Hub/Switch Installation Guide

Chapter 3 System Preparation
188 September 2002 HPSS Installation Guide
Release 4.5, Revision 2
2. The Data Serverrequiresread FilePermission on its userauthorization file,whose default
location is /var/hpss/ssm/hpssadm.config. The hpssadm utility requires read FilePermis-
sion for the user's keyfile file, the default location for which is /var/hpss/ssm/keytab
grant {
permission java.io.FilePermission "/var/hpss/-", "read";
};
Thedash ("-")in thepathname inthis examplesignifies thatthe permissionis tobe granted
to everything in the /var/hpss tree, recursively. Sites which wish to be more restrictive can
write a separate grant clause for each file or directory to which they want to allow access.
Java FilePermission is applied as an additional layer of protection on top of the local
operating system file protections, not as a replacement for them. If the Java permission is
notgranted,the applicationwillnotbe allowedto accessthefile, regardless ofthelocal file
system permissions. Ifthe Java permission isgranted but the localfile system permissions
deny access to the file, the application will not be allowed access.
3. TheDataServerandthehpssadm utilitymayrestricttheremotehostswithwhichtheywill
communicate by setting their SocketPermission.
Accordingto the documentation, and upheld by some ofour testing, youshould not need
an explicit SocketPermission in the policy file just to listen on public ports nor to connect
to applications on the same or other hosts; that permission is supposed to be granted
implicitly.Butwe'vefoundsomeimplementationsonwhich,evenwiththesystemsecurity
and policy files set the same, the applications required that at least connect and listen
permissionbegrantedexplicitlyfromapolicyfile.So,partlyforthisreason,weincludethis
permission in the default policy files for both the Data Server and hpssadm.
Theother reasonweinclude thispermission entryis thatit canbe restrictedtoa singlehost
or set of hosts and/or ports. The following example grants access to all hosts from the
ornl.gov domain:
grant {
permission java.net.SocketPermission
"*.ornl.gov:1024-",
"connect,accept,listen,resolve";
};
Sites which wish to operate under tighter security can set the Java security file so that only the
system wide policy file is recognized and specification of an alternate or additional policy file on
the Java command line is not allowed.
Seethedocumenton Javapolicy file syntax listedinSection 3.8.9.2:Referencesonpage194 formore
information on settings policies.
3.8.5 Setting up the Client Authorization File
This file must exist in order for the Data Server to be initialized, but it may be empty if there is no
desire to use the hpssadm utility.