Java security manager

The Java security manager uses two default policy files:

• A global system policy file named $MQIPT_PATH/java/jre/lib/security/java.policy (where $MQIPT_PATH is the directory where MQIPT is installed) is used by all instances of a virtual machine on a host.
• A user-specific policy file called .java.policy, which can exist in the user's home directory.

You must change the following entries:

• The java.io.FilePermission entry which grants read and write access to the errors directory. The file path in this entry must refer to the MQIPT home directory, because this is where the errors directory is located. MQIPT creates FFST Failure Data Capture files (AMQ*.FDC) and trace files (AMQ*.TRC*) in the errors directory. You must ensure that MQIPT has permission to create trace and FFST files in the errors directory, so that troubleshooting is possible.
• The java.io.FilePermission entry which grants read and write access to the logs directory. The file path in this entry must refer to the MQIPT home directory, because this is where the logs directory is located. MQIPT creates connection log files (mqipt*.log) in the logs directory if the ConnectionLog global property is enabled.
• The java.io.FilePermission entries which grant read and execute access to any directories in the MQIPT installation directory, such as the bin, exits, lib, and ssl directories. The file paths in these entries must be changed to refer to the MQIPT installation directory. Some of these entries may be omitted if they are not required.
• The java.net.SocketPermission entries must be modified to control connections into each listening MQIPT route. The listen and accept permissions are required for the listener port and listener address for each MQIPT route.
• The java.net.SocketPermission entries must be modified to control connections out of each MQIPT route. The connect permission is required for any route destinations, proxy servers or LDAP servers that the MQIPT route connects to. The resolve permission is required when specifying addresses using a host name.

Depending on your configuration, you might also need to add the following entries:

• A java.io.FilePermission entry to grant read access to mqipt.conf, or the MQIPT home directory containing mqipt.conf. If you need to configure MQIPT remotely using the Administration Client then MQIPT will also need write access to mqipt.conf so that it can save configuration changes.
• A java.io.FilePermission entry to grant read access to the security policy file itself. This is useful if an MQIPT refresh causes the security policy file to be re-read.
• Some java.io.FilePermission entries to grant read access to any SSL/TLS keyring files and password stash files. This is only required when using a route which has the SSLClient or SSLServer properties enabled.
• Some java.io.FilePermission entries to grant read or execute access to any MQIPT exit classes. This is only required when an MQIPT exit is enabled. You might need to grant additional permissions if required by the exit.

Permissions are usually defined with three attributes. To control socket connections, their values are:

class permission

java.net.SocketPermission

name to control

This is made up with the format hostname:port, where each component of the name can be specified by a wildcard. The hostname can be a domain name or an IP address. The leftmost position of the host name can be specified by an asterisk (*). For example, harry.company1.com would be matched by each of these strings:

• harry
• harry.company1.com
• *.company1.com
• *
• 198.51.100.123 (assuming this is the IP address of harry.company1.com)

The port component of the name can be specified as a single port address or a range of port addresses, for example:

1414

only port 1414

1414-

all port addresses greater than or equal to 1414

-1414

all port addresses less than or equal to 1414

1-1414

all port addresses between 1 and 1414, inclusive

allowed action

The actions used by java.net.SocketPermission are:

• accept, this allows permission to accept connections from the specified target
• connect, this allows permission to connect to the specified target
• listen, this allows permission to listen on the specified port or ports for connection requests
• resolve, this allows permission to use the DNS name service to resolve domain names into IP addresses

Control of the Java security manager can also be made through the java.security.manager and java.security.policy Java system properties, but it is recommended you use the SecurityManager and SecurityManagerPolicy properties for controlling MQIPT.

To include diagnostic information in trace and FFST records, MQIPT must access certain MQIPT system properties and environment variables. You must always include the following properties in the Java security policy:

permission java.util.PropertyPermission "java.home", "read";
permission java.util.PropertyPermission "java.version", "read";
permission java.util.PropertyPermission "java.runtime.version", "read";
permission java.util.PropertyPermission "java.vm.info", "read";
permission java.util.PropertyPermission "java.vm.vendor", "read";
permission java.util.PropertyPermission "os.arch", "read";
permission java.util.PropertyPermission "os.name", "read";
permission java.util.PropertyPermission "os.version", "read";
permission java.lang.RuntimePermission "getenv.MQIPT_PATH";

If you do not include all of these properties, MQIPT will not operate correctly, and problem diagnosis will be impaired.