<?xml version="1.0" encoding="UTF-8"?>
<Policy PolicyId="ReflectionPolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:ordered-permit-overrides" xmlns="urn:oasis:names:tc:xacml:1.0:policy" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
	
	<Description>
		This policy controls access to Java methods from XQuery.  It should
		not change the operation of any of the samples.  It also should not
		change the operation of the website either.
	</Description>
	
	<Target>
		<Resources>
			<Resource>
				<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">method</AttributeValue>
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml/resource#resource-category" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</ResourceMatch>
			</Resource>
		</Resources>
	</Target>
	
	<Rule RuleId="RandomAndMath" Effect="Permit">
		<Description>
			Allows any method in java.lang.Math or java.util.Random to be executed.
		</Description>
		<Target>
			<Resources>
				<Resource>
					<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">java.lang.Math</AttributeValue>
						<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml/resource#class" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ResourceMatch>
				</Resource>
				<Resource>
					<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">java.util.Random</AttributeValue>
						<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml/resource#class" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ResourceMatch>
				</Resource>
			</Resources>
		</Target>
	</Rule>
	
	<Rule RuleId="File" Effect="Permit">
		
		<Description>
			Allows access to the constructor and the listFiles, getName, and isDirectory methods
			of java.io.File
		</Description>
		
		<Target>
			<Resources>
				<Resource>
					<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">java.lang.File</AttributeValue>
						<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml/resource#class" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ResourceMatch>
				</Resource>
			</Resources>
		</Target>
		
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
			
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
				<Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
					
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml/resource#resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">listFiles</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">getName</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">isDirectory</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">new</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">length</AttributeValue>
				</Apply>
			</Apply>
			
		</Condition>
	</Rule>
	
	<Rule RuleId="Collection" Effect="Permit">
		
		<Description>
			Allows access to the listResources, getName, listChildCollections, and
			getChildCollection methods of org.xmldb.api.base.Collection
		</Description>
		
		<Target>
			<Resources>
				<Resource>
					<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">org.xmldb.api.base.Collection</AttributeValue>
						<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml/resource#class" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ResourceMatch>
				</Resource>
			</Resources>
		</Target>
		
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:or">
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
					<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
						<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</Apply>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">getService</AttributeValue>
				</Apply>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
					<Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dba</AttributeValue>
					<SubjectAttributeDesignator AttributeId="http://exist-db.org/xacml/subject#group" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
			</Apply>
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
				<Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">listResources</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">listChildCollections</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">getName</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">getChildCollection</AttributeValue>
				</Apply>
			</Apply>
		</Condition>
		
	</Rule>
	
	
	<Rule RuleId="Runtime" Effect="Permit">
		
		<Description>
			Allows access to the getRuntime, maxMemory, totalMemory, and
			freeMemory methods of java.lang.Runtime.
			
			Uncomment the Subjects tag to restrict access to administrators.
		</Description>
		
		<Target>
			<!--<Subjects>
				<Subject>
					<SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dba</AttributeValue>
						<SubjectAttributeDesignator AttributeId="http://exist-db.org/xacml/subject#group" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</SubjectMatch>
				</Subject>
			</Subjects>-->
			<Resources>
				<Resource>
					<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">java.lang.Runtime</AttributeValue>
						<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml/resource#class" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ResourceMatch>
				</Resource>
			</Resources>
		</Target>
		
		<Condition FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
			
			<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">
				<Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
					<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#string"/>
				</Apply>
				<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">getRuntime</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">maxMemory</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">totalMemory</AttributeValue>
					<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">freeMemory</AttributeValue>
				</Apply>
			</Apply>
			
		</Condition>
	</Rule>
	
	<Rule RuleId="DatabaseInstanceManager" Effect="Permit">
		
		<Description>
			Only allows database administrators access to the
			org.exist.xmldb.DatabaseInstanceManager class.
		</Description>
		
		<Target>
			<Subjects>
				<Subject>
					<SubjectMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">dba</AttributeValue>
						<SubjectAttributeDesignator AttributeId="http://exist-db.org/xacml/subject#group" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</SubjectMatch>
				</Subject>
			</Subjects>
			<Resources>
				<Resource>
					<ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
						<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">org.exist.xmldb.DatabaseInstanceManager</AttributeValue>
						<ResourceAttributeDesignator AttributeId="http://exist-db.org/xacml/resource#class" DataType="http://www.w3.org/2001/XMLSchema#string"/>
					</ResourceMatch>
				</Resource>
			</Resources>
		</Target>
	</Rule>
	
	<Rule RuleId="DenyAllOthers" Effect="Deny">
		<Description>
			This rule denies access to all other Java classes and methods.
		</Description>
	</Rule>
</Policy>
