1 ###################################################################### 2 # Default Access Control File for Remote JMX(TM) Monitoring 3 ###################################################################### 4 # 5 # Access control file for Remote JMX API access to monitoring. 6 # This file defines the allowed access for different roles. The 7 # password file (jmxremote.password by default) defines the roles and their 8 # passwords. To be functional, a role must have an entry in 9 # both the password and the access files. 10 # 11 # The default location of this file is $JRE/lib/management/jmxremote.access 12 # You can specify an alternate location by specifying a property in 13 # the management config file $JRE/lib/management/management.properties 14 # (See that file for details) 15 # 16 # The file format for password and access files is syntactically the same 17 # as the Properties file format. The syntax is described in the Javadoc 18 # for java.util.Properties.load. 19 # A typical access file has multiple lines, where each line is blank, 20 # a comment (like this one), or an access control entry. 21 # 22 # An access control entry consists of a role name, and an 23 # associated access level. The role name is any string that does not 24 # itself contain spaces or tabs. It corresponds to an entry in the 25 # password file (jmxremote.password). The access level is one of the 26 # following: 27 # "readonly" grants access to read attributes of MBeans. 28 # For monitoring, this means that a remote client in this 29 # role can read measurements but cannot perform any action 30 # that changes the environment of the running program. 31 # "readwrite" grants access to read and write attributes of MBeans, 32 # to invoke operations on them, and optionally 33 # to create or remove them. This access should be granted 34 # only to trusted clients, since they can potentially 35 # interfere with the smooth operation of a running program. 36 # 37 # The "readwrite" access level can optionally be followed by the "create" and/or 38 # "unregister" keywords. The "unregister" keyword grants access to unregister 39 # (delete) MBeans. The "create" keyword grants access to create MBeans of a 40 # particular class or of any class matching a particular pattern. Access 41 # should only be granted to create MBeans of known and trusted classes. 42 # 43 # For example, the following entry would grant readwrite access 44 # to "controlRole", as well as access to create MBeans of the class 45 # javax.management.monitor.CounterMonitor and to unregister any MBean: 46 # controlRole readwrite \ 47 # create javax.management.monitor.CounterMonitorMBean \ 48 # unregister 49 # or equivalently: 50 # controlRole readwrite unregister create javax.management.monitor.CounterMBean 51 # 52 # The following entry would grant readwrite access as well as access to create 53 # MBeans of any class in the packages javax.management.monitor and 54 # javax.management.timer: 55 # controlRole readwrite \ 56 # create javax.management.monitor.*,javax.management.timer.* \ 57 # unregister 58 # 59 # The \ character is defined in the Properties file syntax to allow continuation 60 # lines as shown here. A * in a class pattern matches a sequence of characters 61 # other than dot (.), so javax.management.monitor.* matches 62 # javax.management.monitor.CounterMonitor but not 63 # javax.management.monitor.foo.Bar. 64 # 65 # A given role should have at most one entry in this file. If a role 66 # has no entry, it has no access. 67 # If multiple entries are found for the same role name, then the last 68 # access entry is used. 69 # 70 # 71 # Default access control entries: 72 # o The "monitorRole" role has readonly access. 73 # o The "controlRole" role has readwrite access and can create the standard 74 # Timer and Monitor MBeans defined by the JMX API. 75 76 monitorRole readonly 77 controlRole readwrite \ 78 create javax.management.monitor.*,javax.management.timer.* \ 79 unregister 80
