Understanding java.lang.RuntimePermission

Question

I was utilizing a script I found online which allows me to call OS commands and PERL scripts from PL/SQL, using JAVA as an interface. Before things would work, the following DBMS_JAVA calls were necessary.
I think I get the last one (file permissions) but I don't understand the purpose of the first 2.
EXEC dbms_java.grant_permission('SHARED', 'SYS:java.lang.RuntimePermission', 'writeFileDescriptor', '');
EXEC dbms_java.grant_permission('SHARED', 'SYS:java.lang.RuntimePermission', 'readFileDescriptor', '');
EXEC dbms_java.grant_permission('SHARED', 'SYS:java.io.FilePermission', '/bin/sh', 'execute');
I mainly concerned as they look like they grant read/write privileges on everything (...'writeFileDescriptor', ''). java.sun.com warns that "[readFileDescriptor] ... would allow code to read the particular file associated with the file descriptor read. This is dangerous if the file contains confidential data", and that "[writeFileDescriptor]...allows code to write to a particular file associated with the descriptor. This is dangerous because it may allow malicious code to plant viruses or at the very least, fill up your entire disk."
So I'm concerned,
Chuck

Answer 1

We have since taken it that step further, and revoked access to /bin/sh, and granted it to a test PERL script /test/scripts/list_dir.pl
What is strange is that when I went out to the operating system today (Sep 16) and issued a 'ps -ef' I found the following:
[oracle@ora4 oracle]$ ps -ef | grep 5994
oracle 5994 1 0 Sep15 ? 00:10:52 ora_s001_dev
oracle 11214 5994 0 Sep15 ? 00:00:00 [list_dir.pl <defunct>]
oracle 11327 5994 0 Sep15 ? 00:00:00 [ls <defunct>]
oracle 16866 14478 0 07:56 pts/0 00:00:00 grep 5994
The processes are hanging around (I started with a more simple 'ls' just to see if this would even work - so it's there too).
Why would that be?
If it helps, here is the java code and the PL/SQL wrapper that I found at orafaq.com:
CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "Host" AS
import java.io.*;
public class Host {
public static void executeCommand(String command) {
try {
String[] finalCommand;
if (System.getProperty("os.name").toLowerCase().indexOf("windows") != -1) {
finalCommand = new String[4];
finalCommand[0] = "C:\\winnt\\system32\\cmd.exe";
finalCommand[1] = "/y";
finalCommand[2] = "/c";
finalCommand[3] = command;
} else {                              // Linux or Unix System
finalCommand = new String[3];
finalCommand[0] = "/bin/sh";
finalCommand[1] = "-c";
finalCommand[2] = command;
// Execute the command...
final Process pr = Runtime.getRuntime().exec(finalCommand);
// Capture output from STDOUT...
BufferedReader br_in = null;
try {
br_in = new BufferedReader(new InputStreamReader(pr.getInputStream()));
String buff = null;
while ((buff = br_in.readLine()) != null) {
System.out.println("stdout: " + buff);
try {Thread.sleep(100); } catch(Exception e) {}
br_in.close();
} catch (IOException ioe) {
System.out.println("Error printing process output.");
ioe.printStackTrace();
} finally {
try {
br_in.close();
} catch (Exception ex) {}
// Capture output from STDERR...
BufferedReader br_err = null;
try {
br_err = new BufferedReader(new InputStreamReader(pr.getErrorStream()));
String buff = null;
while ((buff = br_err.readLine()) != null) {
System.out.println("stderr: " + buff);
try {Thread.sleep(100); } catch(Exception e) {}
br_err.close();
} catch (IOException ioe) {
System.out.println("Error printing execution errors.");
ioe.printStackTrace();
} finally {
try {
br_err.close();
} catch (Exception ex) {}
catch (Exception ex) {
System.out.println(ex.getLocalizedMessage());
show errors
rem -----------------------------------------------------------------------
rem Publish the Java call to PL/SQL...
rem -----------------------------------------------------------------------
CREATE OR REPLACE PROCEDURE host (p_command IN VARCHAR2)
AS LANGUAGE JAVA
NAME 'Host.executeCommand (java.lang.String)';
/