Appendix A. Java Security Manager and EKM Scripting

Engineering Knowledge Manager

Administration Guide |

16.3.1. Restoring Procedure |  | Appendix B. Built-in Types - Reference
Prev |  | Next

## Appendix A. Java Security Manager and EKM Scripting

The EKM server makes use of the Java Security Manager to prevent scripts executing on the server from performing malicious operations. These operations could be done intentionally by a knowledgeable script developer or inadvertently by a novice one. One of the main things the security manager prevents is allowing scripts to arbitrarily read and write files anywhere on the server’s file system. By default, scripts in EKM 18.2 will only be able to read and write files in the `EKM_TEMP` directory of the server. Other limitations placed on scripts are the ability to start processes and access network resources exposed to the server. In instances where a script has attempted to perform some privileged operation, the system will report an access violation. For example, if a script attempted to write a file to the server’s root directory, the following error would be encountered:

    access denied (java.io.FilePermission C:\foo.txt write)

In some instances, there may be EKM users that have valid reasons to develop scripts that perform operations expressly forbidden by the default security policy. In these instances, you have a way to grant the script the necessary privileges to perform the operation. This is done by modifying the scripting security policy. The scripting security policy is defined in a file called script.policy that is located in `EKM_HOME/conf`. The default file is as follows:

    //
    // Any custom permissions that are needed for script execution can be applied in this file
    // Example:
    // grant {
    //	    permission java.io.FilePermission "${jboss.home.dir}/domain/servers/-", "read";
    //    };
    //
    //
    //

Note: The default script policy grants read access to the `/modules` and `/domain/servers` directories. These values are not listed in the script.policy file but are embedded within EKM. Any additional permissions that are needed can be added to the script.policy file as defined within this appendix.

To grant privileges to scripts running on the server, you must insert the appropriate permission entries within the brackets "`{}`" of the grant statement. For detailed information on the syntax of the policy file, refer to the Java documentation located here:

http://docs.oracle.com/javase/7/docs/technotes/guides/security/PolicyFiles.html#FileSyntax

Because a likely permission needed by scripts is to access files or folders outside of the server’s `EKM_TEMP` directory, the following is an example entry in the policy for providing scripts with this capability.

    grant {
        permission java.io.FilePermission "C:\\users\\jsmith\\data", "read";
    };

In the above example, scripts executing on the server are granted permission to read files in `C:\users\jsmith\data` as well as the server’s `EKM_TEMP` directory. If the scripts also needed to access files within subdirectories of `C:\users\jsmith\data`, the permission entry would look as follows:

    grant {
        permission java.io.FilePermission "C:\\users\\jsmith\\data\\-", "read";
    };

The "-" at the end of the path indicates that this permission is applied to the specified directory as well as any subdirectories. If write permission is needed within a directory, the entry would look like this:

    grant {
        permission java.io.FilePermission "C:\\users\\jsmith\\data", "read,write";
    };

Once the script.policy file has been edited with the appropriate permission entries and saved, you simply need to execute the script again. Assuming the appropriate permission entries were placed in the policy, the script will execute without any access violations.

Contains proprietary and confidential information of ANSYS, Inc. and its subsidiaries and affiliates.

Prev | Up / Contents | Next

Release 18.2 - © ANSYS, Inc. All rights reserved.