Changing System Property in Java - Security Policy file

I have some confusion in understanding Java Security model. In my ${JDK_HOME}/jre/lib/security/java.policy file, I could see below entries:

grant { 
    // Allows any thread to stop itself using the java.lang.Thread.stop()
    // method that takes no argument.
    // Note that this permission is granted by default only to remain
    // backwards compatible.
    // It is strongly recommended that you either remove this permission
    // from this policy file or further restrict it to code sources
    // that you specify, because Thread.stop() is potentially unsafe.
    // See "http://java.sun.com/notes" for more information.
    permission java.lang.RuntimePermission "stopThread";

    // allows anyone to listen on un-privileged ports
    permission java.net.SocketPermission "localhost:1024-", "listen";

    // "standard" properies that can be read by anyone


    permission java.util.PropertyPermission "java.vm.version", "read";
..... .....

The last line that reads: permission java.util.PropertyPermission "java.vm.version", "read";

I interpret it as: The Java Program that runs in the VM has permission to read the property 'java.vm.version'

Following this understanding I wrote a sample program just to check, If I get any run time error If I alter this property:

    System.setProperty("java.vm.version", "my.jvm.version.2345");
    System.out.println(System.getProperty("java.vm.version"));

There was no e开发者_StackOverflow中文版rror; instead the System.out.println display my modified value i.e. my.jvm.version.2345

Does that mean policies set in java.policy is not working, what am i missing here?

the java.policy file is not used in a normal java process. you must first configure the java process to use a SecurityManager (.e.g add "-Djava.security.manager" to the command line). More details here.

Don't waste time messing with policy files. They are difficult enough for programmers to get right, and virtually impossible for end users.

If an app. needs trust, digitally sign it, and convince the user to trust the code when prompted.