File permissions Socket permissions

These apply even if you arent using AWT directly. For example, if you are using Swing components to build your GUI, the AWT permissions still apply since Swing is implemented as a layer on top of AWT.

20.2.1.2 File permissions

A file permission is simply the ability to perform an operation on a file. There are four basic file operations: reading, writing, executing, and deleting. Correspondingly, there are four types of file permissions: read , write , execute , and delete . Here is a permissions example granting all classes the ability to read, write, and delete™but not execute™all files in the C:temp directory and any of its subdirectories: grant { permission java.io.FilePermission C:temp - , read, write, delete; }; File permissions use a limited regular-expression syntax. A - is a recursive wildcard, and a is a local wildcard. Thus: permission java.io.FilePermission C:temp - , read, write, delete; grants permission to modify any file in C:temp or in any of its subdirectories, while: permission java.io.FilePermission C:temp , read, write, delete; grants permission to modify only files that are actually in C:temp.

20.2.1.3 Socket permissions

Socket permissions represent the operations on sockets. There are four basic socket-related operations: Resolving an address This is the process by which a human-readable name is turned into an Internet address. For example, w w w .or eilly.com is translated into 209.204.146.22. Connecting This is the actual process of creating a socket connection between two applications. Listening for connections This is the process by which server sockets listen for connections. Accepting a connection This is what happens after listening, when an instance of ServerSocket actually forms a connection with an instance of Socket . Associated with these four operations are four socket permissions: resolve , accept , listen , and accept . The distinction between listen and accept is a little strange. It helps to think of accept as accept from. That is, listen specifies on which ports a server socket is allowed to listen, while accept specifies from whom the server socket is allowed to accept connections. These permissions are also somewhat strange in that while you can grant resolve or listen , you rarely do; resolve is implied by any of the other operations, and listen is implied by accept . Socket permissions require you to specify a set of allowed computer addresses and a range of ports. Allowed addresses can be specified in any of the following forms: Hostname A single human-readable name, such as www.hipbone.com . IP address A single IP address, such as 209.220.141.161. localHost The actual string localHost , which specifies the local machine. Alternatively, if no computer is specified or if is used, localHost will be assumed. .partial_domain_specification You are allowed to use a as a wildcard operator on the lefthand side of a human- readable name. Thus, for example, .hipbone.com and .com are both perfectly valid specifications. You cannot use an asterisk as a wildcard with an IP address. For example, 209.220.141. is not a valid address specification. Allowed ports can be specified as either a single number or a range. The allowed specifications are: A single number For example, 1024 . A minus sign followed by a number This is used to specify all port numbers less than or equal to the specified number. For example, -2048 specifies all port numbers less than or equal to 2048. A number followed by a minus sign This is used to specify all port numbers greater than or equal to the specified number. For example, 2048- is used to specify all port numbers greater than or equal to 2048. Two numbers, separated by a minus sign This specifies a range of port numbers with both an upper and lower bound. For example, 2048-4096 specifies all port numbers greater than or equal to 2048 and less than or equal to 4096. Heres an example of a permission that allows classes to accept connections from any machine in the domain .oreilly.com , on any port greater than 1024: grant { permission java.net.SocketPermission .oreilly.com:1024 -, accept, connect; };

20.2.1.4 Property permissions