Fantastic! Thanks for reporting this. Your work helped me get my
application working with Clojure code in a webstart environment.
I do have a question about security in relation to step 3 where the Policy
is set. Is this the strictest policy that will work with Clojure code
compiled at runtime? Does this policy leave an application open to
security problems? My interpretation of step 3 is that all class loaders
now have all-privileges. This could be a problem if some third party jar,
which my have been compromised or contain malicious code, creates its own
class loader and loads arbitrary code from a server. All this code would
then have all permissions where it wouldn't have them without step 3. Is
my assessment correct?
Thanks,
Jason
On Tuesday, April 22, 2008 at 9:44:27 AM UTC-4, Pawel Ostrowski wrote:
>
> Hello,
>
> I managed to successfully deploy simple clojure application with java
> web start. I will share my experience here, because I had some
> problems with granting enough security privileges to run clojure
> application as java web start applet (getting AccessControlException)
> and I did not find complete solution in group's archive. Editing
> java.policy file was not an option because I wanted to share my
> application with users who might not understand java policies at all.
>
> My application is written entirely in clojure except one java class
> with static main method. This main method looks like this:
>
> public static void main(String[] args) throws Exception {
> RT.init();
> // load clj resource
> loadFromClasspath("alphabet/alphabet.clj");
> // get clojure fun
> StringReader sr = new StringReader("clojure-main");
> PushbackReader r = new PushbackReader(sr);
> IFn clojureFun = (IFn) Compiler.eval(LispReader.read(r, false,
> null, false));
> // call clojure fun
> clojureFun.invoke();
> ...
>
> So all I do here is: load clojure source file, get clojure main
> function and then call it.
>
> To run it as java web start applet I had to:
>
> 1) Include <security><all-permissions/></security> element in
> my .jnlp file.
> 2) Sign clojure.jar and my application .jar files. Instructions found
> on http://www.dallaway.com/acad/webstart/ were helpful
> 3) Put the following code in static section in class with the static
> main method:
>
> static {
> Policy.setPolicy( new Policy() {
> public PermissionCollection
> getPermissions(CodeSource codesource) {
> Permissions perms = new Permissions();
> perms.add(new AllPermission());
> return(perms);
> }
> public void refresh(){
> }
> });
> }
>
> Third step was necessary because all permissions from first step were
> granted to javaws classloader only and clojure creates it's own
> classloaders, at least I think so :).
>
> ps. This is a simple alphabet typing swing application, it measures
> your time to type whole alphabet. Time starts with typing letter a and
> ends with letter z. Space resets the game. It may be run with javaws
> from here: http://www.pasza.org/files/alphabet/alphabet.jnlp
>
> clojure code may be found in this jar:
> http://www.pasza.org/files/alphabet/alphabet.jar
>
--
You received this message because you are subscribed to the Google
Groups "Clojure" group.
To post to this group, send email to clojure@googlegroups.com
Note that posts from new members are moderated - please be patient with your
first post.
To unsubscribe from this group, send email to
clojure+unsubscr...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/clojure?hl=en
---
You received this message because you are subscribed to the Google Groups
"Clojure" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to clojure+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
