Derby NetworkServer SocketPermission

Last winter, there was a fairly large and complex Java update: Java™ SE Development Kit 7, Update 51 (JDK 7u51).

There's lots to read in that announcement, but this part particularly affects users of the Derby Network Server:

Change in Default Socket Permissions

The default socket permissions assigned to all code including untrusted code have been changed in this release. Previously, all code was able to bind any socket type to any port number greater than or equal to 1024. It is still possible to bind sockets to the ephemeral port range on each system. The exact range of ephemeral ports varies from one operating system to another, but it is typically in the high range (such as from 49152 to 65535). The new restriction is that binding sockets outside of the ephemeral range now requires an explicit permission in the system security policy.

Most applications using client tcp sockets and a security manager will not see any problem, as these typically bind to ephemeral ports anyway. Applications using datagram sockets or server tcp sockets (and a security manager) may encounter security exceptions where none were seen before. If this occurs, users should review whether the port number being requested is expected, and if this is the case, a socket permission grant can be added to the local security policy, to resolve the issue.

See 8011786 (not public).

For users of Derby, this causes the symptoms described by DERBY-6438.

There is an (Oracle, and picked up by IBM) JVM security change that requests or suggests removal or limitation of the 'range of ports' on which JVMS by default grant the "listen" permission. I cannot find details about this JVM change, but as a result of it, users that have (unknowingly) relied on this in the past will now have to modify their policy files, or Network Server will no longer work.

Happily, it's not terribly hard to modify your Java security policy to allow Derby to run again: Unable to start derby database from Netbeans 7.4

For reason of java.policy is an unix style file and read-only, I opened and edited it with notepad++ and executed as administrator (under the same java home):

C:\Program Files\Java\jdk1.7.0_51\jre\lib\security\java.policy

Add only these lines into the file after the first grant:

grant {
    permission java.net.SocketPermission "localhost:1527", "listen";
};

Save the file, which is a little tricky for reason of the permission. But if you run notepad++ or any other edit program as administrator, you can solve the problem.

In older versions of Java, that security file tended to read something like:

 // allows anyone to listen on un-privileged ports
 permission java.net.SocketPermission "localhost:1024-", "listen";

And that's why Derby used to run successfully with those older Java versions.