar"
java_codebase="."
width="1"
height="1"
scriptable="true"
mayscript="true"
pluginspage="http://java.sun.com/products/plugin/index.html#download">
<noembed>
</noembed>
</embed>
</comment>
</object>
<applet
code="com.arg.aes.test.FileDirectoryBS"
width="1"
height="1"
archive="app.jar"
name="myApplet"
codebase="."
MAYSCRIPT="true"
>
</applet>
javascript
initlistfile : function() {
          try
               var list = $("myApplet").initlistfileInDir();     
               var jsondata = list.evalJSON();
               /*alert(jsondata.dirname);
               alert(jsondata.dirpath);
               alert(jsondata.listfile.length);*/
               initTableLeft(jsondata.listfile);
          catch(e)
               alert("Exception : access denied.");
               return;
import java.applet.Applet;
import java.io.File;
import java.security.Permission;
import java.security.PermissionCollection;
import java.security.Policy;
import java.security.ProtectionDomain;
import java.text.DecimalFormat;
import java.text.NumberFormat;
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.List;
* @author fuangchai
public class FileDirectoryBS extends Applet{
public static File[] ROOTS = File.listRoots();
public static String HOME = System.getProperty("user.home");
public String listDir()
return JsonObj.makeTopDir((ROOTS.length > 0)?ROOTS : new Object[]{HOME});
public String initlistfileInDir()
return listfileInDir(null);
public String listfileInDir(String dirName)
if(null == dirName || dirName.equals(""))
System.out.println("root = " + ROOTS.length);
try {
dirName = (ROOTS.length > 0)?ROOTS[0].getPath():HOME;
catch (Exception e) {
e.printStackTrace();
return "";
System.out.println("#########################");
DirectoryDescImp obj = makeObjDir(dirName);
return (null == obj)?null:JsonObj.makeDir(obj);
public String listlinkInDir(String dirName)
if(null == dirName || dirName.equals(""))
System.out.println("root = " + ROOTS.length);
try {
dirName = (ROOTS.length > 0)?ROOTS[0].getPath():HOME;
catch (Exception e) {
e.printStackTrace();
return "";
System.out.println("#listlinkInDir#");
try {
File obj = new File(dirName);
return (null == obj)?null:JsonObj.makelinkDir(obj.getName(),obj.getPath());
} catch (Exception e) {
System.out.println("I can't access a file here! Access Denied!");
e.printStackTrace();
return null;
public boolean isEnc(File f)
//TODO
return false;
public DirectoryDescImp makeObjDir(String dirName)
System.out.println("dirName = " + dirName);
try{
File dir = new File(dirName);
String[] entries = dir.list();
if(null == dir || null == entries || entries.length <= 0)
System.out.println("Data is null or not obj." );
return null;
System.out.println("Dir List = " + dir.list().length);
System.out.println("Dir Name = " + dir.getName());
System.out.println("Dir Path = " + dir.getPath());
DirectoryDescImp dirDesc = new DirectoryDescImp();
dirDesc.setDirName(dir.getName());
dirDesc.setDirPath(dir.getPath());
List<FileDescImp> list = new ArrayList<FileDescImp>();
for(int i=0; i < entries.length; i++) {
File f = new File(dir, entries);
FileDescImp fDesc = new FileDescImp();
fDesc.setFile(f);
fDesc.setFileEncrept(isEnc(f));
list.add(fDesc);
dirDesc.setListfile(list);
return dirDesc;
catch(Exception e){
System.out.println("I can't access a file here! Access Denied!");
e.printStackTrace();
return null;
Thank you
Fuangchai Jum
Mail [email protected]
Edited by: prositron on Jan 13, 2010 7:35 AM

Answer 1

OK,
Let's say I have to intialize Environment, and call method initEnvironment() in Applet's init(). Environment class:
class Environment
     private KeyStore keyStore;
     private Enumeration<String> aliases;
     public void initEnvironment() {
          Security.addProvider(new sun.security.mscapi.SunMSCAPI());
          keyStore = KeyStore.getInstance("Windows-MY");
          keyStore.load(null);
          aliases = keyStore.aliases();
}Applet is signed, I trust signer.
Since Applet is signed I'm able to overwrite existing .java.policy under user.home.
This doesn't work if I don't have .java.policy:
grant {
  permission java.security.SecurityPermission "insertProvider.SunMSCAPI";
  permission java.security.SecurityPermission "authProvider.SunMSCAPI";
  permission java.util.PropertyPermission "jsr105Provider", "read";
  permission java.util.PropertyPermission "com.sun.xml.internal.ws.api.pipe.Fiber.serialize", "read";
  permission java.lang.RuntimePermission "setContextClassLoader";
  permission java.util.PropertyPermission "com.sun.xml.internal.ws.api.streaming.XMLStreamWriterFactory.noPool", "read";
  permission java.lang.RuntimePermission "accessDeclaredMembers";
  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
  permission java.lang.RuntimePermission "accessClassInPackage.com.sun.xml.internal.ws.fault";
  permission java.util.PropertyPermission "com.sun.xml.internal.ws.api.streaming.XMLStreamWriterFactory.woodstox", "read";
};P.S.
Does it make sense to be able to make changes to file system and not be able to make actions from above policy?!?!