1

I've defined some parameters to file /usr/lib/jvm/jre-8-oracle-x64/lib/security/java.security to comply JAVA security settings with our security policy. Some parameter I have edited are

security.overridePropertiesFile=false
jdk.tls.disabledAlgorithms= ...
jdk.certpath.disabledAlgorithms=MD2,...

It is unclear to me if a developer could set custom parameter in an application, does the JVM enforce these parameters or can they be overridden ?

I've seen there this question already about Java security Policy but I'm my case I just want the system-policy to be applied.

4
  • 1
    To prevent users overwrite security settings you can create a policy that only allow read security properties. Aug 4, 2016 at 1:10
  • @FedericoSierra it seems to be code-related (I've updated the question), and my question was certainly unclear. I rephrased it. Aug 4, 2016 at 17:10
  • 1
    To prevent users from specifying additional policy files, you can set the policy.expandProperties property to false, remove the users .java.policy entry, and makes the java.security file read only by the end users. With this you can established a sanbox that cannot be modified by end users. Aug 4, 2016 at 18:21
  • Can I find some example code to run to validate the enforcement is respected ? Aug 8, 2016 at 12:20

0

You must log in to answer this question.

Browse other questions tagged .