server.policy question

[evsrao]

I see that default JBoss's server.policy has grant all permissions in the server.policy. Is there any specified set of permissions required for JBoss to function? I didn't find any such information in the docs. Building a server.policy with required permissions from scratch seems to be a cumbersome process. Why JBoss is giving default grant all rather than the required set of permissions. Any pointers?

Thanks.

[starksm64]

The server.policy is an obsolete and unused file unless you specifically refer to it in your security manger configuration of the jvm.

[evsrao]

Could you please elaborate how JBoss works with security manager? or no need to use security.policy at all? What is the recommend approach followed in production deployments? I see that this is somewhat different compared to other application servers.

Thanks much.

[anil.saldhana]

http://docs.jboss.org/jbossas/jboss4guide/r2/html/ch8.chapter.html

[spambob]

Instead of confusing J2EE security with the Java Security Manager (as anil did), or making up completely nonsense comments(like scott did), maybe JBoss should write a sensible server.policy that could be used in the real world where you want to use the Java 2 Security Model to restrict things like which Sockets can be opened, which classes can be loaded by which other classes...
If you don't know how to do it, you can read about it on Weblogic documentation
http://edocs.bea.com/wls/docs81/security/server_prot.html#1032249