///////////////////////////////////////////////////////////////////////////////
//the following settings should be added to the security policy file for tomcat
//if remote document base objects will be provided for rmi access
//tomcat should be started in secure mode
//TIP: the following two java command line options can be helpful in debugging rmi problems
//adding them to the tomcat startup file produces output to the console as well as the tomcat log
//1)
//-Djava.security.debug=access,failure,policy OR -Djava.security.debug=all
//for more info use "java -Djava.security.debug=help" at command line
//2)
//-Djava.rmi.server.logCalls=true
///////////////////////////////////////////////////////////////////////////////

////////////////
//TODO-MAINTAIN: The jar names below should be updated as jars change
////////////////

//////////////////////////////////////////////////////////

//granting the AllPermission to the tomcat work directory

grant codeBase "file:${catalina.home}/work/-" {
  permission java.security.AllPermission;
};

//////////////////////////////////////////////////////////

////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

//granting the AllPermission to all jars for basic which provide cocoon functionality
// codeBase property should be the file url path to the specific jar files
//format -  file:${tomcat.home}/webapps/[yourWebappName]/WEB-INF/lib/[jarName].jar
//example1 -  file:${tomcat.home}/webapps/sdx/WEB-INF/lib/sdx.jar
//example2 -  file:${catalina.home}/webapps/sdx/WEB-INF/lib/sdx.jar

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/avalon-excalibur-vm12-20020705.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/avalon-framework-20020627.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/batik-all-1.5b2.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/bsf-2.2.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/cocoon-2.0.4.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/commons-collections-2.1.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/commons-httpclient-20020423.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/commons-logging-1.0.jar" {
permission java.security.AllPermission;
};


grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/deli-0.50.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-altrmi-common-20020916.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-altrmi-server-impl-20020916.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-altrmi-server-interfaces-20020916.jar" {
permission java.security.AllPermission;
};


grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-cli-1.0.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-collections-20020820.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-component-20020916.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-concurrent-20020820.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-datasource-vm12-20021121.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-i18n-1.0.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-instrument-20021108.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-instrument-manager-20021108.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-instrument-manager-interfaces-20021108.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-io-1.1.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-logger-20020820.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-monitor-20020820.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-naming-1.0.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-pool-20020820.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-sourceresolve-20020820.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-store-20020820.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/excalibur-xmlutil-20020820.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/fop-0.20.4.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/hsqldb-1.7.1.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/jakarta-poi-1.5.0-dev-20020408.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/jakarta-regexp-1.2.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/jena-1.3.0.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/jfor-0.7.0.jar" {
permission java.security.AllPermission;
};


grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/jimi-1.0.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/jing-20020724.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/jisp_1_0_2.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/jstyle.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/jtidy-sdx.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/logkit-20020529.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/maybeupload_1-0-5pre3.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/mm.mysql-2.0.11-bin.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/pizza-1.1.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/rdffilter.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/resolver-20020130.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/rhino-1.5r3.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/saxon-6.5.2.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/velocity-1.2.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/xalan-2.3.1.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/xercesImpl-2.0.0.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/xml-apis.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/xmldb-api-20011111.jar" {
permission java.security.AllPermission;
};

grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/xt-19991105.jar" {
permission java.security.AllPermission;
};

////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////


////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
//granting specific permissions to the lucene and sdx jars for rmi purposes
// codeBase property should be the file url path to the specific jar files
//format -  file:${tomcat.home}/webapps/[yourWebappName]/WEB-INF/lib/[jarName].jar
//example1 -  file:${tomcat.home}/webapps/sdx/WEB-INF/lib/sdx.jar
//example2 -  file:${catalina.home}/webapps/sdx/WEB-INF/lib/sdx.jar
//the permission entry : permission java.io.FilePermission "<<ALL FILES>>", "read,execute,write,delete";
//is needed in these two "grant" entries to override a limitation in tomcat security that only grants "read"
//access on each specific webapp (sdx) directory, so we override this with the "<<ALL FILES>>" path permission

//granting the necessary privileges to the lucene jar
grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/lucene-1.3-dev1-20021205.jar" {

	//allowing lucene to read and write properties
	permission java.util.PropertyPermission "*", "read, write";

	//allowing the lucene jar to have full file access to override tomcat security limitations
	permission java.io.FilePermission "<<ALL FILES>>", "read,execute,write,delete";

	//for internal rmi registrations, we grant code connections between the java rmi code and the lucene jar on the local machine
	permission java.net.SocketPermission "localhost", "listen,connect,accept,resolve";
    // and/or the below line maybe necessary depending on your network configuration
    //permission java.net.SocketPermission "[machineIpAddress]", "listen,connect,accept,resolve";

	//to accept connections from a client machine from which the rmi request will be made a
	//java.net.SocketPermission must be granted with specifiying the "accept" action (see last line in this grant entry)
    //the "host" name can be a machine name or an ip address, a port or port range can also be specified
	//see http://java.sun.com/j2se/1.4/docs/guide/security/permissions.html#SocketPermission for more information
	//permission java.net.SocketPermission "[host]", "accept";
};


//granting the necessary privileges to the sdx jar
grant codeBase "file:${catalina.home}/webapps/sdx/WEB-INF/lib/sdx.jar"{

	//allowing sdx to read and write properties
	permission java.util.PropertyPermission "*", "read, write";

	//allowing the sdx jar to have full file access to override tomcat security limitations
	permission java.io.FilePermission "<<ALL FILES>>", "read,execute,write,delete";

	//for internal rmi registrations, we grant code connections between the java rmi code and the sdx jar on the local machine
	permission java.net.SocketPermission "localhost", "listen,connect,accept,resolve";
	// and/or the below line maybe necessary depending on your network configuration
    //permission java.net.SocketPermission "[machineIpAddress]", "listen,connect,accept,resolve";

	//to accept connections from a client machine from which the rmi request will be made a
	//java.net.SocketPermission must be granted with specifiying the "accept" action (see last line in this grant entry)
    //the "host" name can be a machine name or an ip address, a port or port range can also be specified
	//see http://java.sun.com/j2se/1.4/docs/guide/security/permissions.html#SocketPermission for more information
	//permission java.net.SocketPermission "[host]", "accept";

};

////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
