How to sign java applet

Hello, dear reader.
Today you will learn how to sign a JAVA applet. To begin with, I will say that JAVA applets have limited functionality until they are signed. For example, unsigned applets cannot:

• interact with the client's local file system;
• establish network connections with other servers;
• interact with the client's clipboard;
• some others.

There are several options for solving the problem:
1. Allow execution on each local client machine. To do this, you can edit the java.policy file, which is located in the folder with the JRE installed (by default in C: \ Program Files \ Java \ jre6 \ lib \ security). And add the necessary permissions. For example, to allow everything you can, you need to insert the line:

grant { ... permission java.security.AllPermission; } 

And if you want to allow only work with the clipboard for the hackmeplease.com site:
')

 grant codeBase "http://hackmeplease.com/*" { permission java.awt.AWTPermission "accessClipboard"; }; 

This method will be useful only if the number of end users of your site is limited and you do not have to edit this file on every computer. In addition, the security of this solution is not very high.

2. Sign your Java applet. So, what we have at the entrance:
- installed JDK and JRE;
- jar-file of your applet (there are some features of writing source code, see below);
- desire to work with the clipboard. To do this, the line should work correctly:

Toolkit toolkit = Toolkit.getDefaultToolkit ();
Clipboard clipboard = toolkit.getSystemClipboard ();

In the case of calling these lines, from an unsigned applet, we get the following exception:
java.security.AccessControlException: access denied (java.awt.AWTPermission accessClipboard)

So let's get started:
0. Go to the BIN folder of our JDK (for example, C: \ Program Files \ Java \ jdk1.6.0_23 \ bin).
I. Create a local storage of our certificate (keystore):
keytool -genkey -keystore .keystore -alias "Terrasoft" -validity 99999
where Terrasoft is the alias name of our certificate;
99999 - term in months of validity of the certificate;
.keystore is the name of the file being created by the repository.

In case of successful launch of the team, the system will ask us the password of our storage, as well as some information about the certificate (your full name, company name, city, country and blood group)

As a result, we will have a .keystore file. This is our repository, with which we will sign different applets.
Ii. We copy our JAR file into the BIN folder of our JDK. Sign it with the following command:
jarsigner.exe -keystore .keystore ClipboardLibrary.jar "Terrasoft"
where Terrasoft is the alias name of our certificate;
.keystore is the name of the storage file;
ClipboardLibrary.jar - the name of the JAR file.
The system will ask us the password - enter the one that you entered in section I.

It seems to be ready ... Yes, right now, naive ...
So, when you start the page with our applet on board, the user will receive a friendly message like:


Which means, "User, click Yes and say goodbye to your system, because we can do with it what we want."
By the way, pay attention to NOT VERIFIED. It means that we do not have a trust certificate. To get a fiduciary, you need to contact special services in the internet and even pay money.

But back to our sheep. When accessing the clipboard, we again get an exception of the form:
java.security.AccessControlException: access denied (java.awt.AWTPermission accessClipboard)

Very sorry. Well, it did not work out now - it will turn out another time. Goodbye.

Just kidding In fact, at this moment all the guidelines for signing applets that I have met stop. Like, signed applet nothing scary. Let them all be ashamed.
In short, the following trick to make our appeal to the clipboard work:

Iii. Change the source code.
Instead of calling the form:

 clipboard = toolkit.getSystemClipboard() 

You need to write a call of the form:

 clipboard = (Clipboard) AccessController.doPrivileged(new PrivilegedAction() { public Object run() { return toolkit.getSystemClipboard(); } }); 

After that, you need to recompile your JAR and repeat step II (for those who read my message from the end - respect).

But in general, that's all. Should work. I hope that it will come in handy to someone, and he will not spend as much of his life on this nonsense as I spent. Hell, trouble and ire you don't want to wait for you (C). Until new meetings on the air.