public class PrintHome {
   public static void main(String\[\] argv) {
      System.out.println(System.getProperty("user.home"));
   }
}

$ java -Djava.security.manager PrintHome
Exception in thread "main" java.security.AccessControlException: access denied
(java.util.PropertyPermission user.home read)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:264)
at java.security.AccessController.checkPermission(AccessController.java:427)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1285)
at java.lang.System.getProperty(System.java:627)
at PrintHome.main(PrintHome.java:5)

grant codeBase "file:/home/cid/Projects/CustomSecurityManager/"
{permission java.util.PropertyPermission "user.home", "read";};

$ java -Djava.security.policy=policy.txt -Djava.security.manager PrintHome
/home/u

$ java -classpath .:classes \
-Djava.security.manager=com.homosuperiorus.security.ProfilingSecurityManager \
PrintHome

grant codeBase "file:/home/cid/Projects/CustomSecurityManager/"
{permission java.util.PropertyPermission "user.home", "read";};

$ java -classpath .:classes \
-Djava.security.manager=com.homosuperiorus.security.ProfilingSecurityManager \
PrintHome | parsecodebase.pl
grant codeBase "file:/home/cid/Projects/CustomSecurityManager/"
{permission java.util.PropertyPermission "user.home", "read";};

#!/usr/bin/perl -w

use strict 'vars';
use strict 'subs';
use Uniq;   # See http://search.cpan.org/~syamal/Uniq-0.01/Uniq.pm

# Usage:  $0 < logs/catalina.out

# Extract all rules from stdin
my @grantList= uniq sort grep(/^grant/,<STDIN>);

# Extract all codeBase instances
my @codeBaseList;
foreach my $j (@grantList) {
   $j =~ m/"(.*?)"/;
   push @codeBaseList, $1;
}

# Keep only unique codebase instances
@codeBaseList = uniq sort @codeBaseList;

# For each unique codebase, extract all rules containing it and print aggregated rules
foreach my $k (@codeBaseList) {
   my @tlist = uniq sort grep(/^grant codeBase \"$k/,@grantList);
   print "grant codeBase \"$k\" {\n";
   foreach my $n (@tlist) {
      $n =~ m/\{(.*)\}/;
      print "   $1\n";
   }
   print "};\n\n"
}

$ $CATALINA_HOME/bin/startup.sh -security

#!/bin/sh

log=$CATALINA_HOME/logs/catalina.out

/java/jdk/jdk1.5.0_06/bin/java \
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager \
-Djava.util.logging.config.file=/home/tomcat/tomcat/conf/logging.properties \
-Djava.endorsed.dirs=/home/tomcat/tomcat/common/endorsed \
-classpath :/home/tomcat/tomcat/bin/bootstrap.jar:/home/tomcat/tomcat/bin/commons
-logging-api.jar \
-Djava.security.manager \
-Djava.security.policy==/home/tomcat/tomcat/conf/catalina.policy \
-Dcatalina.base=/home/tomcat/tomcat \
-Dcatalina.home=/home/tomcat/tomcat \
-Djava.io.tmpdir=/home/tomcat/tomcat/temp org.apache.catalina.startup.Bootstrap \
start >> $log 2>&1 &

#!/bin/sh

log=$CATALINA_HOME/logs/catalina.out
PATHTOPSM=classes

/java/jdk/jdk1.5.0_06/bin/java \
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager \
-Djava.util.logging.config.file=/home/tomcat/tomcat/conf/logging.properties \
-Djava.endorsed.dirs=/home/tomcat/tomcat/common/endorsed \
-classpath $PATHTOPSM:/home/tomcat/tomcat/bin/bootstrap.jar:/home/tomcat/tomcat/b
in/commons-logging-api.jar \
-Djava.security.manager=com.homosuperiorus.security.ProfilingSecurityManager \
-Djava.security.policy==/home/tomcat/tomcat/conf/catalina.policy \
-Dcatalina.base=/home/tomcat/tomcat \
-Dcatalina.home=/home/tomcat/tomcat \
-Djava.io.tmpdir=/home/tomcat/tomcat/temp org.apache.catalina.startup.Bootstrap \
start >> $log 2>&1 &

$ parsecodebase.pl < $CATALINA_HOME/logs/catalina.out > yourpolicy.txt

$ export CATALINA_OPTS=-Djava.security.debug=access,failure

access: access denied (java.util.PropertyPermission log4j.defaultInitOverride write)

access: domain that failed ProtectionDomain
 (file:/u/homer/apache-tomcat-5.5.12/webapps/crmrpc/WEB-INF/classes/org/binky/crm/CRMContextInit.class

// This is App.java
package com.homosuperiorus;

import static java.lang.System.out;
import java.net.*;

public class App {

   private void doSomething() {
      // Get a system property
      String userHome = System.getProperty("user.home");
      out.println("user home: " + userHome);

      // Make a network call
      try {
         Socket sock = new Socket("localhost",80);
         sock.close();
      }
      catch (Exception e) {
         ;
      }

      // Call code we know to exist in a jar file
      JarCode jc = new JarCode();
      jc.doSomething();
   }

   public static void main(String[] argv) {
      App app = new App();
      app.doSomething();
   }
}

// This is JarCode.java
package com.homosuperiorus;

import static java.lang.System.out;

public class JarCode {
   public void doSomething() {
      String s = System.getProperty("java.version");
      out.println("I am JarCode/ Java version: " + s);
   }
}

$ cat make.sh
#!/bin/sh

classes=classes
mkdir -p $classes
rm -rf $classes/*

javac -d ${classes} App.java JarCode.java ProfilingSecurityManager.java

# Force some of the runtime code to come from a jar file, as this generates
# unique CodeSources for our policy file rules.

(cd $classes;
jar cf ../externaljar.jar com/homosuperiorus/JarCode.class
rm com/homosuperiorus/JarCode.class
)

$ cat run.sh
#!/bin/sh

pkg=com.homosuperiorus
debug=-Djava.security.debug=access,failure
sm=-Djava.security.manager=${pkg}.security.ProfilingSecurityManager

java ${sm} ${debug} -classpath classes:externaljar.jar ${pkg}.App

$ sh run.sh |parsecodebase.pl |tee apolicy.txt
grant codeBase "file:/home/cid/Projects/CustomSecurityManager/classes/" {
   permission java.io.FilePermission "/dev/random", "read";
   permission java.io.FilePermission "/dev/urandom", "read";
   permission java.io.FilePermission
"/home/cid/Projects/CustomSecurityManager/classes/com/homosuperiorus/JarCode.class",
"read";
   permission java.io.FilePermission
"/home/cid/Projects/CustomSecurityManager/externaljar.jar", "read";
   permission java.io.FilePermission
"/home/cid/java/jdk/jdk1.5.0_06/jre/lib/i386/libnet.so", "read";
   permission java.io.FilePermission
"/home/cid/java/jdk/jdk1.5.0_06/jre/lib/net.properties", "read";
   permission java.lang.RuntimePermission "loadLibrary.net", "";
   permission java.lang.reflect.ReflectPermission "suppressAccessChecks", "";
   permission java.net.NetPermission "getProxySelector", "";
   permission java.net.NetPermission "specifyStreamHandler", "";
   permission java.net.SocketPermission "127.0.0.1:80", "connect,resolve";
   permission java.net.SocketPermission "localhost", "resolve";
   permission java.security.SecurityPermission "getProperty.securerandom.source", "";
   permission java.security.SecurityPermission "putProviderProperty.SUN", "";
   permission java.util.PropertyPermission "impl.prefix", "read";
   permission java.util.PropertyPermission "java.home", "read";
   permission java.util.PropertyPermission "java.net.preferIPv4Stack", "read";
   permission java.util.PropertyPermission "java.net.preferIPv6Addresses", "read";
   permission java.util.PropertyPermission "java.net.useSystemProxies", "read";
   permission java.util.PropertyPermission "java.security.egd", "read";
   permission java.util.PropertyPermission "java.version", "read";
   permission java.util.PropertyPermission "sun.net.spi.nameservice.provider.1","read";
   permission java.util.PropertyPermission "user.home", "read";
};

grant codeBase "file:/home/cid/Projects/CustomSecurityManager/externaljar.jar" {
   permission java.util.PropertyPermission "java.version", "read";
};

$ java -classpath .:classes:externaljar.jar \
-Djava.security.manager -Djava.security.policy=apolicy.txt com.homosuperiorus.App
user home: /home/cid
I am JarCode/ Java version: 1.5.0_06

/*

* Copyright (c) 2006 Mark Petrovic <mspetrovic@gmail.com>
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
* OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*
* Original Author: Mark Petrovic <mspetrovic@gmail.com>
* */

package com.homosuperiorus.security;

import static java.lang.System.out;

import java.lang.reflect.Field;

import java.net.URL;
import java.security.AccessController;
import java.security.AccessControlContext;
import java.security.CodeSource;
import java.security.Permission;
import java.security.ProtectionDomain;
import java.util.ArrayList;

/**
 * <code>ProfilingSecurityManager</code> is a Java security manager that profiles
 * what resources an application accesses, and in what manner --- e.g., read,
write, etc.  It does not
enforce a
 * security policy, but rather produces a starting point for crafting one.
 * <p>
 * It extends <code>java.lang.SecurityManager</code> and overrides the two forms
of the <code>checkPerm
ission()</code> method.
 * For each call to <code>checkPermission()</code>,
<code>ProfilingSecurityManager</code> first guards
against the
 * condition that it itself induced the call to <code>checkPermission()</code>,
which would result in
 * unterminated recursion.  If a call to <code>checkPermission()</code> resulted
from a call outside
 * <code>ProfilingSecurityManager</code>, the current context is examined and each
class found therein
is
 * profiled as needing access to the
<code>java.security.Permission</code> in question.
 *
 * Profiling is manifested as a writing to <code>System.out</code> a "grant"
rule for each <code>java.s
ecurity.Permission</code> requested
 * on a per <code>CodeBase</code> basis.
 *
 * @author Mark S. Petrovic
 */

public class ProfilingSecurityManager extends SecurityManager {

   /* Variables of pure convenience */
   private String thisClassName;
   private Class thisClass;
   private ClassLoader cl;

   public ProfilingSecurityManager() {
      cl = this.getClass().getClassLoader();
      thisClassName=this.getClass().getName();
      thisClass = this.getClass();
   }

   // -----------------

   // With a Permssion and AccessControlContext, we can build and print a rule
   private void buildRules(Permission permission, AccessControlContext ctx) {
      ProtectionDomain[] protectionDomain = getProtectionDomains(ctx);
      for(int i=0;i<protectionDomain.length;++i) {
         printRule(permission, protectionDomain[i]);
      }
   }

   // -----------------

   /*
      Traverse the stack, returning true if the stack indicates we called ourselves.
      Avoid recursion that can occur in the course of getting ProtectionDomain's and such.
   */
   private boolean isRecur(StackTraceElement[] st) {
      boolean v = false;
      for(int i=st.length-1;i>=1;--i) {
         boolean c = st[i].getClassName().equals(thisClassName);
         boolean m = st[i].getMethodName().equals("buildRules");
         if (c && m)  {
            v = true;
            break;
         }
      }
      return v;
   }

   // -----------------

   @Override
   public void checkPermission(Permission permission) {
      Throwable t = new Throwable("Profiler stack probe");
      StackTraceElement[] stack = t.getStackTrace();
      // Avoid recursion owing to actions in this class itself inducing callbacks
      if( !isRecur(stack) ) {
         buildRules(permission, AccessController.getContext());
      }
   }

   @Override
   public void checkPermission(Permission permission, Object context) {
      buildRules(permission, (AccessControlContext)context);
   }

   // -----------------

   /* Get the protection domains by Java reflection.  There is no public API for this info.
    * Making this code JVM implementation dependent!!!
    */
   private ProtectionDomain[] getProtectionDomains(AccessControlContext context) {
      ProtectionDomain[] pda = null;
      try {
         Field[] fields = AccessControlContext.class.getDeclaredFields();
         for(int i=0; i<fields.length; ++i ) {
            if( fields[i].getName().equals("context") ) {  // Warning:  JVM-dependent
               fields[i].setAccessible(true);
               Object o = fields[i].get(context);
               pda = (ProtectionDomain[] )o;
               break;
            }
         }
      }
      catch (IllegalAccessException e) {
         e.printStackTrace();
      }
      finally {
         return pda;
      }
   }

   // -----------------

   /* Now that we have a Permission and a ProtectionDomain, we can construct a grant rule
   */
   private void printRule(Permission permission, ProtectionDomain pd) {
         CodeSource cs = pd.getCodeSource();
         if( null == cs ) {
            out.println("csnull: " + pd.toString());
            return;
         }
         URL url = cs.getLocation();

         // don't print rules for the security manager codebase itself
         CodeSource thisCodeSource = thisClass.getProtectionDomain().getCodeSource();
         URL thisCodeSourceURL = thisCodeSource.getLocation();
         if( url.toString().equals(thisCodeSourceURL.toString()) ) {
            return;
         }

         StringBuilder sb = new StringBuilder("grant codeBase \"");
         sb.append(url.toString());
         sb.append("\" {");
         sb.append("permission ");
         sb.append(" ");
         sb.append(permission.getClass().getName());
         sb.append(" ");
         sb.append("\"");
         sb.append( permission.getName().replace("\"","\\\"") );
         sb.append("\", ");
         sb.append("\"");
         sb.append(permission.getActions());
         sb.append("\";");
         sb.append("};");

         out.println(sb);
   }

 // -----------------

   @Override
   public String toString() {
      return "SecurityManager:  ProfilingSecurityManagerr";
   }

}