java - JNLP 对 jar 文件请求两次权限

Question

我当前正在运行 JNLP，在 Java 控制台中，我看到对于某些 jar 文件，它请求权限两次。由于我的 jar 有受信任的证书，因此它也会导致证书检查请求发送两次。以下是我在Java控制台中看到的内容

security: JAVAWS AppPolicy Permission requested for: http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar  
ruleset: finding Deployment Rule Set for   
        title: Xpert.ivy Rich Internet Application  
        location: http://192.168.72.72:8061/ivy/pro/System/Administration/1419CBE3AAB8C361.jws.jnlp;jsessionid=EF178D8454450E00CC95762C3869DD3A  
        main location: http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar  
        main version: null  
        isArtifact: true  
ruleset: no rule applies, returning Default Rule  
Missing Codebase manifest attribute for: http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar  
security: Istrusted: http://192.168.72.72:8061/ivy/pro/System/Administration/1419CBE3AAB8C361.jws.jnlp;jsessionid=EF178D8454450E00CC95762C3869DD3A false  
Missing Codebase manifest attribute for: http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar  
security: Validate the certificate chain using CertPath API  
security: SHA-256Certificate finger print: FCB73268A88D254A997683F535ACA1E3F05E8538B82FFE5F0E3F3E71E9EF81B6  
security: SHA-256Certificate finger print: 235C96A2E2DA557B904E90F3A0CAA57EABB4BDB5F401969DA8C282F60839568F  
security: SHA-256Certificate finger print: A45EDE3BBBF09C8AE15C72EFC07268D693A21C996FD51E67CA079460FD6D8873  
security: The OCSP support is enabled  
security: The CRL support is enabled  
security: Skipping revocation check, not publisher cert  
network: Connecting http://ocsp.quovadisglobal.com/ with proxy=DIRECT  
security: OCSP Response: GOOD  
security: Certificate validation succeeded using OCSP/CRL  
security: Grant socket perm for http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar : java.security.Permissions@64424952 (  
 ("java.net.SocketPermission" "192.168.72.72" "connect,accept,resolve")  
)  
security: JAVAWS AppPolicy Permission requested for: http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar  
ruleset: finding Deployment Rule Set for   
        title: Xpert.ivy Rich Internet Application  
        location: http://192.168.72.72:8061/ivy/pro/System/Administration/1419CBE3AAB8C361.jws.jnlp;jsessionid=EF178D8454450E00CC95762C3869DD3A  
        main location: http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar  
        main version: null  
        isArtifact: true  
ruleset: no rule applies, returning Default Rule  
Missing Codebase manifest attribute for: http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar  
security: Istrusted: http://192.168.72.72:8061/ivy/pro/System/Administration/1419CBE3AAB8C361.jws.jnlp;jsessionid=EF178D8454450E00CC95762C3869DD3A false  
Missing Codebase manifest attribute for: http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar  
security: Validate the certificate chain using CertPath API  
security: SHA-256Certificate finger print: FCB73268A88D254A997683F535ACA1E3F05E8538B82FFE5F0E3F3E71E9EF81B6  
security: SHA-256Certificate finger print: 235C96A2E2DA557B904E90F3A0CAA57EABB4BDB5F401969DA8C282F60839568F  
security: SHA-256Certificate finger print: A45EDE3BBBF09C8AE15C72EFC07268D693A21C996FD51E67CA079460FD6D8873  
security: The OCSP support is enabled  
security: The CRL support is enabled  
security: Skipping revocation check, not publisher cert  
network: Connecting http://ocsp.quovadisglobal.com/ with proxy=DIRECT  
security: OCSP Response: GOOD  
security: Certificate validation succeeded using OCSP/CRL  

您可以看到对 jar 文件的 JAVAWS AppPolicy Permission 请求两次(从第 26-45 行开始，与第 1-21 行相同)。

我自己的任务是导致问题的原因是这一行

security: Grant socket perm for http://192.168.72.72:8061/ivy/rdlib/syntheticaAddons-1.226.jar : java.security.Permissions@64424952 (  
 ("java.net.SocketPermission" "192.168.72.72" "connect,accept,resolve")  
)  

对于其他一些 jar 文件，上面的行(Grant socket perm)不会出现，因此该文件仅检查一次。

在这种情况下，我现在更新到 JRE 7 update 40，并在 Java 控制面板中启用“混合代码(沙盒与可信)安全验证”

然后我尝试禁用“混合代码(沙盒与可信)安全验证”，然后:

• 检查1次的jar文件(在上述情况下)是不再检查权限。
• 检查了两次的 jar 文件(在上述情况下)仍然检查了 1 次(并且仍然出现“security: Grant socket perm...”)

这里可能出现什么问题？这是一个安全错误还是我的 jar 或 JNLP 有问题？

请帮忙。非常感谢。

Answer 1

如果您的代码在java安全管理器下运行，则每种类型的操作都需要具有明确的权限。

当您为可信jar启用证书模式时，jar访问权限会以混合模式通过JVM传递，但socket访问仍然需要显式权限。

http://download.java.net/jdk8/docs/technotes/guides/security/permissions.html从安全管理员的角度列出了所有类型的权限及其风险。

连接主机的可能方式是: 接受 连接 听 解决

默认情况下，您可以连接、接受、解析到主机 192.168.72.72。