Subj : Re: [Rhino] security policy
To   : Jo <jo99_fr@yahoo.fr>
From : Igor Bukanov <igor@icesoft.com>
Date : Wed Mar 12 2003 05:36 pm

Jo wrote:
> 
> Hi,
> 
> I'm trying to restrict some of the permissions of my Rhino scripts 
> (Rhino14R5).
> For example I don't want my Rhino scripts to create their own class 
> loaders, but of course Rhino code itself should be able to do that as it 
> needs it for internal use.
> 
> For that I use a Java SecurityManager and I have a policy file that 
> looks like:
> 
> grant codeBase "file:/.../rhino.jar" {
>   permission java.lang.RuntimePermission "createClassLoader";
> }
> 
> (I also have Rhino SecurityController but with or without it, the 
> problem is the same as soon as I have a SecurityManager).
> 
> However it happens that I have some exceptions like:
> 
> java.security.AccessControlException: access denied 
> (java.lang.RuntimePermission
>  createClassLoader)

Did you try to use 
org.mozilla.javascript.tools.shell.JavaPolicySecurity, which provides an 
    implementation of SecurityController in Rhino shell, see 
http://mozilla.org/rhino/rhino15R4.html on info how to activate it in 
the shell?

Regards, Igor

.