[CONFIGURATION-391] Double file permissions required in WAS 6.1

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.5
• Fix Version/s: 2.x

Environment

• WebSphere AS 6.1with J2EE securit enabled
• AIX

• Assignee: Unassigned
• Reporter: Stéphane Van Espen
• Created: 01/Jul/09 13:22
• Updated: 24/Mar/16 20:13

Description

We are using Commons Configuration as follows:

final PropertiesConfiguration config = new PropertiesConfiguration("velocity.properties");

Noteworthy points:

• properties files are embedded in JARs
• Application is deployed in WAS 6.1, where J2EE security is activated (was.policy)

Problem is the following:
Two entries are necessary in was.policy in order to make the application work.

Example:

permission java.io.FilePermission "velocity.properties","read";
permission java.io.FilePermission "/home/wasadmin/velocity.properties","read";

The first entry is valid.
The second entry (with "/home/wasadmin/...") is wrong but necesarry in order to make WebSphere happy.

We would like to remove this second entry (useless and less secure) from our was.policy.

What could be the cause of this issue ?

Thank you,