|
FlexDoc/Javadoc 2.0 Demo Java Doc |
The SecurityManager class contains many methods with names that begin with the word check. These methods are called by various methods in the Java libraries before those methods perform certain potentially sensitive operations. The invocation of such a check method typically looks like this:
SecurityManager security = System.getSecurityManager(); if (security != null) { security.checkXXX(argument, . . . ); }
The security manager is thereby given an opportunity to prevent completion of the operation by throwing an exception. A security manager routine simply returns if the operation is permitted, but throws a SecurityException if the operation is not permitted.
Environments using a security manager will typically set the security manager at startup. In the JDK implementation, this is done by setting the system property java.security.manager on the command line to the class name of the security manager. It can also be set to the empty String ("") or the special token "default" to use the default java.lang.SecurityManager. If a class name is specified, it must be java.lang.SecurityManager or a public subclass and have a public no-arg constructor. The class is loaded by the built-in system class loader if it is not java.lang.SecurityManager. If the java.security.manager system property is not set, the default value is null, which means a security manager will not be set at startup.
The Java run-time may also allow, but is not required to allow, the security manager to be set dynamically by invoking the setSecurityManager method. In the JDK implementation, if the Java virtual machine is started with the java.security.manager system property set to the special token "disallow" then a security manager will not be set at startup and cannot be set dynamically (the setSecurityManager method will throw an UnsupportedOperationException). If the java.security.manager system property is not set or is set to the special token "allow", then a security manager will not be set at startup but can be set dynamically. Finally, if the java.security.manager system property is set to the class name of the security manager, or to the empty String ("") or the special token "default", then a security manager is set at startup (as described previously) and can also be subsequently replaced (or disabled) dynamically (subject to the policy of the currently installed security manager). The following table illustrates the behavior of the JDK implementation for the different settings of the java.security.manager system property:
Property Value | The SecurityManager set at startup | System.setSecurityManager run-time behavior |
---|---|---|
null | None | Success or throws SecurityException if not permitted by the currently installed security manager |
empty String ("") | java.lang.SecurityManager | Success or throws SecurityException if not permitted by the currently installed security manager |
"default" | java.lang.SecurityManager | Success or throws SecurityException if not permitted by the currently installed security manager |
"disallow" | None | Always throws UnsupportedOperationException |
"allow" | None | Success or throws SecurityException if not permitted by the currently installed security manager |
a class name | the named class | Success or throws SecurityException if not permitted by the currently installed security manager |
A future release of the JDK may change the default value of the java.security.manager system property to "disallow".
The current security manager is returned by the getSecurityManager method.
The special method checkPermission(java.security.Permission) determines whether an access request indicated by a specified permission should be granted or denied. The default implementation calls
AccessController.checkPermission(perm);
If a requested access is allowed, checkPermission returns quietly. If denied, a SecurityException is thrown.
The default implementation of each of the other check methods in SecurityManager is to call the SecurityManager checkPermission method to determine if the calling thread has permission to perform the requested operation.
Note that the checkPermission method with just a single permission argument always performs security checks within the context of the currently executing thread. Sometimes a security check that should be made within a given context will actually need to be done from within a different context (for example, from within a worker thread). The getSecurityContext method and the checkPermission method that includes a context argument are provided for this situation. The getSecurityContext method returns a "snapshot" of the current calling context. (The default implementation returns an AccessControlContext object.) A sample call is the following:
Object context = null; SecurityManager sm = System.getSecurityManager(); if (sm != null) context = sm.getSecurityContext();
The checkPermission method that takes a context object in addition to a permission makes access decisions based on that context, rather than on that of the current execution thread. Code within a different context can thus call that method, passing the permission and the previously-saved context object. A sample call, using the SecurityManager sm obtained as in the previous example, is the following:
if (sm != null) sm.checkPermission(permission, context);
Permissions fall into these categories: File, Socket, Net, Security, Runtime, Property, AWT, Reflect, and Serializable. The classes managing these various permission categories are java.io.FilePermission, java.net.SocketPermission, java.net.NetPermission, java.security.SecurityPermission, java.lang.RuntimePermission, java.util.PropertyPermission, java.awt.AWTPermission, java.lang.reflect.ReflectPermission, and java.io.SerializablePermission.
All but the first two (FilePermission and SocketPermission) are subclasses of java.security.BasicPermission, which itself is an abstract subclass of the top-level class for permissions, which is java.security.Permission. BasicPermission defines the functionality needed for all permissions that contain a name that follows the hierarchical property naming convention (for example, "exitVM", "setFactory", "queuePrintJob", etc). An asterisk may appear at the end of the name, following a ".", or by itself, to signify a wildcard match. For example: "a.*" or "*" is valid, "*a" or "a*b" is not valid.
FilePermission and SocketPermission are subclasses of the top-level class for permissions (java.security.Permission). Classes like these that have a more complicated name syntax than that used by BasicPermission subclass directly from Permission rather than from BasicPermission. For example, for a java.io.FilePermission object, the permission name is the path name of a file (or directory).
Some of the permission classes have an "actions" list that tells the actions that are permitted for the object. For example, for a java.io.FilePermission object, the actions list (such as "read, write") specifies which actions are granted for the specified file (or for files in the specified directory).
Other permission classes are for "named" permissions - ones that contain a name but no actions list; you either have the named permission or you don't.
Note: There is also a java.security.AllPermission permission that implies all permissions. It exists to simplify the work of system administrators who might need to perform multiple tasks that require all (or numerous) permissions.
See Permissions in the Java Development Kit (JDK) for permission-related information. This document includes a table listing the various SecurityManager check methods and the permission(s) the default implementation of each such method requires. It also contains a table of the methods that require permissions, and for each such method tells which permission it requires.
Constructor Summary |
||
Deprecated. Constructs a new SecurityManager.
|
Method Summary |
||
void |
checkAccept(String host, int port)
Deprecated. Throws a SecurityException if the
calling thread is not permitted to accept a socket connection from
the specified host and port number.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to modify the thread argument.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to modify the thread group argument.
|
|
void |
checkConnect(String host, int port)
Deprecated. Throws a SecurityException if the
calling thread is not allowed to open a socket connection to the
specified host and port number.
|
|
void |
Deprecated. Throws a SecurityException if the
specified security context is not allowed to open a socket
connection to the specified host and port number.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to create a new class loader.
|
|
void |
checkDelete(String file)
Deprecated. Throws a SecurityException if the
calling thread is not allowed to delete the specified file.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to create a subprocess.
|
|
void |
checkExit(int status)
Deprecated. Throws a SecurityException if the
calling thread is not allowed to cause the Java Virtual Machine to
halt with the specified status code.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to dynamic link the library code
specified by the string argument file.
|
|
void |
checkListen(int port)
Deprecated. Throws a SecurityException if the
calling thread is not allowed to wait for a connection request on
the specified local port number.
|
|
void |
checkMulticast(InetAddress maddr)
Deprecated. Throws a SecurityException if the
calling thread is not allowed to use
(join/leave/send/receive) IP multicast.
|
|
void |
checkMulticast(InetAddress maddr, byte ttl)
Deprecated, for removal.
|
|
void |
checkPackageAccess(String pkg)
Deprecated. Throws a SecurityException if the calling thread is not allowed
to access the specified package.
|
|
void |
Deprecated. Throws a SecurityException if the calling thread is not
allowed to define classes in the specified package.
|
|
void |
checkPermission(Permission perm)
Deprecated. Throws a SecurityException if the requested
access, specified by the given permission, is not permitted based
on the security policy currently in effect.
|
|
void |
Deprecated. Throws a SecurityException if the
specified security context is denied access to the resource
specified by the given permission.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to initiate a print job request.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to access or modify the system
properties.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to access the system property with
the specified key name.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to read from the specified file
descriptor.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to read the file specified by the
string argument.
|
|
void |
Deprecated. Throws a SecurityException if the
specified security context is not allowed to read the file
specified by the string argument.
|
|
void |
checkSecurityAccess(String target)
Deprecated. Determines whether the permission with the specified permission target
name should be granted or denied.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to set the socket factory used by
ServerSocket or Socket, or the stream
handler factory used by URL.
|
|
void |
Deprecated. Throws a SecurityException if the
calling thread is not allowed to write to the specified file
descriptor.
|
|
void |
checkWrite(String file)
Deprecated. Throws a SecurityException if the
calling thread is not allowed to write to the file specified by
the string argument.
|
|
protected Class<?>[] |
Deprecated. Returns the current execution stack as an array of classes.
|
|
Deprecated. Creates an object that encapsulates the current execution
environment.
|
||
Deprecated. Returns the thread group into which to instantiate any new
thread being created at the time this is being called.
|
Methods inherited from class java.lang.Object |
public SecurityManager |
() |
If there is a security manager already installed, this method first calls the security manager's checkPermission method with the RuntimePermission("createSecurityManager") permission to ensure the calling thread has permission to create a new security manager. This may result in throwing a SecurityException.
protected Class<?>[] getClassContext |
() |
The length of the array is the number of methods on the execution stack. The element at index 0 is the class of the currently executing method, the element at index 1 is the class of that method's caller, and so on.
public Object getSecurityContext |
() |
The default implementation of this method is to return an AccessControlContext object.
public void checkPermission |
(Permission perm) |
This method calls AccessController.checkPermission with the given permission.
public void checkPermission |
If context is an instance of AccessControlContext then the AccessControlContext.checkPermission method is invoked with the specified permission.
If context is not an instance of AccessControlContext then a SecurityException is thrown.
public void checkCreateClassLoader |
() |
This method calls checkPermission with the RuntimePermission("createClassLoader") permission.
If you override this method, then you should make a call to super.checkCreateClassLoader at the point the overridden method would normally throw an exception.
public void checkAccess |
(Thread t) |
This method is invoked for the current security manager by the stop, suspend, resume, setPriority, setName, and setDaemon methods of class Thread.
If the thread argument is a system thread (belongs to the thread group with a null parent) then this method calls checkPermission with the RuntimePermission("modifyThread") permission. If the thread argument is not a system thread, this method just returns silently.
Applications that want a stricter policy should override this method. If this method is overridden, the method that overrides it should additionally check to see if the calling thread has the RuntimePermission("modifyThread") permission, and if so, return silently. This is to ensure that code granted that permission (such as the JDK itself) is allowed to manipulate any thread.
If this method is overridden, then super.checkAccess should be called by the first statement in the overridden method, or the equivalent security check should be placed in the overridden method.
public void checkAccess |
(ThreadGroup g) |
This method is invoked for the current security manager when a new child thread or child thread group is created, and by the setDaemon, setMaxPriority, stop, suspend, resume, and destroy methods of class ThreadGroup.
If the thread group argument is the system thread group ( has a null parent) then this method calls checkPermission with the RuntimePermission("modifyThreadGroup") permission. If the thread group argument is not the system thread group, this method just returns silently.
Applications that want a stricter policy should override this method. If this method is overridden, the method that overrides it should additionally check to see if the calling thread has the RuntimePermission("modifyThreadGroup") permission, and if so, return silently. This is to ensure that code granted that permission (such as the JDK itself) is allowed to manipulate any thread.
If this method is overridden, then super.checkAccess should be called by the first statement in the overridden method, or the equivalent security check should be placed in the overridden method.
public void checkExit |
(int status) |
This method is invoked for the current security manager by the exit method of class Runtime. A status of 0 indicates success; other values indicate various errors.
This method calls checkPermission with the RuntimePermission("exitVM."+status) permission.
If you override this method, then you should make a call to super.checkExit at the point the overridden method would normally throw an exception.
public void checkExec |
(String cmd) |
This method is invoked for the current security manager by the exec methods of class Runtime.
This method calls checkPermission with the
FilePermission(cmd,"execute") permission
if cmd is an absolute path, otherwise it calls
checkPermission with
FilePermission("<<ALL FILES>>","execute")
.
If you override this method, then you should make a call to super.checkExec at the point the overridden method would normally throw an exception.
public void checkLink |
(String lib) |
This method is invoked for the current security manager by methods load and loadLibrary of class Runtime.
This method calls checkPermission with the RuntimePermission("loadLibrary."+lib) permission.
If you override this method, then you should make a call to super.checkLink at the point the overridden method would normally throw an exception.
public void checkRead |
(FileDescriptor fd) |
This method calls checkPermission with the RuntimePermission("readFileDescriptor") permission.
If you override this method, then you should make a call to super.checkRead at the point the overridden method would normally throw an exception.
public void checkRead |
(String file) |
This method calls checkPermission with the FilePermission(file,"read") permission.
If you override this method, then you should make a call to super.checkRead at the point the overridden method would normally throw an exception.
public void checkRead |
If context is an instance of AccessControlContext then the AccessControlContext.checkPermission method will be invoked with the FilePermission(file,"read") permission.
If context is not an instance of AccessControlContext then a SecurityException is thrown.
If you override this method, then you should make a call to super.checkRead at the point the overridden method would normally throw an exception.
public void checkWrite |
(FileDescriptor fd) |
This method calls checkPermission with the RuntimePermission("writeFileDescriptor") permission.
If you override this method, then you should make a call to super.checkWrite at the point the overridden method would normally throw an exception.
public void checkWrite |
(String file) |
This method calls checkPermission with the FilePermission(file,"write") permission.
If you override this method, then you should make a call to super.checkWrite at the point the overridden method would normally throw an exception.
public void checkDelete |
(String file) |
This method is invoked for the current security manager by the delete method of class File.
This method calls checkPermission with the FilePermission(file,"delete") permission.
If you override this method, then you should make a call to super.checkDelete at the point the overridden method would normally throw an exception.
public void checkConnect |
(String host, int port) |
A port number of -1 indicates that the calling method is attempting to determine the IP address of the specified host name.
This method calls checkPermission with the SocketPermission(host+":"+port,"connect") permission if the port is not equal to -1. If the port is equal to -1, then it calls checkPermission with the SocketPermission(host,"resolve") permission.
If you override this method, then you should make a call to super.checkConnect at the point the overridden method would normally throw an exception.
public void checkConnect |
A port number of -1 indicates that the calling method is attempting to determine the IP address of the specified host name.
If context is not an instance of AccessControlContext then a SecurityException is thrown.
Otherwise, the port number is checked. If it is not equal to -1, the context's checkPermission method is called with a SocketPermission(host+":"+port,"connect") permission. If the port is equal to -1, then the context's checkPermission method is called with a SocketPermission(host,"resolve") permission.
If you override this method, then you should make a call to super.checkConnect at the point the overridden method would normally throw an exception.
public void checkListen |
(int port) |
This method calls checkPermission with the SocketPermission("localhost:"+port,"listen").
If you override this method, then you should make a call to super.checkListen at the point the overridden method would normally throw an exception.
public void checkAccept |
(String host, int port) |
This method is invoked for the current security manager by the accept method of class ServerSocket.
This method calls checkPermission with the SocketPermission(host+":"+port,"accept") permission.
If you override this method, then you should make a call to super.checkAccept at the point the overridden method would normally throw an exception.
public void checkMulticast |
(InetAddress maddr) |
This method calls checkPermission with the
java.net.SocketPermission(maddr.getHostAddress(),
"accept,connect")
permission.
If you override this method, then you should make a call to super.checkMulticast at the point the overridden method would normally throw an exception.
public void checkMulticast |
(InetAddress maddr, byte ttl) |
This method calls checkPermission with the
java.net.SocketPermission(maddr.getHostAddress(),
"accept,connect")
permission.
If you override this method, then you should make a call to super.checkMulticast at the point the overridden method would normally throw an exception.
public void checkPropertiesAccess |
() |
This method is used by the getProperties and setProperties methods of class System.
This method calls checkPermission with the PropertyPermission("*", "read,write") permission.
If you override this method, then you should make a call to super.checkPropertiesAccess at the point the overridden method would normally throw an exception.
public void checkPropertyAccess |
(String key) |
This method is used by the getProperty method of class System.
This method calls checkPermission with the PropertyPermission(key, "read") permission.
If you override this method, then you should make a call to super.checkPropertyAccess at the point the overridden method would normally throw an exception.
public void checkPrintJobAccess |
() |
This method calls checkPermission with the RuntimePermission("queuePrintJob") permission.
If you override this method, then you should make a call to super.checkPrintJobAccess at the point the overridden method would normally throw an exception.
public void checkPackageAccess |
(String pkg) |
During class loading, this method may be called by the loadClass method of class loaders and by the Java Virtual Machine to ensure that the caller is allowed to access the package of the class that is being loaded.
This method checks if the specified package starts with or equals any of the packages in the package.access Security Property. An implementation may also check the package against an additional list of restricted packages as noted below. If the package is restricted, checkPermission(Permission) is called with a RuntimePermission("accessClassInPackage."+pkg) permission.
If this method is overridden, then super.checkPackageAccess should be called as the first line in the overridden method.
public void checkPackageDefinition |
(String pkg) |
This method is called by the loadClass method of some class loaders.
This method checks if the specified package starts with or equals any of the packages in the package.definition Security Property. An implementation may also check the package against an additional list of restricted packages as noted below. If the package is restricted, checkPermission(Permission) is called with a RuntimePermission("defineClassInPackage."+pkg) permission.
If this method is overridden, then super.checkPackageDefinition should be called as the first line in the overridden method.
public void checkSetFactory |
() |
This method calls checkPermission with the RuntimePermission("setFactory") permission.
If you override this method, then you should make a call to super.checkSetFactory at the point the overridden method would normally throw an exception.
public void checkSecurityAccess |
(String target) |
If the requested permission is allowed, this method returns quietly. If denied, a SecurityException is raised.
This method creates a SecurityPermission object for the given permission target name and calls checkPermission with it.
See the documentation for
SecurityPermission
for
a list of possible permission target names.
If you override this method, then you should make a call to super.checkSecurityAccess at the point the overridden method would normally throw an exception.
public ThreadGroup getThreadGroup |
() |
|
FlexDoc/Javadoc 2.0 Demo Java Doc |