1 |
/* java.lang.SecurityManager |
/* SecurityManager.java -- security checks for privileged actions |
2 |
Copyright (C) 1998, 1999, 2001 Free Software Foundation, Inc. |
Copyright (C) 1998, 1999, 2001, 2002 Free Software Foundation, Inc. |
3 |
|
|
4 |
This file is part of GNU Classpath. |
This file is part of GNU Classpath. |
5 |
|
|
7 |
it under the terms of the GNU General Public License as published by |
it under the terms of the GNU General Public License as published by |
8 |
the Free Software Foundation; either version 2, or (at your option) |
the Free Software Foundation; either version 2, or (at your option) |
9 |
any later version. |
any later version. |
10 |
|
|
11 |
GNU Classpath is distributed in the hope that it will be useful, but |
GNU Classpath is distributed in the hope that it will be useful, but |
12 |
WITHOUT ANY WARRANTY; without even the implied warranty of |
WITHOUT ANY WARRANTY; without even the implied warranty of |
13 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
38 |
|
|
39 |
package java.lang; |
package java.lang; |
40 |
|
|
41 |
import java.net.*; |
import java.io.FileDescriptor; |
42 |
import java.util.*; |
import java.net.InetAddress; |
43 |
import java.io.*; |
import java.security.Permission; |
44 |
|
import java.security.SecurityPermission; |
45 |
|
|
46 |
/** |
/** |
47 |
** SecurityManager is a class you can extend to create |
* SecurityManager is a class you can extend to create your own Java |
48 |
** your own Java security policy. By default, there is |
* security policy. By default, there is no SecurityManager installed in |
49 |
** no SecurityManager installed in 1.1, which means that |
* 1.1, which means that all things are permitted to all people. The security |
50 |
** all things are permitted to all people.<P> |
* manager, if set, is consulted before doing anything with potentially |
51 |
** |
* dangerous results, and throws a <code>SecurityException</code> if the |
52 |
** The default methods in this class deny all |
* action is forbidden. |
53 |
** things to all people. |
* |
54 |
** |
* <p>A typical check is as follows, just before the dangerous operation:<br> |
55 |
** @author John Keiser |
* <pre> |
56 |
** @version 1.1.0, 31 May 1998 |
* SecurityManager sm = System.getSecurityManager(); |
57 |
** @since JDK1.0 |
* if (sm != null) |
58 |
**/ |
* sm.checkXXX(<em>argument</em>, ...); |
59 |
public class SecurityManager { |
* </pre> |
60 |
/** Tells whether or not the SecurityManager is currently |
* Note that this is thread-safe, by caching the security manager in a local |
61 |
** performing a security check. |
* variable rather than risking a NullPointerException if the mangager is |
62 |
**/ |
* changed between the check for null and before the permission check. |
63 |
protected boolean inCheck; |
* |
64 |
|
* <p>The special method <code>checkPermission</code> is a catchall, and |
65 |
/** Tells whether or not the SecurityManager is currently |
* the default implementation calls |
66 |
** performing a security check. |
* <code>AccessController.checkPermission</code>. In fact, all the other |
67 |
** |
* methods default to calling checkPermission. |
68 |
** @return whether or not the SecurityManager is |
* |
69 |
** currently performing a security check. |
* <p>Sometimes, the security check needs to happen from a different context, |
70 |
**/ |
* such as when called from a worker thread. In such cases, use |
71 |
public boolean getInCheck() { |
* <code>getSecurityContext</code> to take a snapshot that can be passed |
72 |
return inCheck; |
* to the worker thread:<br> |
73 |
} |
* <pre> |
74 |
|
* Object context = null; |
75 |
/** Get a list of all the classes currently executing |
* SecurityManager sm = System.getSecurityManager(); |
76 |
** methods on the Java stack. getClassContext()[0] is |
* if (sm != null) |
77 |
** the currently executing method |
* context = sm.getSecurityContext(); // defaults to an AccessControlContext |
78 |
** <STRONG>Spec Note:</STRONG> does not say whether |
* // now, in worker thread |
79 |
** the stack will include the getClassContext() call or |
* if (sm != null) |
80 |
** the one just before it. |
* sm.checkPermission(permission, context); |
81 |
** |
* <pre> |
82 |
** @return an array containing all the methods on classes |
* |
83 |
** on the Java execution stack. |
* <p>Permissions fall into these categories: File, Socket, Net, Security, |
84 |
**/ |
* Runtime, Property, AWT, Reflect, and Serializable. Each of these |
85 |
protected Class[] getClassContext() { |
* permissions have a property naming convention, that follows a hierarchical |
86 |
return VMSecurityManager.getClassContext(); |
* naming convention, to make it easy to grant or deny several permissions |
87 |
} |
* at once. Some permissions also take a list of permitted actions, such |
88 |
|
* as "read" or "write", to fine-tune control even more. The permission |
89 |
/** Find the ClassLoader for the most recent class on the |
* <code>java.security.AllPermission</code> grants all permissions. |
90 |
** stack that was loaded by an explicit ClassLoader. If |
* |
91 |
** everything on the stack was loaded by the system |
* <p>The default methods in this class deny all things to all people. You |
92 |
** classloader, null is returned. |
* must explicitly grant permission for anything you want to be legal when |
93 |
** |
* subclassing this class. |
94 |
** @return the most recent ClassLoader on the execution |
* |
95 |
** stack. |
* @author John Keiser |
96 |
**/ |
* @author Eric Blake <ebb9@email.byu.edu> |
97 |
protected ClassLoader currentClassLoader() { |
* @see ClassLoader |
98 |
return VMSecurityManager.currentClassLoader(); |
* @see SecurityException |
99 |
} |
* @see #checkTopLevelWindow(Object) |
100 |
|
* @see System#getSecurityManager() |
101 |
/** Find the most recent class on the stack that was |
* @see System#setSecurityManager(SecurityManager) |
102 |
** loaded by an explicit ClassLoader. If everything on |
* @see AccessController |
103 |
** the stack was loaded by the system classloader, null |
* @see AccessControlContext |
104 |
** is returned. |
* @see AccessControlException |
105 |
** |
* @see Permission |
106 |
** @return the most recent loaded Class on the execution |
* @see BasicPermission |
107 |
** stack. |
* @see java.io.FilePermission |
108 |
**/ |
* @see java.net.SocketPermission |
109 |
protected Class currentLoadedClass() { |
* @see java.util.PropertyPermission |
110 |
Class[] c = getClassContext(); |
* @see RuntimePermission |
111 |
for(int i=0;i<c.length;i++) { |
* @see java.awt.AWTPermission |
112 |
if(c[i].getClassLoader() != null) { |
* @see Policy |
113 |
return c[i]; |
* @see SecurityPermission |
114 |
} |
* @see ProtectionDomain |
115 |
} |
* @since 1.0 |
116 |
return null; |
* @status still missing 1.4 functionality |
117 |
} |
*/ |
118 |
|
public class SecurityManager |
119 |
/** Get the depth on the execution stack of the most |
{ |
120 |
** recent class that was loaded by an explicit |
/** |
121 |
** ClassLoader. This can be used as an index into |
* Tells whether or not the SecurityManager is currently performing a |
122 |
** getClassContext(). |
* security check. |
123 |
** |
* @deprecated Use {@link #checkPermission(Permission)} instead. |
124 |
** @return the index of the most recent loaded Class on |
*/ |
125 |
** the execution stack. |
protected boolean inCheck; |
126 |
**/ |
|
127 |
protected int classLoaderDepth() { |
/** |
128 |
Class[] c = getClassContext(); |
* Construct a new security manager. There may be a security check, of |
129 |
for(int i=0;i<c.length;i++) { |
* <code>RuntimePermission("createSecurityManager")</code>. |
130 |
if(c[i].getClassLoader() != null) { |
* |
131 |
return i; |
* @throws SecurityException if permission is denied |
132 |
} |
*/ |
133 |
} |
public SecurityManager() |
134 |
return -1; |
{ |
135 |
} |
SecurityManager sm = System.getSecurityManager(); |
136 |
|
if (sm != null) |
137 |
/** Tell whether there is a class loaded with an explicit |
sm.checkPermission(new RuntimePermission("createSecurityManager")); |
138 |
** ClassLoader on the stack. |
} |
139 |
** |
|
140 |
** @return whether there is a class loaded with an |
/** |
141 |
** explicit ClassLoader on the stack. |
* Tells whether or not the SecurityManager is currently performing a |
142 |
**/ |
* security check. |
143 |
protected boolean inClassLoader() { |
* |
144 |
return classLoaderDepth() != -1; |
* @return true if the SecurityManager is in a security check |
145 |
} |
* @see #inCheck |
146 |
|
* @deprecated use {@link #checkPermission(Permission)} instead |
147 |
|
*/ |
148 |
/** Get the depth of a particular class on the execution |
public boolean getInCheck() |
149 |
** stack. |
{ |
150 |
** |
return inCheck; |
151 |
** @param className the fully-qualified name of the class |
} |
152 |
** to search for on the stack. |
|
153 |
** @return the index of the class on the stack, or -1 if |
/** |
154 |
** the class is not on the stack. |
* Get a list of all the classes currently executing methods on the Java |
155 |
**/ |
* stack. getClassContext()[0] is the currently executing method (ie. the |
156 |
protected int classDepth(String className) { |
* class that CALLED getClassContext, not SecurityManager). |
157 |
Class[] c = getClassContext(); |
* |
158 |
for(int i=0;i<c.length;i++) { |
* @return an array of classes on the Java execution stack |
159 |
if(className.equals(c[i].getName())) { |
*/ |
160 |
return i; |
protected Class[] getClassContext() |
161 |
} |
{ |
162 |
} |
return VMSecurityManager.getClassContext(); |
163 |
return -1; |
} |
164 |
} |
|
165 |
|
/** |
166 |
/** Tell whether the specified class is on the execution |
* Find the ClassLoader of the first non-system class on the execution |
167 |
** stack. |
* stack. A non-system class is one whose ClassLoader is not equal to |
168 |
** |
* {@link ClassLoader#getSystemClassLoader()} or its ancestors. This |
169 |
** @param className the fully-qualified name of the class |
* will return null in three cases:<br><nl> |
170 |
** to search for on the stack. |
* <li>All methods on the stack are from system classes</li> |
171 |
** @return whether the specified class is on the |
* <li>All methods on the stack up to the first "privileged" caller, as |
172 |
** execution stack. |
* created by {@link AccessController.doPrivileged(PrivilegedAction)}, |
173 |
**/ |
* are from system classes</li> |
174 |
protected boolean inClass(String className) { |
* <li>A check of <code>java.security.AllPermission</code> succeeds.</li> |
175 |
return classDepth(className) != -1; |
* </nl> |
176 |
} |
* |
177 |
|
* @return the most recent non-system ClassLoader on the execution stack |
178 |
/** Get an implementation-dependent Object that contains |
* @deprecated use {@link #checkPermission(Permission)} instead |
179 |
** enough information about the current environment to be |
*/ |
180 |
** able to perform standard security checks later. This |
protected ClassLoader currentClassLoader() |
181 |
** is used by trusted methods that need to verify that |
{ |
182 |
** their callers have sufficient access to perform |
// XXX should be: |
183 |
** certain operations.<P> |
// Class c = currentLoadedClass(); |
184 |
** |
// return c != null ? c.getClassLoader() : null; |
185 |
** Currently the only methods that use this are checkRead() |
return VMSecurityManager.currentClassLoader(); |
186 |
** and checkConnect(). |
} |
187 |
** |
|
188 |
** @see checkConnect(java.lang.String,int,java.lang.Object) |
/** |
189 |
** @see checkRead(java.lang.String,java.lang.Object) |
* Find the first non-system class on the execution stack. A non-system |
190 |
**/ |
* class is one whose ClassLoader is not equal to |
191 |
public Object getSecurityContext() { |
* {@link ClassLoader#getSystemClassLoader()} or its ancestors. This |
192 |
return new SecurityContext(getClassContext()); |
* will return null in three cases:<br><nl> |
193 |
} |
* <li>All methods on the stack are from system classes</li> |
194 |
|
* <li>All methods on the stack up to the first "privileged" caller, as |
195 |
/** Check if the current thread is allowed to create a |
* created by {@link AccessController.doPrivileged(PrivilegedAction)}, |
196 |
** ClassLoader.<P> |
* are from system classes</li> |
197 |
** |
* <li>A check of <code>java.security.AllPermission</code> succeeds.</li> |
198 |
** This method is called from ClassLoader.ClassLoader(), |
* </nl> |
199 |
** in other words, whenever a ClassLoader is created.<P> |
* |
200 |
** |
* @return the most recent non-system Class on the execution stack |
201 |
** SecurityManager's implementation always denies access. |
* @deprecated use {@link #checkPermission(Permission)} instead |
202 |
** |
*/ |
203 |
** @exception SecurityException if the operation is not |
protected Class currentLoadedClass() |
204 |
** permitted. |
{ |
205 |
** @see java.lang.ClassLoader#ClassLoader() |
// XXX Should be: |
206 |
**/ |
// int i = classLoaderDepth(); |
207 |
public void checkCreateClassLoader() { |
// return i >= 0 ? getClassContext(i) : null; |
208 |
throw new SecurityException("Cannot create new ClassLoaders."); |
Class[] c = getClassContext(); |
209 |
} |
for (int i = 0; i < c.length; i++) |
210 |
|
if (c[i].getClassLoader() != null) |
211 |
/** Check if the current thread is allowed to modify this |
return c[i]; |
212 |
** other Thread.<P> |
return null; |
213 |
** |
} |
214 |
** Called by Thread.stop(), suspend(), resume(), and |
|
215 |
** interrupt(), destroy(), setPriority(), setName() and |
/** |
216 |
** setDaemon().<P> |
* Get the depth of a particular class on the execution stack. |
217 |
** |
* |
218 |
** SecurityManager's implementation always denies access. |
* @param className the fully-qualified name to search for |
219 |
** |
* @return the index of the class on the stack, or -1 |
220 |
** @param g the Thread to check against |
* @deprecated use {@link #checkPermission(Permission)} instead |
221 |
** @exception SecurityException if the operation is not |
*/ |
222 |
** permitted. |
protected int classDepth(String className) |
223 |
** @see java.lang.Thread#stop() |
{ |
224 |
** @see java.lang.Thread#suspend() |
Class[] c = getClassContext(); |
225 |
** @see java.lang.Thread#resume() |
for (int i = 0; i < c.length; i++) |
226 |
** @see java.lang.Thread#interrupt() |
if (className.equals(c[i].getName())) |
227 |
** @see java.lang.Thread#destroy() |
return i; |
228 |
** @see java.lang.Thread#setPriority(int) |
return -1; |
229 |
** @see java.lang.Thread#setName(java.lang.String) |
} |
230 |
** @see java.lang.Thread#setDaemon(boolean) |
|
231 |
**/ |
/** |
232 |
public void checkAccess(Thread t) { |
* Get the depth on the execution stack of the most recent non-system class. |
233 |
throw new SecurityException("Cannot modify Threads."); |
* A non-system class is one whose ClassLoader is not equal to |
234 |
} |
* {@link ClassLoader#getSystemClassLoader()} or its ancestors. This |
235 |
|
* will return -1 in three cases:<br><nl> |
236 |
/** Check if the current thread is allowed to modify this |
* <li>All methods on the stack are from system classes</li> |
237 |
** ThreadGroup.<P> |
* <li>All methods on the stack up to the first "privileged" caller, as |
238 |
** |
* created by {@link AccessController.doPrivileged(PrivilegedAction)}, |
239 |
** Called by Thread.Thread() (to add a thread to the |
* are from system classes</li> |
240 |
** ThreadGroup), ThreadGroup.ThreadGroup() (to add this |
* <li>A check of <code>java.security.AllPermission</code> succeeds.</li> |
241 |
** ThreadGroup to a parent), ThreadGroup.stop(), |
* </nl> |
242 |
** suspend(), resume(), interrupt(), destroy(), |
* |
243 |
** setDaemon(), and setMaxPriority().<P> |
* @return the index of the most recent non-system Class on the stack |
244 |
** |
* @deprecated use {@link #checkPermission(Permission)} instead |
245 |
** SecurityManager's implementation always denies access. |
*/ |
246 |
** |
protected int classLoaderDepth() |
247 |
** @param g the ThreadGroup to check against |
{ |
248 |
** @exception SecurityException if the operation is not |
// XXX Check AllPermission first. |
249 |
** permitted. |
Class[] c = getClassContext(); |
250 |
** @see java.lang.Thread#Thread() |
for (int i = 0; i <c.length; i++) |
251 |
** @see java.lang.ThreadGroup#ThreadGroup() |
if (c[i].getClassLoader() != null) |
252 |
** @see java.lang.ThreadGroup#stop() |
// XXX Check if c[i] is AccessController, or a system class. |
253 |
** @see java.lang.ThreadGroup#suspend() |
return i; |
254 |
** @see java.lang.ThreadGroup#resume() |
return -1; |
255 |
** @see java.lang.ThreadGroup#interrupt() |
} |
256 |
** @see java.lang.ThreadGroup#setDaemon(boolean) |
|
257 |
** @see java.lang.ThreadGroup#setMaxPriority(int) |
/** |
258 |
**/ |
* Tell whether the specified class is on the execution stack. |
259 |
public void checkAccess(ThreadGroup g) { |
* |
260 |
throw new SecurityException("Cannot modify ThreadGroups."); |
* @param className the fully-qualified name of the class to find |
261 |
} |
* @return whether the specified class is on the execution stack |
262 |
|
* @deprecated use {@link #checkPermission(Permission)} instead |
263 |
/** Check if the current thread is allowed to exit the |
*/ |
264 |
** JVM with the given status.<P> |
protected boolean inClass(String className) |
265 |
** |
{ |
266 |
** This method is called from Runtime.exit().<P> |
return classDepth(className) != -1; |
267 |
** |
} |
268 |
** SecurityManager's implementation always denies access. |
|
269 |
** |
/** |
270 |
** @param status the status to exit with |
* Tell whether there is a class loaded with an explicit ClassLoader on |
271 |
** @exception SecurityException if the operation is not |
* the stack. |
272 |
** permitted. |
* |
273 |
** @see java.lang.Runtime#exit() |
* @return whether a class with an explicit ClassLoader is on the stack |
274 |
** @see java.lang.Runtime#exit(int) |
* @deprecated use {@link #checkPermission(Permission)} instead |
275 |
**/ |
*/ |
276 |
public void checkExit(int status) { |
protected boolean inClassLoader() |
277 |
throw new SecurityException("Cannot exit JVM."); |
{ |
278 |
} |
return classLoaderDepth() != -1; |
279 |
|
} |
280 |
/** Check if the current thread is allowed to execute the |
|
281 |
** given program.<P> |
/** |
282 |
** |
* Get an implementation-dependent Object that contains enough information |
283 |
** This method is called from Runtime.exec().<P> |
* about the current environment to be able to perform standard security |
284 |
** |
* checks later. This is used by trusted methods that need to verify that |
285 |
** SecurityManager's implementation always denies access. |
* their callers have sufficient access to perform certain operations. |
286 |
** |
* |
287 |
** @param program the name of the program to exec |
* <p>Currently the only methods that use this are checkRead() and |
288 |
** @exception SecurityException if the operation is not |
* checkConnect(). The default implementation returns an |
289 |
** permitted. |
* <code>AccessControlContext</code>. |
290 |
** @see java.lang.Runtime#exec(java.lang.String[],java.lang.String[]) |
* |
291 |
**/ |
* @return a security context |
292 |
public void checkExec(String program) { |
* @see #checkConnect(String, int, Object) |
293 |
throw new SecurityException("Cannot execute programs."); |
* @see #checkRead(String, Object) |
294 |
} |
* @see AccessControlContext |
295 |
|
* @see AccessController#getContext() |
296 |
/** Check if the current thread is allowed to link in the |
*/ |
297 |
** given native library.<P> |
public Object getSecurityContext() |
298 |
** |
{ |
299 |
** This method is called from Runtime.load() (and hence, |
// XXX Should be: return AccessController.getContext(); |
300 |
** by loadLibrary() as well).<P> |
return new SecurityContext(getClassContext()); |
301 |
** |
} |
302 |
** SecurityManager's implementation always denies access. |
|
303 |
** |
/** |
304 |
** @param filename the full name of the library to load |
* Check if the current thread is allowed to perform an operation that |
305 |
** @exception SecurityException if the operation is not |
* requires the specified <code>Permission</code>. This defaults to |
306 |
** permitted. |
* <code>AccessController.checkPermission</code>. |
307 |
** @see java.lang.Runtime#load(java.lang.String) |
* |
308 |
**/ |
* @param perm the <code>Permission</code> required |
309 |
public void checkLink(String filename) { |
* @throws SecurityException if permission is denied |
310 |
throw new SecurityException("Cannot link native libraries."); |
* @throws NullPointerException if perm is null |
311 |
} |
* @since 1.2 |
312 |
|
*/ |
313 |
/** Check if the current thread is allowed to read the |
public void checkPermission(Permission perm) |
314 |
** given file using the FileDescriptor.<P> |
{ |
315 |
** |
// XXX Should be: AccessController.checkPermission(perm); |
316 |
** This method is called from |
throw new SecurityException("Operation not allowed"); |
317 |
** FileInputStream.FileInputStream().<P> |
} |
318 |
** |
|
319 |
** SecurityManager's implementation always denies access. |
/** |
320 |
** |
* Check if the current thread is allowed to perform an operation that |
321 |
** @param desc the FileDescriptor representing the file |
* requires the specified <code>Permission</code>. This is done in a |
322 |
** to access |
* context previously returned by <code>getSecurityContext()</code>. The |
323 |
** @exception SecurityException if the operation is not |
* default implementation expects context to be an AccessControlContext, |
324 |
** permitted. |
* and it calls <code>AccessControlContext.checkPermission(perm)</code>. |
325 |
** @see java.io.FileInputStream#FileInputStream(java.io.FileDescriptor) |
* |
326 |
**/ |
* @param perm the <code>Permission</code> required |
327 |
public void checkRead(FileDescriptor desc) { |
* @param context a security context |
328 |
throw new SecurityException("Cannot read files via file descriptors."); |
* @throws SecurityException if permission is denied, or if context is |
329 |
} |
* not an AccessControlContext |
330 |
|
* @throws NullPointerException if perm is null |
331 |
/** Check if the current thread is allowed to read the |
* @see #getSecurityContext() |
332 |
** given file.<P> |
* @see AccessControlContext#checkPermission(Permission) |
333 |
** |
* @since 1.2 |
334 |
** This method is called from |
*/ |
335 |
** FileInputStream.FileInputStream(), |
public void checkPermission(Permission perm, Object context) |
336 |
** RandomAccessFile.RandomAccessFile(), File.exists(), |
{ |
337 |
** canRead(), isFile(), isDirectory(), lastModified(), |
// XXX Should be: |
338 |
** length() and list().<P> |
// if (! (context instanceof AccessControlContext)) |
339 |
** |
// throw new SecurityException("Missing context"); |
340 |
** SecurityManager's implementation always denies access. |
// ((AccessControlContext) context).checkPermission(perm); |
341 |
** |
|
342 |
** @param filename the full name of the file to access |
throw new SecurityException("Operation not allowed"); |
343 |
** @exception SecurityException if the operation is not |
} |
344 |
** permitted. |
|
345 |
** @see java.io.File |
/** |
346 |
** @see java.io.FileInputStream#FileInputStream(java.lang.String) |
* Check if the current thread is allowed to create a ClassLoader. This |
347 |
** @see java.io.RandomAccessFile#RandomAccessFile(java.lang.String) |
* method is called from ClassLoader.ClassLoader(), and checks |
348 |
**/ |
* <code>RuntimePermission("createClassLoader")</code>. If you override |
349 |
public void checkRead(String filename) { |
* this, you should call <code>super.checkCreateClassLoader()</code> rather |
350 |
throw new SecurityException("Cannot read files via file names."); |
* than throwing an exception. |
351 |
} |
* |
352 |
|
* @throws SecurityException if permission is denied |
353 |
/** Check if the current thread is allowed to read the |
* @see ClassLoader#ClassLoader() |
354 |
** given file. using the given SecurityContext.<P> |
*/ |
355 |
** |
public void checkCreateClassLoader() |
356 |
** I know of no core class that calls this method.<P> |
{ |
357 |
** |
// XXX Should be: |
358 |
** SecurityManager's implementation always denies access. |
// checkPermission(new RuntimePermission("createClassLoader")); |
359 |
** |
throw new SecurityException("Cannot create new ClassLoaders."); |
360 |
** @param filename the full name of the file to access |
} |
361 |
** @param securityContext the Security Context to |
|
362 |
** determine access for. |
/** |
363 |
** @exception SecurityException if the operation is not |
* Check if the current thread is allowed to modify another Thread. This is |
364 |
** permitted. |
* called by Thread.stop(), suspend(), resume(), interrupt(), destroy(), |
365 |
**/ |
* setPriority(), setName(), and setDaemon(). The default implementation |
366 |
public void checkRead(String filename, Object securityContext) { |
* checks <code>RuntimePermission("modifyThread") on system threads (ie. |
367 |
throw new SecurityException("Cannot read files via file names."); |
* threads in ThreadGroup with a null parent), and returns silently on |
368 |
} |
* other threads. |
369 |
|
* |
370 |
/** Check if the current thread is allowed to write to the |
* <p>If you override this, you must do two things. First, call |
371 |
** given file using the FileDescriptor.<P> |
* <code>super.checkAccess(t)</code>, to make sure you are not relaxing |
372 |
** |
* requirements. Second, if the calling thread has |
373 |
** This method is called from |
* <code>RuntimePermission("modifyThread")</code>, return silently, so that |
374 |
** FileOutputStream.FileOutputStream().<P> |
* core classes (the Classpath library!) can modify any thread. |
375 |
** |
* |
376 |
** SecurityManager's implementation always denies access. |
* @param t the other Thread to check |
377 |
** |
* @throws SecurityException if permission is denied |
378 |
** @param desc the FileDescriptor representing the file |
* @throws NullPointerException if t is null |
379 |
** to access |
* @see Thread#stop() |
380 |
** @exception SecurityException if the operation is not |
* @see Thread#suspend() |
381 |
** permitted. |
* @see Thread#resume() |
382 |
** @see java.io.FileOutputStream#FileOutputStream(java.io.FileDescriptor) |
* @see Thread#setPriority(int) |
383 |
**/ |
* @see Thread#setName(String) |
384 |
public void checkWrite(FileDescriptor desc) { |
* @see Thread#setDaemon(boolean) |
385 |
throw new SecurityException("Cannot write files via file descriptors."); |
*/ |
386 |
} |
public void checkAccess(Thread t) |
387 |
|
{ |
388 |
/** Check if the current thread is allowed to write to the |
// XXX Implement this correctly. |
389 |
** given file.<P> |
throw new SecurityException("Cannot modify Threads."); |
390 |
** |
} |
391 |
** This method is called from |
|
392 |
** FileOutputStream.FileOutputStream(), |
/** |
393 |
** RandomAccessFile.RandomAccessFile(), |
* Check if the current thread is allowed to modify a ThreadGroup. This is |
394 |
** File.canWrite(), mkdir(), and renameTo().<P> |
* called by Thread.Thread() (to add a thread to the ThreadGroup), |
395 |
** |
* ThreadGroup.ThreadGroup() (to add this ThreadGroup to a parent), |
396 |
** SecurityManager's implementation always denies access. |
* ThreadGroup.stop(), suspend(), resume(), interrupt(), destroy(), |
397 |
** |
* setDaemon(), and setMaxPriority(). The default implementation |
398 |
** @param filename the full name of the file to access |
* checks <code>RuntimePermission("modifyThread") on the system group (ie. |
399 |
** @exception SecurityException if the operation is not |
* the one with a null parent), and returns silently on other groups. |
400 |
** permitted. |
* |
401 |
** @see java.io.File#canWrite() |
* <p>If you override this, you must do two things. First, call |
402 |
** @see java.io.File#mkdir() |
* <code>super.checkAccess(t)</code>, to make sure you are not relaxing |
403 |
** @see java.io.File#renameTo() |
* requirements. Second, if the calling thread has |
404 |
** @see java.io.FileOutputStream#FileOutputStream(java.lang.String) |
* <code>RuntimePermission("modifyThreadGroup")</code>, return silently, |
405 |
** @see java.io.RandomAccessFile#RandomAccessFile(java.lang.String) |
* so that core classes (the Classpath library!) can modify any thread. |
406 |
**/ |
* |
407 |
public void checkWrite(String filename) { |
* @param t the other Thread to check |
408 |
throw new SecurityException("Cannot write files via file names."); |
* @throws SecurityException if permission is denied |
409 |
} |
* @throws NullPointerException if t is null |
410 |
|
* @see Thread#Thread() |
411 |
/** Check if the current thread is allowed to delete the |
* @see ThreadGroup#ThreadGroup() |
412 |
** given file.<P> |
* @see ThreadGroup#stop() |
413 |
** |
* @see ThreadGroup#suspend() |
414 |
** This method is called from File.delete().<P> |
* @see ThreadGroup#resume() |
415 |
** |
* @see ThreadGroup#interrupt() |
416 |
** SecurityManager's implementation always denies access. |
* @see ThreadGroup#setDaemon(boolean) |
417 |
** |
* @see ThreadGroup#setMaxPriority(int) |
418 |
** @param filename the full name of the file to delete |
*/ |
419 |
** @exception SecurityException if th operation is not |
public void checkAccess(ThreadGroup g) |
420 |
** permitted. |
{ |
421 |
** @see java.io.File#delete() |
// XXX Implement this correctly. |
422 |
**/ |
throw new SecurityException("Cannot modify ThreadGroups."); |
423 |
public void checkDelete(String filename) { |
} |
424 |
throw new SecurityException("Cannot delete files."); |
|
425 |
} |
/** |
426 |
|
* Check if the current thread is allowed to exit the JVM with the given |
427 |
/** Check if the current thread is allowed to connect to a |
* status. This method is called from Runtime.exit() and Runtime.halt(). |
428 |
** given host on a given port.<P> |
* The default implementation checks |
429 |
** |
* <code>RuntimePermission("exitVM")</code>. If you override this, call |
430 |
** This method is called from Socket.Socket(). |
* <code>super.checkExit</code> rather than throwing an exception. |
431 |
** |
* |
432 |
** SecurityManager's implementation always denies access. |
* @param status the status to exit with |
433 |
** |
* @throws SecurityException if permission is denied |
434 |
** @param host the host to connect to |
* @see Runtime#exit(int) |
435 |
** @param port the port to connect on |
* @see Runtime#halt(int) |
436 |
** @exception SecurityException if the operation is not |
*/ |
437 |
** permitted |
public void checkExit(int status) |
438 |
** @see java.net.Socket#Socket() |
{ |
439 |
**/ |
// XXX Should be: checkPermission(new RuntimePermission("exitVM")); |
440 |
public void checkConnect(String host, int port) { |
throw new SecurityException("Cannot exit JVM."); |
441 |
throw new SecurityException("Cannot make network connections."); |
} |
442 |
} |
|
443 |
|
/** |
444 |
/** Check if the current thread is allowed to connect to a |
* Check if the current thread is allowed to execute the given program. This |
445 |
** given host on a given port using a specific security |
* method is called from Runtime.exec(). If the name is an absolute path, |
446 |
** context to determine access.<P> |
* the default implementation checks |
447 |
** |
* <code>FilePermission(program, "execute")</code>, otherwise it checks |
448 |
** This method is not called in the 1.1 core classes.<P> |
* <code>FilePermission("<<ALL FILES>>", "execute")</code>. If |
449 |
** |
* you override this, call <code>super.checkExec</code> rather than |
450 |
** SecurityManager's implementation always denies access. |
* throwing an exception. |
451 |
** |
* |
452 |
** @param host the host to connect to |
* @param program the name of the program to exec |
453 |
** @param port the port to connect on |
* @throws SecurityException if permission is denied |
454 |
** @param securityContext the security context to |
* @throws NullPointerException if program is null |
455 |
** determine access with |
* @see Runtime#exec(String[], String[], File) |
456 |
** @exception SecurityException if the operation is not |
*/ |
457 |
** permitted |
public void checkExec(String program) |
458 |
**/ |
{ |
459 |
public void checkConnect(String host, int port, Object securityContext) { |
// XXX Implement this correctly. |
460 |
throw new SecurityException("Cannot make network connections."); |
throw new SecurityException("Cannot execute programs."); |
461 |
} |
} |
462 |
|
|
463 |
/** Check if the current thread is allowed to listen to a |
/** |
464 |
** specific port for data.<P> |
* Check if the current thread is allowed to link in the given native |
465 |
** |
* library. This method is called from Runtime.load() (and hence, by |
466 |
** This method is called by ServerSocket.ServerSocket().<P> |
* loadLibrary() as well). The default implementation checks |
467 |
** |
* <code>RuntimePermission("loadLibrary." + filename)</code>. If you |
468 |
** SecurityManager's implementation always denies access. |
* override this, call <code>super.checkLink</code> rather than throwing |
469 |
** |
* an exception. |
470 |
** @param port the port to listen on |
* |
471 |
** @exception SecurityException if the operation is not |
* @param filename the full name of the library to load |
472 |
** permitted |
* @throws SecurityException if permission is denied |
473 |
** @see java.net.ServerSocket#ServerSocket(int) |
* @throws NullPointerException if filename is null |
474 |
**/ |
* @see Runtime#load(String) |
475 |
public void checkListen(int port) { |
*/ |
476 |
throw new SecurityException("Cannot listen for connections."); |
public void checkLink(String filename) |
477 |
} |
{ |
478 |
|
// Use the toString() hack to do the null check. |
479 |
/** Check if the current thread is allowed to accept a |
// XXX Should be: |
480 |
** connection from a particular host on a particular |
// checkPermission(new RuntimePermission("loadLibrary." |
481 |
** port.<P> |
// + filename.toString())); |
482 |
** |
throw new SecurityException("Cannot link native libraries."); |
483 |
** This method is called by ServerSocket.implAccept().<P> |
} |
484 |
** |
|
485 |
** SecurityManager's implementation always denies access. |
/** |
486 |
** |
* Check if the current thread is allowed to read the given file using the |
487 |
** @param host the host which wishes to connect |
* FileDescriptor. This method is called from |
488 |
** @param port the port the connection will be on |
* FileInputStream.FileInputStream(). The default implementation checks |
489 |
** @exception SecurityException if the operation is not |
* <code>RuntimePermission("readFileDescriptor")</code>. If you override |
490 |
** permitted |
* this, call <code>super.checkRead</code> rather than throwing an |
491 |
** @see java.net.ServerSocket#accept() |
* exception. |
492 |
**/ |
* |
493 |
public void checkAccept(String host, int port) { |
* @param desc the FileDescriptor representing the file to access |
494 |
throw new SecurityException("Cannot accept connections."); |
* @throws SecurityException if permission is denied |
495 |
} |
* @throws NullPointerException if desc is null |
496 |
|
* @see FileInputStream#FileInputStream(FileDescriptor) |
497 |
/** Check if the current thread is allowed to read and |
*/ |
498 |
** write multicast to a particular address.<P> |
public void checkRead(FileDescriptor desc) |
499 |
** |
{ |
500 |
** SecurityManager's implementation always denies access. |
// XXX Should be: |
501 |
** |
// checkPermission(new RuntimePermission("readFileDescriptor")); |
502 |
** @XXX where is it called? |
throw new SecurityException("Cannot read files via file descriptors."); |
503 |
** |
} |
504 |
** @param addr the address to multicast to. |
|
505 |
** @exception SecurityException if the operation is not |
/** |
506 |
** permitted. |
* Check if the current thread is allowed to read the given file. This |
507 |
**/ |
* method is called from FileInputStream.FileInputStream(), |
508 |
public void checkMulticast(InetAddress addr) { |
* RandomAccessFile.RandomAccessFile(), File.exists(), canRead(), isFile(), |
509 |
throw new SecurityException("Cannot read or write multicast."); |
* isDirectory(), lastModified(), length() and list(). The default |
510 |
} |
* implementation checks <code>FilePermission(filename, "read")</code>. If |
511 |
|
* you override this, call <code>super.checkRead</code> rather than |
512 |
/** Check if the current thread is allowed to read and |
* throwing an exception. |
513 |
** write multicast to a particular address with a |
* |
514 |
** particular ttl value.<P> |
* @param filename the full name of the file to access |
515 |
** |
* @throws SecurityException if permission is denied |
516 |
** SecurityManager's implementation always denies access.<P> |
* @throws NullPointerException if filename is null |
517 |
** |
* @see File |
518 |
** @XXX where is it called? |
* @see FileInputStream#FileInputStream(String) |
519 |
** |
* @see RandomAccessFile#RandomAccessFile(String) |
520 |
** @XXX what the hell is ttl? Expand abbreviation. |
*/ |
521 |
** |
public void checkRead(String filename) |
522 |
** @param addr the address to multicast to. |
{ |
523 |
** @param ttl the ttl value to use |
// XXX Should be: checkPermission(new FilePermission(filename, "read")); |
524 |
** @exception SecurityException if the operation is not |
throw new SecurityException("Cannot read files via file names."); |
525 |
** permitted. |
} |
526 |
**/ |
|
527 |
public void checkMulticast(InetAddress addr, byte ttl) { |
/** |
528 |
throw new SecurityException("Cannot read or write multicast."); |
* Check if the current thread is allowed to read the given file. using the |
529 |
} |
* given security context. The context must be a result of a previous call |
530 |
|
* to <code>getSecurityContext()</code>. The default implementation checks |
531 |
/** |
* <code>AccessControlContext.checkPermission(new FilePermission(filename, |
532 |
** Check if the current thread is allowed to perform an |
* "read"))</code>. If you override this, call <code>super.checkRead</code> |
533 |
** operation that requires the specified <code>Permission</code>. |
* rather than throwing an exception. |
534 |
** |
* |
535 |
** @param perm The <code>Permission</code> required. |
* @param filename the full name of the file to access |
536 |
** @exception SecurityException If the operation is not allowed. |
* @param context the context to determine access for |
537 |
**/ |
* @throws SecurityException if permission is denied, or if context is |
538 |
public void checkPermission(java.security.Permission perm) { |
* not an AccessControlContext |
539 |
throw new SecurityException("Operation not allowed"); |
* @throws NullPointerException if filename is null |
540 |
} |
* @see #getSecurityContext() |
541 |
|
* @see AccessControlContext#checkPermission(Permission) |
542 |
/** |
*/ |
543 |
** Check if the current thread is allowed to perform an |
public void checkRead(String filename, Object context) |
544 |
** operation that requires the specified <code>Permission</code>. |
{ |
545 |
** |
// XXX Should be: |
546 |
** @param perm The <code>Permission</code> required. |
// if (! (context instanceof AccessControlContext)) |
547 |
** @param context A security context |
// throw new SecurityException("Missing context"); |
548 |
** @exception SecurityException If the operation is not allowed. |
// AccessControlContext ac = (AccessControlContext) context; |
549 |
** @since 1.2 |
// ac.checkPermission(new FilePermission(filename, "read")); |
550 |
**/ |
throw new SecurityException("Cannot read files via file names."); |
551 |
public void checkPermission(java.security.Permission perm, |
} |
552 |
Object context) { |
|
553 |
throw new SecurityException("Operation not allowed"); |
/** |
554 |
} |
* Check if the current thread is allowed to write the given file using the |
555 |
|
* FileDescriptor. This method is called from |
556 |
/** Check if the current thread is allowed to read or |
* FileOutputStream.FileOutputStream(). The default implementation checks |
557 |
** write all the system properties at once.<P> |
* <code>RuntimePermission("writeFileDescriptor")</code>. If you override |
558 |
** |
* this, call <code>super.checkWrite</code> rather than throwing an |
559 |
** This method is called by System.getProperties() |
* exception. |
560 |
** and setProperties().<P> |
* |
561 |
** |
* @param desc the FileDescriptor representing the file to access |
562 |
** SecurityManager's implementation always denies access. |
* @throws SecurityException if permission is denied |
563 |
** |
* @throws NullPointerException if desc is null |
564 |
** @exception SecurityException if the operation is not |
* @see FileOutputStream#FileOutputStream(FileDescriptor) |
565 |
** permitted. |
*/ |
566 |
** @see java.lang.System#getProperties() |
public void checkWrite(FileDescriptor desc) |
567 |
** @see java.lang.System#setProperties(java.util.Properties) |
{ |
568 |
**/ |
// XXX Should be: |
569 |
public void checkPropertiesAccess() { |
// checkPermission(new RuntimePermission("writeFileDescriptor")); |
570 |
throw new SecurityException("Cannot access all system properties at once."); |
throw new SecurityException("Cannot write files via file descriptors."); |
571 |
} |
} |
572 |
|
|
573 |
/** Check if the current thread is allowed to read or |
/** |
574 |
** write a particular system property.<P> |
* Check if the current thread is allowed to write the given file. This |
575 |
** |
* method is called from FileOutputStream.FileOutputStream(), |
576 |
** This method is called by System.getProperty() and |
* RandomAccessFile.RandomAccessFile(), File.canWrite(), mkdir(), and |
577 |
** setProperty().<P> |
* renameTo(). The default implementation checks |
578 |
** |
* <code>FilePermission(filename, "write")</code>. If you override this, |
579 |
** SecurityManager's implementation always denies access. |
* call <code>super.checkWrite</code> rather than throwing an exception. |
580 |
** |
* |
581 |
** @exception SecurityException is the operation is not |
* @param filename the full name of the file to access |
582 |
** permitted. |
* @throws SecurityException if permission is denied |
583 |
** @see java.lang.System#getProperty(java.lang.String) |
* @throws NullPointerException if filename is null |
584 |
** @see java.lang.System#setProperty(java.lang.String,java.lang.String) |
* @see File |
585 |
**/ |
* @see File#canWrite() |
586 |
public void checkPropertyAccess(String name) { |
* @see File#mkdir() |
587 |
throw new SecurityException("Cannot access individual system properties."); |
* @see File#renameTo() |
588 |
} |
* @see FileOutputStream#FileOutputStream(String) |
589 |
|
* @see RandomAccessFile#RandomAccessFile(String) |
590 |
/** Check if the current thread is allowed to create a |
*/ |
591 |
** top-level window. If it is not, the operation should |
public void checkWrite(String filename) |
592 |
** still go through, but some sort of nonremovable |
{ |
593 |
** warning should be placed on the window to show that it |
// XXX Should be: checkPermission(new FilePermission(filename, "write")); |
594 |
** is untrusted.<P> |
throw new SecurityException("Cannot write files via file names."); |
595 |
** |
} |
596 |
** This method is called by Window.Window().<P> |
|
597 |
** |
/** |
598 |
** SecurityManager's implementation always denies access. |
* Check if the current thread is allowed to delete the given file. This |
599 |
** |
* method is called from File.delete(). The default implementation checks |
600 |
** @param window the window to create |
* <code>FilePermission(filename, "delete")</code>. If you override this, |
601 |
** @see java.awt.Window#Window(java.awt.Frame) |
* call <code>super.checkDelete</code> rather than throwing an exception. |
602 |
**/ |
* |
603 |
public boolean checkTopLevelWindow(Object window) { |
* @param filename the full name of the file to delete |
604 |
return false; |
* @throws SecurityException if permission is denied |
605 |
} |
* @throws NullPointerException if filename is null |
606 |
|
* @see File#delete() |
607 |
/** Check if the current thread is allowed to create a |
*/ |
608 |
** print job.<P> |
public void checkDelete(String filename) |
609 |
** |
{ |
610 |
** This method is called by Toolkit.getPrintJob(). (I |
// XXX Should be: checkPermission(new FilePermission(filename, "delete")); |
611 |
** assume so, at least, it just don't say nothing about |
throw new SecurityException("Cannot delete files."); |
612 |
** it in the spec.)<P> |
} |
613 |
** |
|
614 |
** SecurityManager's implementation always denies access. |
/** |
615 |
** |
* Check if the current thread is allowed to connect to a given host on a |
616 |
** @exception SecurityException if the operation is not |
* given port. This method is called from Socket.Socket(). A port number |
617 |
** permitted. |
* of -1 indicates the caller is attempting to determine an IP address, so |
618 |
** @see java.awt.Toolkit.getPrintJob(java.awt.Frame,java.lang.String,java.util.Properties) |
* the default implementation checks |
619 |
**/ |
* <code>SocketPermission(host, "resolve")</code>. Otherwise, the default |
620 |
public void checkPrintJobAccess() { |
* implementation checks |
621 |
throw new SecurityException("Cannot create print jobs."); |
* <code>SocketPermission(host + ":" + port, "connect")</code>. If you |
622 |
} |
* override this, call <code>super.checkConnect</code> rather than throwing |
623 |
|
* an exception. |
624 |
/** Check if the current thread is allowed to use the |
* |
625 |
** system clipboard.<P> |
* @param host the host to connect to |
626 |
** |
* @param port the port to connect on |
627 |
** This method is called by Toolkit.getSystemClipboard(). |
* @throws SecurityException if permission is denied |
628 |
** (I assume.)<P> |
* @throws NullPointerException if host is null |
629 |
** |
* @see Socket#Socket() |
630 |
** SecurityManager's implementation always denies access. |
*/ |
631 |
** |
public void checkConnect(String host, int port) |
632 |
** @exception SecurityException if the operation is not |
{ |
633 |
** permitted. |
// XXX Should be: |
634 |
** @see java.awt.Toolkit#getSystemClipboard() |
// if (port == -1) |
635 |
**/ |
// checkPermission(new SocketPermission(host, "resolve")); |
636 |
public void checkSystemClipboardAccess() { |
// else |
637 |
throw new SecurityException("Cannot access the system clipboard."); |
// checkPermission(new SocketPermission(host + ":" + port, "connect")); |
638 |
} |
throw new SecurityException("Cannot make network connections."); |
639 |
|
} |
640 |
/** Check if the current thread is allowed to use the AWT |
|
641 |
** event queue.<P> |
/** |
642 |
** |
* Check if the current thread is allowed to connect to a given host on a |
643 |
** This method is called by Toolkit.getSystemEventQueue().<P> |
* given port, using the given security context. The context must be a |
644 |
** |
* result of a previous call to <code>getSecurityContext</code>. A port |
645 |
** SecurityManager's implementation always denies access. |
* number of -1 indicates the caller is attempting to determine an IP |
646 |
** |
* address, so the default implementation checks |
647 |
** @exception SecurityException if the operation is not |
* <code>AccessControlContext.checkPermission(new SocketPermission(host, |
648 |
** permitted. |
* "resolve"))</code>. Otherwise, the default implementation checks |
649 |
** @see java.awt.Toolkit#getSystemEventQueue() |
* <code>AccessControlContext.checkPermission(new SocketPermission(host |
650 |
**/ |
* + ":" + port, "connect"))</code>. If you override this, call |
651 |
public void checkAwtEventQueueAccess() { |
* <code>super.checkConnect</code> rather than throwing an exception. |
652 |
throw new SecurityException("Cannot access the AWT event queue."); |
* |
653 |
} |
* @param host the host to connect to |
654 |
|
* @param port the port to connect on |
655 |
/** Check if the current thread is allowed to access the |
* @param context the context to determine access for |
656 |
** specified package at all.<P> |
* @throws SecurityException if permission is denied, or if context is |
657 |
** |
* not an AccessControlContext |
658 |
** This method is called by ClassLoader.loadClass() in |
* @throws NullPointerException if host is null |
659 |
** user-created ClassLoaders.<P> |
* @see #getSecurityContext() |
660 |
** |
* @see AccessControlContext#checkPermission(Permission) |
661 |
** SecurityManager's implementation always denies access. |
*/ |
662 |
** |
public void checkConnect(String host, int port, Object securityContext) |
663 |
** @param packageName the package name to check access to |
{ |
664 |
** @exception SecurityException if the operation is not |
// XXX Should be: |
665 |
** permitted. |
// if (! (context instanceof AccessControlContext)) |
666 |
** @see java.lang.ClassLoader#loadClass(java.lang.String,boolean) |
// throw new SecurityException("Missing context"); |
667 |
**/ |
// AccessControlContext ac = (AccessControlContext) context; |
668 |
public void checkPackageAccess(String packageName) { |
// if (port == -1) |
669 |
throw new SecurityException("Cannot access packages via the ClassLoader."); |
// ac.checkPermission(new SocketPermission(host, "resolve")); |
670 |
} |
// else |
671 |
|
// ac.checkPermission(new SocketPermission(host + ":" +port, "connect")); |
672 |
/** Check if the current thread is allowed to define |
throw new SecurityException("Cannot make network connections."); |
673 |
** classes the specified package. If the class already |
} |
674 |
** created, though, ClassLoader.loadClass() can still |
|
675 |
** return the Class if checkPackageAccess() checks out.<P> |
/** |
676 |
** |
* Check if the current thread is allowed to listen to a specific port for |
677 |
** This method is called by ClassLoader.loadClass() in |
* data. This method is called by ServerSocket.ServerSocket(). The default |
678 |
** user-created ClassLoaders.<P> |
* implementation checks |
679 |
** |
* <code>SocketPermission("localhost:" + (port == 0 ? "1024-" : "" + port), |
680 |
** SecurityManager's implementation always denies access. |
* "listen")</code>. If you override this, call |
681 |
** |
* <code>super.checkListen</code> rather than throwing an exception. |
682 |
** @param packageName the package name to check access to |
* |
683 |
** @exception SecurityException if the operation is not |
* @param port the port to listen on |
684 |
** permitted. |
* @throws SecurityException if permission is denied |
685 |
** @see java.lang.ClassLoader#loadClass(java.lang.String,boolean) |
* @see ServerSocket#ServerSocket(int) |
686 |
**/ |
*/ |
687 |
public void checkPackageDefinition(String packageName) { |
public void checkListen(int port) |
688 |
throw new SecurityException("Cannot load classes into any packages via the ClassLoader."); |
{ |
689 |
} |
// XXX Should be: |
690 |
|
// checkPermission(new SocketPermission("localhost:" |
691 |
/** Check if the current thread is allowed to set the |
// + (port == 0 ? "1024-" : "" +port), |
692 |
** current socket factory.<P> |
// "listen")); |
693 |
** |
throw new SecurityException("Cannot listen for connections."); |
694 |
** This method is called by Socket.setSocketImplFactory(), |
} |
695 |
** ServerSocket.setSocketFactory(), and |
|
696 |
** URL.setURLStreamHandlerFactory().<P> |
/** |
697 |
** |
* Check if the current thread is allowed to accept a connection from a |
698 |
** SecurityManager's implementation always denies access. |
* particular host on a particular port. This method is called by |
699 |
** |
* ServerSocket.implAccept(). The default implementation checks |
700 |
** @exception SecurityException if the operation is not |
* <code>SocketPermission(host + ":" + port, "accept")</code>. If you |
701 |
** permitted. |
* override this, call <code>super.checkAccept</code> rather than throwing |
702 |
** @see java.net.Socket#setSocketImplFactory(java.net.SocketImplFactory) |
* an exception. |
703 |
** @see java.net.ServerSocket#setSocketFactory(java.net.SocketImplFactory) |
* |
704 |
** @see java.net.URL#setURLStreamHandlerFactory(java.net.URLStreamHandlerFactory) |
* @param host the host which wishes to connect |
705 |
**/ |
* @param port the port the connection will be on |
706 |
public void checkSetFactory() { |
* @throws SecurityException if permission is denied |
707 |
throw new SecurityException("Cannot set the socket factory."); |
* @throws NullPointerException if host is null |
708 |
} |
* @see ServerSocket#accept() |
709 |
|
*/ |
710 |
/** Check if the current thread is allowed to get certain |
public void checkAccept(String host, int port) |
711 |
** types of Methods, Fields and Constructors from a Class |
{ |
712 |
** object.<P> |
// Use the toString() hack to do the null check. |
713 |
** |
// XXX Should be: |
714 |
** This method is called by Class.getMethod[s](), |
// checkPermission(new SocketPermission(host.toString() + ":" + port, |
715 |
** Class.getField[s](), Class.getConstructor[s], |
// "accept")); |
716 |
** Class.getDeclaredMethod[s](), |
throw new SecurityException("Cannot accept connections."); |
717 |
** Class.getDeclaredField[s](), and |
} |
718 |
** Class.getDeclaredConstructor[s]().<P> |
|
719 |
** |
/** |
720 |
** SecurityManager's implementation always denies access. |
* Check if the current thread is allowed to read and write multicast to |
721 |
** |
* a particular address. The default implementation checks |
722 |
** @param c the Class to check |
* <code>SocketPermission(addr.getHostAddress(), "accept,connect")</code>. |
723 |
** @param memberType the type of members to check |
* If you override this, call <code>super.checkMulticast</code> rather than |
724 |
** against, either Member.DECLARED or |
* throwing an exception. |
725 |
** Member.PUBLIC. |
* |
726 |
** @exception SecurityException if the operation is not |
* @param addr the address to multicast to |
727 |
** permitted. |
* @throws SecurityException if permission is denied |
728 |
** @see java.lang.Class |
* @throws NullPointerException if host is null |
729 |
** @see java.lang.reflect.Member#DECLARED |
* @since 1.1 |
730 |
** @see java.lang.reflect.Member#PUBLIC |
*/ |
731 |
**/ |
public void checkMulticast(InetAddress addr) |
732 |
public void checkMemberAccess(Class c, int memberType) { |
{ |
733 |
throw new SecurityException("Cannot access members of classes."); |
// XXX Should be: |
734 |
} |
// checkPermission(new SocketPermission(addr.getHostAddress(), |
735 |
|
// "accept,connect")); |
736 |
/** Test whether a particular security action may be |
throw new SecurityException("Cannot read or write multicast."); |
737 |
** taken. |
} |
738 |
** @param action the desired action to take |
|
739 |
** @exception SecurityException if the action is denied. |
/** |
740 |
** @XXX I have no idea what actions must be tested |
*Check if the current thread is allowed to read and write multicast to |
741 |
** or where. |
* a particular address with a particular ttl (time-to-live) value. The |
742 |
**/ |
* default implementation ignores ttl, and checks |
743 |
public void checkSecurityAccess(String action) { |
* <code>SocketPermission(addr.getHostAddress(), "accept,connect")</code>. |
744 |
checkPermission (new java.security.SecurityPermission (action)); |
* If you override this, call <code>super.checkMulticast</code> rather than |
745 |
} |
* throwing an exception. |
746 |
|
* |
747 |
/** Get the ThreadGroup that a new Thread should belong |
* @param addr the address to multicast to |
748 |
** to by default.<P> |
* @param ttl value in use for multicast send |
749 |
** |
* @throws SecurityException if permission is denied |
750 |
** Called by Thread.Thread().<P> |
* @throws NullPointerException if host is null |
751 |
** |
* @since 1.1 |
752 |
** SecurityManager's implementation just uses the |
* @deprecated use {@link #checkPermission(Permission)} instead |
753 |
** ThreadGroup of the current Thread.<P> |
*/ |
754 |
** |
public void checkMulticast(InetAddress addr, byte ttl) |
755 |
** <STRONG>Spec Note:</STRONG> it is not clear whether |
{ |
756 |
** the new Thread is guaranteed to pass the |
// XXX Should be: |
757 |
** checkAccessThreadGroup() test when using this |
// checkPermission(new SocketPermission(addr.getHostAddress(), |
758 |
** ThreadGroup. I presume so. |
// "accept,connect")); |
759 |
** |
throw new SecurityException("Cannot read or write multicast."); |
760 |
** @return the ThreadGroup to put the new Thread into. |
} |
761 |
**/ |
|
762 |
public ThreadGroup getThreadGroup() { |
/** |
763 |
return Thread.currentThread().getThreadGroup(); |
* Check if the current thread is allowed to read or write all the system |
764 |
} |
* properties at once. This method is called by System.getProperties() |
765 |
|
* and setProperties(). The default implementation checks |
766 |
public SecurityManager () { |
* <code>PropertyPermission("*", "read,write")</code>. If you override |
767 |
if (System.getSecurityManager () != null) |
* this, call <code>super.checkPropertiesAccess</code> rather than |
768 |
throw new SecurityException (); |
* throwing an exception. |
769 |
} |
* |
770 |
} |
* @throws SecurityException if permission is denied |
771 |
|
* @see System#getProperties() |
772 |
|
* @see System#setProperties(Properties) |
773 |
|
*/ |
774 |
|
public void checkPropertiesAccess() |
775 |
|
{ |
776 |
|
// XXX Should be: |
777 |
|
// checkPermission(new PropertyPermission("*", "read,write")); |
778 |
|
throw new SecurityException("Cannot access all system properties at once."); |
779 |
|
} |
780 |
|
|
781 |
|
/** |
782 |
|
* Check if the current thread is allowed to read a particular system |
783 |
|
* property (writes are checked directly via checkPermission). This method |
784 |
|
* is called by System.getProperty() and setProperty(). The default |
785 |
|
* implementation checks <code>PropertyPermission(key, "read")</code>. If |
786 |
|
* you override this, call <code>super.checkPropertyAccess</code> rather |
787 |
|
* than throwing an exception. |
788 |
|
* |
789 |
|
* @throws SecurityException if permission is denied |
790 |
|
* @throws NullPointerException if key is null |
791 |
|
* @throws IllegalArgumentException if key is "" |
792 |
|
* @see System#getProperty(String) |
793 |
|
*/ |
794 |
|
public void checkPropertyAccess(String key) |
795 |
|
{ |
796 |
|
// XXX Should be: checkPermission(new PropertyPermission(key, "read")); |
797 |
|
throw new SecurityException("Cannot access individual system properties."); |
798 |
|
} |
799 |
|
|
800 |
|
/** |
801 |
|
* Check if the current thread is allowed to create a top-level window. If |
802 |
|
* it is not, the operation should still go through, but some sort of |
803 |
|
* nonremovable warning should be placed on the window to show that it |
804 |
|
* is untrusted. This method is called by Window.Window(). The default |
805 |
|
* implementation checks |
806 |
|
* <code>AWTPermission("showWindowWithoutWarningBanner")</code>, and returns |
807 |
|
* true if no exception was thrown. If you override this, use |
808 |
|
* <code>return super.checkTopLevelWindow</code> rather than returning |
809 |
|
* false. |
810 |
|
* |
811 |
|
* @param window the window to create |
812 |
|
* @return true if there is permission to show the window without warning |
813 |
|
* @throws NullPointerException if window is null |
814 |
|
* @see Window#Window(Frame) |
815 |
|
*/ |
816 |
|
public boolean checkTopLevelWindow(Object window) |
817 |
|
{ |
818 |
|
// Should be: |
819 |
|
// if (window == null) |
820 |
|
// throw new NullPointerException(); |
821 |
|
// try |
822 |
|
// { |
823 |
|
// checkPermission(new AWTPermission("showWindowWithoutWarningBanner")); |
824 |
|
// return true; |
825 |
|
// } |
826 |
|
// catch (SecurityException e) |
827 |
|
// { |
828 |
|
// return false; |
829 |
|
// } |
830 |
|
return false; |
831 |
|
} |
832 |
|
|
833 |
|
/** |
834 |
|
* Check if the current thread is allowed to create a print job. This |
835 |
|
* method is called by Toolkit.getPrintJob(). The default implementation |
836 |
|
* checks <code>RuntimePermission("queuePrintJob")</code>. If you override |
837 |
|
* this, call <code>super.checkPrintJobAccess</code> rather than throwing |
838 |
|
* an exception. |
839 |
|
* |
840 |
|
* @throws SecurityException if permission is denied |
841 |
|
* @see Toolkit#getPrintJob(Frame, String, Properties) |
842 |
|
* @since 1.1 |
843 |
|
*/ |
844 |
|
public void checkPrintJobAccess() |
845 |
|
{ |
846 |
|
// XXX Should be: checkPermission(new RuntimePermission("queuePrintJob")); |
847 |
|
throw new SecurityException("Cannot create print jobs."); |
848 |
|
} |
849 |
|
|
850 |
|
/** |
851 |
|
* Check if the current thread is allowed to use the system clipboard. This |
852 |
|
* method is called by Toolkit.getSystemClipboard(). The default |
853 |
|
* implementation checks <code>AWTPermission("accessClipboard")</code>. If |
854 |
|
* you override this, call <code>super.checkSystemClipboardAccess</code> |
855 |
|
* rather than throwing an exception. |
856 |
|
* |
857 |
|
* @throws SecurityException if permission is denied |
858 |
|
* @see Toolkit#getSystemClipboard() |
859 |
|
* @since 1.1 |
860 |
|
*/ |
861 |
|
public void checkSystemClipboardAccess() |
862 |
|
{ |
863 |
|
// XXX Should be: checkPermission(new AWTPermission("accessClipboard")); |
864 |
|
throw new SecurityException("Cannot access the system clipboard."); |
865 |
|
} |
866 |
|
|
867 |
|
/** |
868 |
|
* Check if the current thread is allowed to use the AWT event queue. This |
869 |
|
* method is called by Toolkit.getSystemEventQueue(). The default |
870 |
|
* implementation checks <code>AWTPermission("accessEventQueue")</code>. |
871 |
|
* you override this, call <code>super.checkAwtEventQueueAccess</code> |
872 |
|
* rather than throwing an exception. |
873 |
|
* |
874 |
|
* @throws SecurityException if permission is denied |
875 |
|
* @see Toolkit#getSystemEventQueue() |
876 |
|
* @since 1.1 |
877 |
|
*/ |
878 |
|
public void checkAwtEventQueueAccess() |
879 |
|
{ |
880 |
|
// Should be: checkPermission(new AWTPermission("accessEventQueue")); |
881 |
|
throw new SecurityException("Cannot access the AWT event queue."); |
882 |
|
} |
883 |
|
|
884 |
|
/** |
885 |
|
* Check if the current thread is allowed to access the specified package |
886 |
|
* at all. This method is called by ClassLoader.loadClass() in user-created |
887 |
|
* ClassLoaders. The default implementation gets a list of all restricted |
888 |
|
* packages, via <code>Security.getProperty("package.access")</code>. Then, |
889 |
|
* if packageName starts with or equals any restricted package, it checks |
890 |
|
* <code>RuntimePermission("accessClassInPackage." + packageName)</code>. |
891 |
|
* If you override this, you should call |
892 |
|
* <code>super.checkPackageAccess</code> before doing anything else. |
893 |
|
* |
894 |
|
* @param packageName the package name to check access to |
895 |
|
* @throws SecurityException if permission is denied |
896 |
|
* @throws NullPointerException if packageName is null |
897 |
|
* @see ClassLoader#loadClass(String, boolean) |
898 |
|
* @see Security#getProperty(String) |
899 |
|
*/ |
900 |
|
public void checkPackageAccess(String packageName) |
901 |
|
{ |
902 |
|
// XXX Implement this. |
903 |
|
throw new SecurityException("Cannot access packages via the ClassLoader."); |
904 |
|
} |
905 |
|
|
906 |
|
/** |
907 |
|
* Check if the current thread is allowed to define a class into the |
908 |
|
* specified package. This method is called by ClassLoader.loadClass() in |
909 |
|
* user-created ClassLoaders. The default implementation gets a list of all |
910 |
|
* restricted packages, via |
911 |
|
* <code>Security.getProperty("package.definition")</code>. Then, if |
912 |
|
* packageName starts with or equals any restricted package, it checks |
913 |
|
* <code>RuntimePermission("defineClassInPackage." + packageName)</code>. |
914 |
|
* If you override this, you should call |
915 |
|
* <code>super.checkPackageDefinition</code> before doing anything else. |
916 |
|
* |
917 |
|
* @param packageName the package name to check access to |
918 |
|
* @throws SecurityException if permission is denied |
919 |
|
* @throws NullPointerException if packageName is null |
920 |
|
* @see ClassLoader#loadClass(String, boolean) |
921 |
|
* @see Security#getProperty(String) |
922 |
|
*/ |
923 |
|
public void checkPackageDefinition(String packageName) |
924 |
|
{ |
925 |
|
// XXX Implement this. |
926 |
|
throw new SecurityException("Cannot load classes into any packages via the ClassLoader."); |
927 |
|
} |
928 |
|
|
929 |
|
/** |
930 |
|
* Check if the current thread is allowed to set the current socket factory. |
931 |
|
* This method is called by Socket.setSocketImplFactory(), |
932 |
|
* ServerSocket.setSocketFactory(), and URL.setURLStreamHandlerFactory(). |
933 |
|
* The default implementation checks |
934 |
|
* <code>RuntimePermission("setFactory")</code>. If you override this, call |
935 |
|
* <code>super.checkSetFactory</code> rather than throwing an exception. |
936 |
|
* |
937 |
|
* @throws SecurityException if permission is denied |
938 |
|
* @see Socket#setSocketImplFactory(SocketImplFactory) |
939 |
|
* @see ServerSocket#setSocketFactory(SocketImplFactory) |
940 |
|
* @see URL#setURLStreamHandlerFactory(URLStreamHandlerFactory) |
941 |
|
*/ |
942 |
|
public void checkSetFactory() |
943 |
|
{ |
944 |
|
// XXX Should be: checkPermission(new RuntimePermission("setFactory")); |
945 |
|
throw new SecurityException("Cannot set the socket factory."); |
946 |
|
} |
947 |
|
|
948 |
|
/** |
949 |
|
* Check if the current thread is allowed to get certain types of Methods, |
950 |
|
* Fields and Constructors from a Class object. This method is called by |
951 |
|
* Class.getMethod[s](), Class.getField[s](), Class.getConstructor[s], |
952 |
|
* Class.getDeclaredMethod[s](), Class.getDeclaredField[s](), and |
953 |
|
* Class.getDeclaredConstructor[s](). The default implementation allows |
954 |
|
* PUBLIC access, and access to classes defined by the same classloader as |
955 |
|
* the code performing the reflection. Otherwise, it checks |
956 |
|
* <code>RuntimePermission("accessDeclaredMembers")</code>. If you override |
957 |
|
* this, do not call <code>super.checkMemberAccess</code>, as this would |
958 |
|
* mess up the stack depth check that determines the ClassLoader requesting |
959 |
|
* the access. |
960 |
|
* |
961 |
|
* @param c the Class to check |
962 |
|
* @param memberType either DECLARED or PUBLIC |
963 |
|
* @throws SecurityException if permission is denied, including when |
964 |
|
* memberType is not DECLARED or PUBLIC |
965 |
|
* @throws NullPointerException if c is null |
966 |
|
* @see Class |
967 |
|
* @see Member#DECLARED |
968 |
|
* @see Member#PUBLIC |
969 |
|
* @since 1.1 |
970 |
|
*/ |
971 |
|
public void checkMemberAccess(Class c, int memberType) |
972 |
|
{ |
973 |
|
// XXX Implement this. |
974 |
|
throw new SecurityException("Cannot access members of classes."); |
975 |
|
} |
976 |
|
|
977 |
|
/** |
978 |
|
* Test whether a particular security action may be taken. The default |
979 |
|
* implementation checks <code>SecurityPermission(action)</code>. If you |
980 |
|
* override this, call <code>super.checkSecurityAccess</code> rather than |
981 |
|
* throwing an exception. |
982 |
|
* |
983 |
|
* @param action the desired action to take |
984 |
|
* @throws SecurityException if permission is denied |
985 |
|
* @throws NullPointerException if action is null |
986 |
|
* @throws IllegalArgumentException if action is "" |
987 |
|
* @since 1.1 |
988 |
|
*/ |
989 |
|
public void checkSecurityAccess(String action) |
990 |
|
{ |
991 |
|
checkPermission(new SecurityPermission(action)); |
992 |
|
} |
993 |
|
|
994 |
|
/** |
995 |
|
* Get the ThreadGroup that a new Thread should belong to by default. Called |
996 |
|
* by Thread.Thread(). The default implementation returns the current |
997 |
|
* ThreadGroup of the current Thread. <STRONG>Spec Note:</STRONG> it is not |
998 |
|
* clear whether the new Thread is guaranteed to pass the |
999 |
|
* checkAccessThreadGroup() test when using this ThreadGroup, but I presume |
1000 |
|
* so. |
1001 |
|
* |
1002 |
|
* @return the ThreadGroup to put the new Thread into |
1003 |
|
* @since 1.1 |
1004 |
|
*/ |
1005 |
|
public ThreadGroup getThreadGroup() |
1006 |
|
{ |
1007 |
|
return Thread.currentThread().getThreadGroup(); |
1008 |
|
} |
1009 |
|
} // class SecurityManager |
1010 |
|
|
1011 |
|
// XXX This class is unnecessary. |
1012 |
class SecurityContext { |
class SecurityContext { |
1013 |
Class[] classes; |
Class[] classes; |
1014 |
SecurityContext(Class[] classes) { |
SecurityContext(Class[] classes) { |