Modifying the weblogic.policy file for General Use

Using Java Security to Protect WebLogic Resources 8-3 If you enable the Java Security Manager but do not specify a security policy file, the Java Security Manager uses the default security policies defined in the java.policy file in the JAVA_HOME\jre\lib\security directory. Define security policies for the Java Security Manager in one of the following ways: ■ Section 8.2.1.1, Modifying the weblogic.policy file for General Use ■ Section 8.2.1.2, Setting Application-Type Security Policies ■ Section 8.2.1.3, Setting Application-Specific Security Policies

8.2.1.1 Modifying the weblogic.policy file for General Use

To use the Java Security Manager security policy file with your WebLogic Server deployment, you must specify the location of the weblogic.policy file to the Java Security Manager when you start WebLogic Server. To do this, you set the following arguments on the Java command line you use to start the server: ■ java.security.manager tells the JVM to use a Java security policy file. ■ java.security.policy tells the JVM the location of the Java security policy file to use. The argument is the fully qualified name of the Java security policy, which in this case is weblogic.policy. For example: java...-Djava.security.manager \ -Djava.security.policy==c:\weblogic\weblogic.policy If you have extra directories in your CLASSPATH or if you are deploying applications in extra directories, add specific permissions for those directories to your weblogic.policy file. Oracle recommends taking the following precautions when using the weblogic.policy file: ■ Make a backup copy of the weblogic.policy file and put the backup copy in a secure location. ■ Set the permissions on the weblogic.policy file via the operating system such that the administrator of the WebLogic Server deployment has write and read privileges and no other users have access to the file. Note: Be sure to use == instead of = when specifying the java.security.policy argument so that only the weblogic.policy file is used by the Java Security Manager. The == causes the weblogic.policy file to override any default security policy. A single equal sign = causes the weblogic.policy file to be appended to an existing security policy. 8-4 Programming Security for Oracle WebLogic Server For more information about the Java Security Manager, see the Javadoc for the java.lang.SecurityManager class, available at http:java.sun.comjavase6docsapijavalangSecurityManager. html .

8.2.1.2 Setting Application-Type Security Policies