Bug 13291

Back in February, I posted the following to the ML with no replies:

******************************************************************
Is anyone else suddenly (since Feb 1) having problems with the Java security profile in cauldron ?

I have been running derby from a manual install on /usr/local and apps against it since forever.  Since Feb 1, the server fails to come up with an error attempting to listen on localhost:1527 in spite of the fact  that "listen" on localhost:0 is granted to all users and has been as far back as I can check.  Adding a specific grant for port 1527 gets the server up, but clients fail to connect with an arcane derby error that google suggests stems from lack of permission to connect.

If I put:
   grant codeBase "file:/-" {
                 permission java.security.AllPermission;
   };

at the top of the java.policy file and restart the server, all the errors go magically away.

What changed ?
******************************************************************

The problem is the following:

##################################################################


    Change in Default Socket Permissions

    The default socket permissions assigned to all code including untrusted code have been changed in this release. Previously, all code was able to bind any socket type to any port number greater than or equal to 1024. It is still possible to bind sockets to the ephemeral port range on each system. The exact range of ephemeral ports varies from one operating system to another, but it is typically in the high range (such as from 49152 to 65535). The new restriction is that binding sockets outside of the ephemeral range now requires an explicit permission in the system security policy.

    Most applications using client tcp sockets and a security manager will not see any problem, as these typically bind to ephemeral ports anyway. Applications using datagram sockets or server tcp sockets (and a security manager) may encounter security exceptions where none were seen before. If this occurs, users should review whether the port number being requested is expected, and if this is the case, a socket permission grant can be added to the local security policy, to resolve the issue.

This means that you have to explicity set the permissions for your application to be able to access the ports range between 1025 and 49151. You can therefore grant this permission by appending this line in the list of permissions granted:

Visit your Java Home Directory and access your policy file at $JAVA_HOME/jre/lib/security/java.policy and make the following changes.

grant{
     //List of granted permissions
     permission java.net.SocketPermission "localhost:1527", "listen";
}
##################################################################

This means that the MGA JDK as installed will fail for any network server application unless java.policy is modified by the user, and that means that every time the package is updated those modifications will be lost unless the package is changed to install java.policy using ".rpmnew".



Reproducible: 

Steps to Reproduce: