Problem of granting permissions for a signed applet

Question

I'm writing an applet, which needs to
1. write a file into client file system, then
2. launch an application to edit this file, then
3. read the edited content from the file
Obviously, all the above 3 steps are restricted operations, they are not allowed for an applet by default. So I suppose that if the applet is signed, it will get the additional permissions. And because I want this applet work for both IE and NS browser, I choose to use Java Plug-in.
But base on the Java 2 Security Tutorial, it seems I can't specify the permissions in the jar. I can only sign my applet, let the end user knows this applet comes from me. And it's the end user's job to run the policytool program, and give the "FilePermission" of "read, write, delete, execute" to the code signed by me(or download from a specific codebase, or both), if they decide to "trust" me.
I can't imagine how to make the business user understand the Security concept of Java, and ask them to configure their system properly. It's just a mission impossible! So, did I miss some important part in the signning process? Is there such a way which keeps the policy setting for this applet in the signed jar, so the business user only need to click "Grant" to allow it running?
Thank you very much.
Kevin Zhang
P.S. some interesting facts confuse me:
1. I signed the jar (which I'm not sure if I signed it currectly, I will tell you why later), and converted the <applet> tag to <object> tag for IE. It works, which makes me confused :-) Because I didn't specify the permissions at all, neither in the code nor in the signning process. Should I consider that by default it gives all the permissions?
2. Same jar file. I use the original <applet> tag on Netscape 6.2, which use java plug-in to handle <applet> tags. This time an AccessControlException is thrown. I can understand that's obviously because of no permission. But both this one and the above one are using same JRE 1.3.1_01 plug-in, why they behave differently?

Answer 1

Hi Kevin
I have the exactly the same requirement as yours....
(1. write a file into client file system, then
2. launch an application to edit this file, then
3. read the edited content from the file).
Plz go thru the following. I signed my applet as follows:-
makecert -sk exec -n "CN=Hemanth" exec.cer
cert2spc exec.cer exec.spc
javac ExecNP.java (ExecNP.java is the applet code. I have given the code of the applet)
cabarc -s 6144 n exec.cab ExecNP.class
setreg 1 true
signcode -j javasign.dll -jp exec.ini -spc exec.spc -k exec exec.cab
chkjava exec.cab
Code of ExecNP.java :-
import com.ms.security.*;
import com.ms.security.permissions.*;
import java.lang.Runtime.*;
public class ExecNP extends java.applet.Applet
public void init()
     try {
          PolicyEngine.assertPermission(PermissionID.EXEC);
          Runtime.getRuntime().exec("c:\\windows\\notepad.exe");
     } catch(Exception e) {
Here is the html code :-
<applet code=ExecNP width=800 height=200> <PARAM NAME='cabbase' VALUE='exec.cab'> </applet>
When I try to open this html file I get the following exception in the Java Console
java.lang.UnsatisfiedLinkError: initPolicyEngine
Please tell me whats wrong.
Hemanth.