|
@@ -94,9 +94,44 @@ grant codebase "${org.postgresql.pljava.codesource}" {
|
|
|
// code, or to its specific jar, etc.).
|
|
|
//
|
|
|
grant principal org.postgresql.pljava.PLPrincipal$Sandboxed * {
|
|
|
- //permission java.security.AllPermission;
|
|
|
permission java.lang.RuntimePermission
|
|
|
"createClassLoader";
|
|
|
+ permission java.lang.RuntimePermission
|
|
|
+ "getClassLoader";
|
|
|
+ permission java.util.PropertyPermission
|
|
|
+ "user.home", "read";
|
|
|
+ permission java.util.PropertyPermission
|
|
|
+ "sword.home", "read";
|
|
|
+ permission java.util.PropertyPermission
|
|
|
+ "jsword.home", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/usr/share/sword", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/usr/share/sword/-", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/usr/share/sword/mods.d", "read,write";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/usr/share/sword/mods.d/*", "read,write";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/var/lib/postgresql", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/var/lib/postgresql/.jsword", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/var/lib/postgresql/.jsword/-", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/var/lib/postgresql/.sword/-", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "./sword.conf", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "./mods.d", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "../library/mods.d", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/etc/sword.conf", "read";
|
|
|
+ permission java.io.FilePermission
|
|
|
+ "/usr/local/etc/sword.conf", "read";
|
|
|
+ //permission java.io.FilePermission
|
|
|
+ // "<<ALL FILES>>", "read";
|
|
|
};
|
|
|
|
|
|
|
|
@@ -108,9 +143,6 @@ grant principal org.postgresql.pljava.PLPrincipal$Sandboxed * {
|
|
|
// to its specific jar, etc.).
|
|
|
//
|
|
|
grant principal org.postgresql.pljava.PLPrincipal$Unsandboxed * {
|
|
|
- //permission java.security.AllPermission;
|
|
|
- //permission java.lang.RuntimePermission
|
|
|
- // "createClassLoader";
|
|
|
// Java does not circumvent operating system access controls; this grant
|
|
|
// will still be limited to what the OS allows a PostgreSQL backend process
|
|
|
// to do.
|
|
@@ -129,7 +161,5 @@ grant principal org.postgresql.pljava.PLPrincipal$Unsandboxed * {
|
|
|
// and DROP LANGUAGE to remove it when undeployed.
|
|
|
//
|
|
|
grant principal org.postgresql.pljava.PLPrincipal$Sandboxed "java_tzset" {
|
|
|
- //permission java.lang.RuntimePermission
|
|
|
- // "createClassLoader";
|
|
|
permission java.util.PropertyPermission "user.timezone", "write";
|
|
|
};
|