You need to update those items in the JNLP not the jar since you are launching this via webstart.
Example from: http://docs.oracle.com/javase/tutorial/deployment/webstart/deploying.html
<jnlp spec="1.0+" codebase=
"http://docs.oracle.com/javase/tutorialJWS/samples/deployment/webstart_ComponentArch_DynamicTreeDemo" 
    href="dynamictree_webstart.jnlp">
    <information>
        <title>Dynamic Tree Demo</title>
        <vendor>Dynamic Team</vendor>
    </information>
    <resources>
        <!-- Application Resources -->
        <j2se version="1.7+"
              href="http://java.sun.com/products/autodl/j2se"/>
        <jar href="DynamicTreeDemo.jar"
            main="true" />
    </resources>
    <application-desc
         name="Dynamic Tree Demo Application"
         main-class=
           "webstartComponentArch.DynamicTreeApplication"
         width="300"
         height="300">
     </application-desc>
     <update check="background"/>
</jnlp>   
For permissions you possibly need the security tag, here is a writeup about that tag from: http://lopica.sourceforge.net/ref.html#security
By default every application runs in a restricted execution
  environment (aka sandbox). If an app runs in a secure sandbox, it must
  follow these restrictions:
No access to local disk. All your jars must be downloaded from the
  same host. Note, however, that you can download extensions and JREs
  from any host as long as they are signed and trusted. Network
  connections are allowed only to host from which your jars were
  downloaded. ("Phone home restriction.") No security manager can be
  installed. No native libraries (not even in extensions). Limited
  access to system properties. (The application has read/write access to
  all system properties defined in the jnlp file, as well as read-only
  access to the same set of properties as applets (see System Properties
  Available for Unsigned Apps for a complete list).) If you specify
  all-permissions, the app can do whatever it wants and has full access
  to the user's machine and local network.
Contents
all-permissions?, j2ee-application-client-permissions? 
<security>
  <all-permissions/>
</security>