Discusses how the Remote Manager supports the OSGi framework security mechanism, based on the distribution of permissions.

Basic Information about Permissions on OSGi Devices

In an OSGi device framework running in secure mode, the actions that a bundle is allowed to perform are based on the permissions it has. For example, to get a particular service, import or export a package, alter the properties of a user, read and/or write on a particular file etc., it must have the appropriate permission. If a bundle is granted no permissions, within the OSGi framework it will not be allowed to perform actions, requiring any permissions. The most essential permissions are defined in the java.security package of the Java 2 platform.

Permission Types

The OSGi Service Platform Core Specification defines two types of permissions:

  • Bundle Permissions – Represents the permissions bound to specific bundle locations on the device. Bundle Permissions are defined in the Permission Admin Service Specification part of the OSGi Service Platform Core Specification.
  • Conditional Permissions – Represents the conditional permissions on the device associated with specific condition. Conditional Permissions are defined in the Conditional Permission Admin Specification part of the OSGi Service Platform Core Specification.

Installation and Setup

Prerequisite

Permission management is possible only if the OSGi device framework is running in secure mode.

Installation on the OSGi device

To be able to manage conditional permission you must provide the Conditional Permission Agent on the managed device framework.
There are two ways to deploy the RM Conditional Permission Agent on an OSGi device framework:

  • When you register a new device in RM through the console – Select Conditional Permission Agent from the RM optional features.
  • Manually – Install directly on the device framework the osgidm.core.condperm.cu.agent.jar located in the packages/osgidm directory of the RM installation.

User Interface

Using the console GUI, you are allowed to add or change the permissions of a OSGi device bundle runtime from the device management tree. For details refer to the Managing Permissions on OSGi Devices document.