4.0

You granted permissions to Orchestrator applications to run local commands in the Orchestrator server host
operating system.
NOTE By setting the com.vmware.js.allow-local-process system property to true, you allow the Command
scripting class to write anywhere in the file system. This property overrides any file system access permissions
that you set in the js-io-rights.conf file for the Command scripting class only. The file system access permissions
that you set in the js-io-rights.conf file still apply to all scripting classes other than Command.
Set JavaScript Access to Java Classes
By default, Orchestrator restricts JavaScript access to a limited set of Java classes. If you require JavaScript
access to a wider range of Java classes, you must set an Orchestrator system property to allow this access.
Allowing the JavaScript engine full access to the Java virtual machine (JVM) presents potential security issues.
Malformed or malicious scripts might have access to all of the system components to which the user who runs
the Orchestrator server has access. Consequently, by default the Orchestrator JavaScript engine can access only
the classes in the java.util.* package.
If you require JavaScript access to classes outside of the java.util.* package, you can list in a configuration
file the Java packages to which to allow JavaScript access. You then set the com.vmware.scripting.rhino-
class-shutter-file system property to point to this file.
Procedure
1 Create a text configuration file to store the list of Java packages to which to allow JavaScript access.
For example, to allow JavaScript access to all the classes in the java.net package and to the
java.lang.Object class, you add the following content to the file.
java.net.*
java.lang.Object
2 Save the configuration file with an appropriate name and in an appropriate place.
3 Navigate to the following folder on the Orchestrator server system.
Option Action
If you installed Orchestrator with the
vCenter Server installer
Go to
install_directory \VMware\Infrastructure\Orchestrator\app-
server\server\vmo\conf.
If you installed the standalone
version of Orchestrator
Go to install_directory \VMware\Orchestrator\app-
server\server\vmo\conf.
4 Open the vmo.properties configuration file in a text editor.
5 Set the com.vmware.scripting.rhino-class-shutter-file system property by adding the following line
to the vmo.properties file.
com.vmware.scripting.rhino-class-shutter-file= path_to_your_configuration_file
6 Save the vmo.properties file.
7 Restart the Orchestrator server.
The JavaScript engine has access to the Java classes that you specified.
Chapter 8 Setting System Properties
VMware, Inc. 67