Sometimes it happens: I write something in a rush, and present it in a not-optimal way. And then I get advices!
Using PL/Java: need for clarifications
On January, I wrote an article about installing PL/Java on Rocky Linux, and about some of the difficulties I had in achieving a fully operational installation, even if I did not dig enough into the problems that I encountered.
Chapman Flack, the most active developer in the project at the moment, take the time to write to me a very detailed email with a lot of suggestions for improvements and providing corrections to some of the misconceptions I present in such an article.
I’m really glad to have received all those insights, and in order to spread the word, I’m writing here another article that, hopefully, fixes my mistakes. I’m not following the same order that Chapman presented them to me, since in my opinion some issues are much more important than others, so I present from the most important to the least one, according to me.
Editing the java.policy file
In my previous article, I advised readers to edit java.policy in the case there was a problem with Java permissions when executing PL/Java code. Despite the fact that I clearly stated that relaxing the permissions to all permissions was not a good idea, Chapman emphasized two main problems in my example: 1) I was editing the main policy file, therefore changing the policy rules for all the Java code, not only for PL/Java one; 2) adding java.security.AllPermission made no distinction between trusted and untrusted languages.
Chapman pointed out that PL/Java uses a customized policy file, that can be found in the PostgreSQL configuration directory, hence in $(pg_config --sysconfdir). This customizable configuration is available since PL/Java version 1.6, and is documented here in the section “Permissions available in sandboxed/unsandboxed PL/Java”. This file defines two main principals:
grant principal org.postgresql.pljava.PLPrincipal$Sandboxed * {
};
grant princ[...]
这篇文章讨论了使用PL/Java时的一些问题和解决方法。作者在之前的文章中提到了编辑java.policy文件来解决Java权限问题，但是这样会改变所有Java代码的策略规则。文章中提到了PL/Java使用自定义的策略文件，可以在PostgreSQL配置目录中找到。此外，还介绍了PL/Java的默认安装位置和编译Java代码所需的API jar文件。最后，作者纠正了之前关于数据往返和PL/Java通信方式的错误理解。总的来说，PL/Java是一个成熟的项目，解决了许多与Java代码集成的问题。
