Granting permissions to Derby

Mandatory permissions

permission java.lang.RuntimePermission createClassLoader

Mandatory. It allows Derby to execute SQL queries and supports loading class files from jar files stored in the database.

permission java.util.PropertyPermission "derby.*", "read"

Allows Derby to read individual Derby properties set in the JVM's system set. If the action is denied, properties in the JVM's system set are ignored.

permission java.util.PropertyPermission "derby.storage.jvmInstanceId", "write"

This property is used by Derby to prevent the accidental boot of the database by two class loaders. If the database is booted by two class loaders, database corruption can occur. This permission requirement is new in Version 10.3. If write permission for this property is not granted, a message is printed to the log file which indicates that the Derby database is not protected from dual boot and possible corruption.

Database access permissions

permission java.io.FilePermission "directory${/}/-", "read,write,delete"

Allows Derby to manage files within the database that maps to the directory specified. For read-only databases, only the "read" action needs to be granted.

Optional permissions

permission java.io.FilePermission "${derby.system.home}", "read,write"

Allows Derby to determine the system directory when set by db2j.system.home and create it if needed. If the system directory already exists then only the "read" permission needs to be granted.

permission java.util.PropertyPermission "user.dir", "read"

Permits access to the system directory value if derby.system.home is not set or no permission has been granted to read the derby.system.home property.

permission java.io.FilePermission "${derby.system.home}${/}derby.properties", "read"

Allows Derby to read the system properties file from the system directory.

permission java.io.FilePermission "${derby.system.home}${/}derby.log", "read,write,delete"

permission java.io.FilePermission "${user.dir}${/}derby.log", "read,write,delete";

Only one of these permissions is needed. Permits the application to read, write, and delete to the Derby log file, unless the log has been re-directed. (See the derby.stream.error properties in Tuning Java DB for more information.) If one of the requested valid actions is denied, the Derby log will be java.lang.System.err.

permission java.security.SecurityPermission "getPolicy"

You need this permission if you want to change the security policy on the fly and reload it into a running system. Given this permission, a DBA can reload the policy file by calling the SYSCS_UTIL.SYSCS_RELOAD_SECURITY_POLICY system procedure. For more information, see the section which describes this procedure in Java DB Reference Manual.

Combining permissions

permission java.io.FilePermission "${derby.system.home}/-", "read,write,delete";