Guideline for Granting Permissions to Run-Time Facilities

Many Oracle Database products use run-time facilities such as Oracle Java Virtual Machine (OJVM). Do not assign all permissions to a database run-time facility. Instead, grant specific permissions to the explicit document root file paths for facilities that might run files and packages outside the database.

Here is an example of a vulnerable run-time call, in which an individual file (in bold typeface) is specified:

call dbms_java.grant_permission('wsmith',
 'SYS:java.io.FilePermission','filename','read');

The following example is a better (more secure) run-time call, because by specifying a directory path (in bold typeface), it protects all files within the directory.

call dbms_java.grant_permission('wsmith', 
 'SYS:java.io.FilePermission','directory_path','read');