How to adjust Sun's Java security policy for skins in DVD Profiler

German FlagDeutsche Version

If you found your way here you are using InterVocative's DVD Profiler, try to run skins which require reading (and writing) files outside of DVD Profiler (such as roolku's or Mithirandir's fabulous works), but end up seeing this:

Error message

Below you will find the solution how to fix the problem.

The following has been tested with Sun's Java VM version 1.4.2 and 1.5.0_02. roolku's skin does not work with version 1.5.0_01 (Mithirandir's has not been tested with that).

In the beginning, however, in case you care, I will give you some basic details about the background of the problem and my search for the remedy. Then I'll give you the instructions how to fix it. For path names I'll show them as they appear in my computer, you just translate them to whatever they should be in your's...

THE PROBLEM:

I suppose you have Windows XP Service Pack 1a installed (I have SP 2 by now, but that makes no difference here). The meaning of 1a was, that Microsoft removed their own Java Virtual Machine because of legal issues; SP 1 still had it. That is also, why not everybody runs into problems... Therefore another way to resolve the problem could be to find a stand-alone installer of the MS VM and install that (Don't forget to run an Update after that!). But since MS is not supporting their VM anymore, maybe you want to stick to Sun's Java.

As I learned during my search, Java does not allow applets to do potentially harmful actions on your computer. Therefore file system actions are ruled out by default. Since the DVD Profiler skins in question apparently need to be reading and writing files on your machine, we received those infamous "access denied" messages (in the Java console; see above) and nothing would work.

THE SEARCH:

I googled a lot and found quite some information on the Java security, the most informative one being Sun's Java Technology pages (Default Policy Implementation and Policy File Syntax, Permissions in the JavaTM 2 SDK and Policy Tool - Policy File Creation and Management Tool). With that on hand I felt the solution was near, it seemed I only needed to use the "policytool" (<JAVA-HOME>\bin) to tweak the VM's java.policy file (<JAVA-HOME>\lib\security). But at first it wouldn't work.

Eventually I found, that the above mentioned java.policy file is only used by the Administrator account of the computer. Users have their own java.policy in their "Documents and Settings" section and it's named slightly different:
C:\Documents and Settings\Achim\.java.policy (note the dot in front of java.policy!)
Trying to copy the file from the original location and renaming it does not work, as Windows will ask you to provide a name for the file (.java.policy is considered a file extension).

After having solved that (you'll learn below), I simply went through the procedures step by step. Applying one permission with reference to the error message in the Java console and see what comes up next time DVD Profiler starts up with a skin. It is totally five separate permissions that needed to be granted.

O.k., enough of that, here it is:

THE SOLUTION:

(for a "shortcut" click here)

~~~~~~~DISCLAIMER~~~~~~~
(I just feel better mentioning this)
THE BELOW SETTINGS WILL BE DONE AT YOUR OWN RISK.
THEY WORK FOR ME, BUT THEY MIGHT CREATE SECURITY
ISSUES OR OTHER PROBLEMS FOR YOUR COMPUTER, WHICH
I WILL NOT BE RESPONSIBLE FOR.
~~~~END OF DISCLAIMER~~~~

In the following I will use <JAVA-HOME> to represent the installation directory of the Runtime Environment. Depending on your version it could be:
1.4.2: C:\Program Files\Java\j2re1.4.2_07
1.5.0: C:\Program Files\Java\jre1.5.0_02

Start up <JAVA-HOME>\bin\policytool.exe.

At first startup it should give you a message, that the .java.policy file of your user account was not found (unless you use the Administrator's account, then you can skip the first step). Therefore use File|Open to locate and open the java.policy file in <JAVA-HOME>\lib\security.

Policy Tool when first opened

Then, before doing any actual adjustments, do File|Save As... and save it in the "root" of your user account (C:\Documents and Settings\<USERNAME>). Remember to put the dot in front of the file name before clicking Save! (What Explorer doesn't allow you, policytool will do the trick...) You will be greeted with "Policy successfully written to..."

In the window of the policytool you see two entries:
Codebase "file:${java.home}/lib/ext/*"
Codebase <ALL>
The one we'll be creating will also be named "Codebase <ALL>", but I felt better keeping the new settings separately. Codebase refers to the location where the code, that will be granted the permissions you are about to set, is found. I just couldn't figure out to work, that ONLY the skins in the \DVD Profiler\skins folder will be able to do the granted actions. So, with the set Permissions ANY code on your computer could potentially take advantage of them; then again, the permissions are rather linmited to begin with.

Now click "Add Policy Entry" to open the related window. (When you come back here later, just double-click "your" "Codebase <ALL>" entry or select it and click "Edit Policy Entry").

Add Policy window

The top half of the window stays empty (as I said, I don't know what to put there, in order to limit the permissions to the code of the skins). Five permissions will have to be created. Each time you click Add Permission a new window will pop up.

Add New Permission window

Just fill in the information as provided below; you may need to adjust the pathnames to suit your system.

1. Permission:
Select "RuntimePermission" from the first dropdown.
Select "modifyThreadGroup" from the second dropdown.
Click "OK".

2. Permission:
Select "RuntimePermission" from the first dropdown.
Select "modifyThread" from the second dropdown.
Click "OK".

3. Permission:
Select "FilePermission" from the first dropdown.
On the right side, next to "Target Name:", enter the path to the IMAGES directory as follows:
C:\\Program Files\\InterVocative Software\\DVD Profiler\\IMAGES\\-
(The dash at the end will include all subdirectories.)
Enter the words "read" and "write", separated by comma, into the field next to "Actions:"
This permission will allow applets (ANY applet, that is) to read or write files in the IMAGES directory and all it's subdirectories.
Click "OK".

4. Permission (especially for the download features):
Select "SocketPermission" from the first dropdown.
On the right side, next to "Target Name:", enter "*" (asterisk; without the quotes).
Enter the words "connect", "listen" and "resolve", separated by comma, into the field next to "Actions:"
Click "OK".

5. Permission (especially for Mithirandir's skin):
Select "FilePermission" from the first dropdown.
On the right side, next to "Target Name:", enter the path to the INFOS directory as follows:
C:\\Program Files\\InterVocative Software\\DVD Profiler\\data\\infos\\-
(The dash at the end will include all subdirectories; even though it's not really necessary...)
Enter the word "read" into the field next to "Actions:"
This permission will allow applets (ANY applet, that is) to read files in the \infos directory and all it's subdirectories.
Click "OK".

So, that should be it. After saving the .java.policy file the skins should be operating as desired.

YOU'RE DONE!

IMORTANT:
You will have to make sure to copy any "class" files used by the skins to the to the <JAVA-HOME>\classes directory , which you may still have to create. (roolku's classes are originally in \roolku\java, Mithirandir already instructed you to place them correctly)

You do not need to use roolku's dvdpro.bat anymore, as Sun does not support the CLASSPATH function.

THE SHORTCUT:

Taking the shortcut... Well, I assume that you have read the above bit THE SOLUTION and have at least a vague idea what the whole thing is doing (OR you are thinking "I don't know about all that computer stuff, just make that skin work!"), then you can simply download my version of the .java.policy file, place it in the C:\Documents and Settings\<USERNAME> folder of your user profile and start up DVD Profiler.

If you still have any question or any description above is not clear enough, don't hesitate to contact me (you'll find my e-mail address on the Contact page or in messages from me in the DVD Profiler forum on Intervocative's site; my username is ya_shin).

Good luck!