You need to update those items in the JNLP not the jar since you are launching this via webstart.
Example from: http://docs.oracle.com/javase/tutorial/deployment/webstart/deploying.html
<jnlp spec="1.0+" codebase=
"http://docs.oracle.com/javase/tutorialJWS/samples/deployment/webstart_ComponentArch_DynamicTreeDemo"
href="dynamictree_webstart.jnlp">
<information>
<title>Dynamic Tree Demo</title>
<vendor>Dynamic Team</vendor>
</information>
<resources>
<!-- Application Resources -->
<j2se version="1.7+"
href="http://java.sun.com/products/autodl/j2se"/>
<jar href="DynamicTreeDemo.jar"
main="true" />
</resources>
<application-desc
name="Dynamic Tree Demo Application"
main-class=
"webstartComponentArch.DynamicTreeApplication"
width="300"
height="300">
</application-desc>
<update check="background"/>
</jnlp>
For permissions you possibly need the security tag, here is a writeup about that tag from: http://lopica.sourceforge.net/ref.html#security
By default every application runs in a restricted execution
environment (aka sandbox). If an app runs in a secure sandbox, it must
follow these restrictions:
No access to local disk. All your jars must be downloaded from the
same host. Note, however, that you can download extensions and JREs
from any host as long as they are signed and trusted. Network
connections are allowed only to host from which your jars were
downloaded. ("Phone home restriction.") No security manager can be
installed. No native libraries (not even in extensions). Limited
access to system properties. (The application has read/write access to
all system properties defined in the jnlp file, as well as read-only
access to the same set of properties as applets (see System Properties
Available for Unsigned Apps for a complete list).) If you specify
all-permissions, the app can do whatever it wants and has full access
to the user's machine and local network.
Contents
all-permissions?, j2ee-application-client-permissions?
<security>
<all-permissions/>
</security>