0.2i default The \f3default or unspecified value \f3execPolicy allows the \f3rmid command to execute commands with specific command-line options only when the \f3rmid command was granted permission to execute those commands and options in the security policy file that the \f3rmid command uses. Only the default activation group implementation can be used with the default execution policy. The \f3rmid command starts a JVM for an activation group with the information in the group's registered activation group descriptor, an \f3ActivationGroupDesc. The group descriptor specifies an optional \f3ActivationGroupDesc.CommandEnvironment that includes the command to execute to start the activation group and any command-line options to be added to the command line. By default, the \f3rmid command uses the \f3java command found in \f3java.home. The group descriptor also contains properties overrides that are added to the command line as options defined as: \f3-D<property>=<value>.The \f3com.sun.rmi.rmid.ExecPermission permission grants the \f3rmid command permission to execute a command that is specified in the group descriptor's \f3CommandEnvironment to start an activation group. The \f3com.sun.rmi.rmid.ExecOptionPermission permission enables the \f3rmid command to use command-line options, specified as properties overrides in the group descriptor or as options in the \f3CommandEnvironment when starting the activation group.When granting the \f3rmid command permission to execute various commands and options, the permissions \f3ExecPermission and \f3ExecOptionPermission must be granted to all code sources. ExecPermission The \f3ExecPermission class represents permission for the \f3rmid command to execute a specific command to start an activation group. Syntax: The name of an \f3ExecPermission is the path name of a command to grant the \f3rmid command permission to execute. A path name that ends in a slash (/) and an asterisk (*) indicates that all of the files contained in that directory where slash is the file-separator character, \f3File.separatorChar. A path name that ends in a slash (/) and a minus sign (-) indicates all files and subdirectories contained in that directory (recursively). A path name that consists of the special token \f3<<ALL FILES>> matches any file. A path name that consists of an asterisk (*) indicates all the files in the current directory. A path name that consists of a minus sign (-) indicates all the files in the current directory and (recursively) all files and subdirectories contained in the current directory. ExecOptionPermission The \f3ExecOptionPermission class represents permission for the \f3rmid command to use a specific command-line option when starting an activation group. The name of an \f3ExecOptionPermission is the value of a command-line option. Syntax: Options support a limited wild card scheme. An asterisk signifies a wild card match, and it can appear as the option name itself (matches any option), or an asterisk (*) can appear at the end of the option name only when the asterisk (*) follows a dot (.) or an equals sign (=). For example: \f3* or \f3-Dmydir.* or \f3-Da.b.c=* is valid, but \f3*mydir or \f3-Da*b or \f3ab* is not. Policy file for rmid When you grant the \f3rmid command permission to execute various commands and options, the permissions \f3ExecPermission and \f3ExecOptionPermission must be granted to all code sources (universally). It is safe to grant these permissions universally because only the \f3rmid command checks these permissions. An example policy file that grants various execute permissions to the \f3rmid command is:

 
\f3grant {

 
\f3 permission com.sun.rmi.rmid.ExecPermission

 
\f3 "/files/apps/java/jdk1.7.0/solaris/bin/java";

 
\f3

 
\f3 permission com.sun.rmi.rmid.ExecPermission

 
\f3 "/files/apps/rmidcmds/*";

 
\f3

 
\f3 permission com.sun.rmi.rmid.ExecOptionPermission

 
\f3 "-Djava.security.policy=/files/policies/group.policy";

 
\f3

 
\f3 permission com.sun.rmi.rmid.ExecOptionPermission

 
\f3 "-Djava.security.debug=*";

 
\f3

 
\f3 permission com.sun.rmi.rmid.ExecOptionPermission

 
\f3 "-Dsun.rmi.*";

 
\f3};

 
\f3

0.2i <policyClassName> If the default behavior is not flexible enough, then an administrator can provide, when starting the \f3rmid command, the name of a class whose \f3checkExecCommand method is executed to check commands to be executed by the \f3rmid command. The \f3policyClassName specifies a public class with a public, no-argument constructor and an implementation of the following \f3checkExecCommand method:

 
\f3 public void checkExecCommand(ActivationGroupDesc desc, String[] command)

 
\f3 throws SecurityException;

 
\f3

0.2i none If the \f3sun.rmi.activation.execPolicy property value is \f3none, then the \f3rmid command does not perform any validation of commands to start activation groups.