| /* |
| * Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.acl; |
| |
| import java.io.*; |
| import java.util.*; |
| import java.security.Principal; |
| import java.security.acl.*; |
| |
| /** |
| * An Access Control List (ACL) is encapsulated by this class. |
| * @author Satish Dharmaraj |
| */ |
| public class AclImpl extends OwnerImpl implements Acl { |
| // |
| // Maintain four tables. one each for positive and negative |
| // ACLs. One each depending on whether the entity is a group |
| // or principal. |
| // |
| private Hashtable<Principal, AclEntry> allowedUsersTable = |
| new Hashtable<>(23); |
| private Hashtable<Principal, AclEntry> allowedGroupsTable = |
| new Hashtable<>(23); |
| private Hashtable<Principal, AclEntry> deniedUsersTable = |
| new Hashtable<>(23); |
| private Hashtable<Principal, AclEntry> deniedGroupsTable = |
| new Hashtable<>(23); |
| private String aclName = null; |
| private Vector<Permission> zeroSet = new Vector<>(1,1); |
| |
| |
| /** |
| * Constructor for creating an empty ACL. |
| */ |
| public AclImpl(Principal owner, String name) { |
| super(owner); |
| try { |
| setName(owner, name); |
| } catch (Exception e) {} |
| } |
| |
| /** |
| * Sets the name of the ACL. |
| * @param caller the principal who is invoking this method. |
| * @param name the name of the ACL. |
| * @exception NotOwnerException if the caller principal is |
| * not on the owners list of the Acl. |
| */ |
| public void setName(Principal caller, String name) |
| throws NotOwnerException |
| { |
| if (!isOwner(caller)) |
| throw new NotOwnerException(); |
| |
| aclName = name; |
| } |
| |
| /** |
| * Returns the name of the ACL. |
| * @return the name of the ACL. |
| */ |
| public String getName() { |
| return aclName; |
| } |
| |
| /** |
| * Adds an ACL entry to this ACL. An entry associates a |
| * group or a principal with a set of permissions. Each |
| * user or group can have one positive ACL entry and one |
| * negative ACL entry. If there is one of the type (negative |
| * or positive) already in the table, a false value is returned. |
| * The caller principal must be a part of the owners list of |
| * the ACL in order to invoke this method. |
| * @param caller the principal who is invoking this method. |
| * @param entry the ACL entry that must be added to the ACL. |
| * @return true on success, false if the entry is already present. |
| * @exception NotOwnerException if the caller principal |
| * is not on the owners list of the Acl. |
| */ |
| public synchronized boolean addEntry(Principal caller, AclEntry entry) |
| throws NotOwnerException |
| { |
| if (!isOwner(caller)) |
| throw new NotOwnerException(); |
| |
| Hashtable<Principal, AclEntry> aclTable = findTable(entry); |
| Principal key = entry.getPrincipal(); |
| |
| if (aclTable.get(key) != null) |
| return false; |
| |
| aclTable.put(key, entry); |
| return true; |
| } |
| |
| /** |
| * Removes an ACL entry from this ACL. |
| * The caller principal must be a part of the owners list of the ACL |
| * in order to invoke this method. |
| * @param caller the principal who is invoking this method. |
| * @param entry the ACL entry that must be removed from the ACL. |
| * @return true on success, false if the entry is not part of the ACL. |
| * @exception NotOwnerException if the caller principal is not |
| * the owners list of the Acl. |
| */ |
| public synchronized boolean removeEntry(Principal caller, AclEntry entry) |
| throws NotOwnerException |
| { |
| if (!isOwner(caller)) |
| throw new NotOwnerException(); |
| |
| Hashtable<Principal, AclEntry> aclTable = findTable(entry); |
| Principal key = entry.getPrincipal(); |
| |
| AclEntry o = aclTable.remove(key); |
| return (o != null); |
| } |
| |
| /** |
| * This method returns the set of allowed permissions for the |
| * specified principal. This set of allowed permissions is calculated |
| * as follows: |
| * |
| * If there is no entry for a group or a principal an empty permission |
| * set is assumed. |
| * |
| * The group positive permission set is the union of all |
| * the positive permissions of each group that the individual belongs to. |
| * The group negative permission set is the union of all |
| * the negative permissions of each group that the individual belongs to. |
| * If there is a specific permission that occurs in both |
| * the postive permission set and the negative permission set, |
| * it is removed from both. The group positive and negatoive permission |
| * sets are calculated. |
| * |
| * The individial positive permission set and the individual negative |
| * permission set is then calculated. Again abscence of an entry means |
| * the empty set. |
| * |
| * The set of permissions granted to the principal is then calculated using |
| * the simple rule: Individual permissions always override the Group permissions. |
| * Specifically, individual negative permission set (specific |
| * denial of permissions) overrides the group positive permission set. |
| * And the individual positive permission set override the group negative |
| * permission set. |
| * |
| * @param user the principal for which the ACL entry is returned. |
| * @return The resulting permission set that the principal is allowed. |
| */ |
| public synchronized Enumeration<Permission> getPermissions(Principal user) { |
| |
| Enumeration<Permission> individualPositive; |
| Enumeration<Permission> individualNegative; |
| Enumeration<Permission> groupPositive; |
| Enumeration<Permission> groupNegative; |
| |
| // |
| // canonicalize the sets. That is remove common permissions from |
| // positive and negative sets. |
| // |
| groupPositive = |
| subtract(getGroupPositive(user), getGroupNegative(user)); |
| groupNegative = |
| subtract(getGroupNegative(user), getGroupPositive(user)); |
| individualPositive = |
| subtract(getIndividualPositive(user), getIndividualNegative(user)); |
| individualNegative = |
| subtract(getIndividualNegative(user), getIndividualPositive(user)); |
| |
| // |
| // net positive permissions is individual positive permissions |
| // plus (group positive - individual negative). |
| // |
| Enumeration<Permission> temp1 = |
| subtract(groupPositive, individualNegative); |
| Enumeration<Permission> netPositive = |
| union(individualPositive, temp1); |
| |
| // recalculate the enumeration since we lost it in performing the |
| // subtraction |
| // |
| individualPositive = |
| subtract(getIndividualPositive(user), getIndividualNegative(user)); |
| individualNegative = |
| subtract(getIndividualNegative(user), getIndividualPositive(user)); |
| |
| // |
| // net negative permissions is individual negative permissions |
| // plus (group negative - individual positive). |
| // |
| temp1 = subtract(groupNegative, individualPositive); |
| Enumeration<Permission> netNegative = union(individualNegative, temp1); |
| |
| return subtract(netPositive, netNegative); |
| } |
| |
| /** |
| * This method checks whether or not the specified principal |
| * has the required permission. If permission is denied |
| * permission false is returned, a true value is returned otherwise. |
| * This method does not authenticate the principal. It presumes that |
| * the principal is a valid authenticated principal. |
| * @param principal the name of the authenticated principal |
| * @param permission the permission that the principal must have. |
| * @return true of the principal has the permission desired, false |
| * otherwise. |
| */ |
| public boolean checkPermission(Principal principal, Permission permission) |
| { |
| Enumeration<Permission> permSet = getPermissions(principal); |
| while (permSet.hasMoreElements()) { |
| Permission p = permSet.nextElement(); |
| if (p.equals(permission)) |
| return true; |
| } |
| return false; |
| } |
| |
| /** |
| * returns an enumeration of the entries in this ACL. |
| */ |
| public synchronized Enumeration<AclEntry> entries() { |
| return new AclEnumerator(this, |
| allowedUsersTable, allowedGroupsTable, |
| deniedUsersTable, deniedGroupsTable); |
| } |
| |
| /** |
| * return a stringified version of the |
| * ACL. |
| */ |
| public String toString() { |
| StringBuffer sb = new StringBuffer(); |
| Enumeration<AclEntry> entries = entries(); |
| while (entries.hasMoreElements()) { |
| AclEntry entry = entries.nextElement(); |
| sb.append(entry.toString().trim()); |
| sb.append("\n"); |
| } |
| |
| return sb.toString(); |
| } |
| |
| // |
| // Find the table that this entry belongs to. There are 4 |
| // tables that are maintained. One each for postive and |
| // negative ACLs and one each for groups and users. |
| // This method figures out which |
| // table is the one that this AclEntry belongs to. |
| // |
| private Hashtable<Principal, AclEntry> findTable(AclEntry entry) { |
| Hashtable<Principal, AclEntry> aclTable = null; |
| |
| Principal p = entry.getPrincipal(); |
| if (p instanceof Group) { |
| if (entry.isNegative()) |
| aclTable = deniedGroupsTable; |
| else |
| aclTable = allowedGroupsTable; |
| } else { |
| if (entry.isNegative()) |
| aclTable = deniedUsersTable; |
| else |
| aclTable = allowedUsersTable; |
| } |
| return aclTable; |
| } |
| |
| // |
| // returns the set e1 U e2. |
| // |
| private static Enumeration<Permission> union(Enumeration<Permission> e1, |
| Enumeration<Permission> e2) { |
| Vector<Permission> v = new Vector<>(20, 20); |
| |
| while (e1.hasMoreElements()) |
| v.addElement(e1.nextElement()); |
| |
| while (e2.hasMoreElements()) { |
| Permission o = e2.nextElement(); |
| if (!v.contains(o)) |
| v.addElement(o); |
| } |
| |
| return v.elements(); |
| } |
| |
| // |
| // returns the set e1 - e2. |
| // |
| private Enumeration<Permission> subtract(Enumeration<Permission> e1, |
| Enumeration<Permission> e2) { |
| Vector<Permission> v = new Vector<>(20, 20); |
| |
| while (e1.hasMoreElements()) |
| v.addElement(e1.nextElement()); |
| |
| while (e2.hasMoreElements()) { |
| Permission o = e2.nextElement(); |
| if (v.contains(o)) |
| v.removeElement(o); |
| } |
| |
| return v.elements(); |
| } |
| |
| private Enumeration<Permission> getGroupPositive(Principal user) { |
| Enumeration<Permission> groupPositive = zeroSet.elements(); |
| Enumeration<Principal> e = allowedGroupsTable.keys(); |
| while (e.hasMoreElements()) { |
| Group g = (Group)e.nextElement(); |
| if (g.isMember(user)) { |
| AclEntry ae = allowedGroupsTable.get(g); |
| groupPositive = union(ae.permissions(), groupPositive); |
| } |
| } |
| return groupPositive; |
| } |
| |
| private Enumeration<Permission> getGroupNegative(Principal user) { |
| Enumeration<Permission> groupNegative = zeroSet.elements(); |
| Enumeration<Principal> e = deniedGroupsTable.keys(); |
| while (e.hasMoreElements()) { |
| Group g = (Group)e.nextElement(); |
| if (g.isMember(user)) { |
| AclEntry ae = deniedGroupsTable.get(g); |
| groupNegative = union(ae.permissions(), groupNegative); |
| } |
| } |
| return groupNegative; |
| } |
| |
| private Enumeration<Permission> getIndividualPositive(Principal user) { |
| Enumeration<Permission> individualPositive = zeroSet.elements(); |
| AclEntry ae = allowedUsersTable.get(user); |
| if (ae != null) |
| individualPositive = ae.permissions(); |
| return individualPositive; |
| } |
| |
| private Enumeration<Permission> getIndividualNegative(Principal user) { |
| Enumeration<Permission> individualNegative = zeroSet.elements(); |
| AclEntry ae = deniedUsersTable.get(user); |
| if (ae != null) |
| individualNegative = ae.permissions(); |
| return individualNegative; |
| } |
| } |
| |
| final class AclEnumerator implements Enumeration<AclEntry> { |
| Acl acl; |
| Enumeration<AclEntry> u1, u2, g1, g2; |
| |
| AclEnumerator(Acl acl, Hashtable<?,AclEntry> u1, Hashtable<?,AclEntry> g1, |
| Hashtable<?,AclEntry> u2, Hashtable<?,AclEntry> g2) { |
| this.acl = acl; |
| this.u1 = u1.elements(); |
| this.u2 = u2.elements(); |
| this.g1 = g1.elements(); |
| this.g2 = g2.elements(); |
| } |
| |
| public boolean hasMoreElements() { |
| return (u1.hasMoreElements() || |
| u2.hasMoreElements() || |
| g1.hasMoreElements() || |
| g2.hasMoreElements()); |
| } |
| |
| public AclEntry nextElement() |
| { |
| AclEntry o; |
| synchronized (acl) { |
| if (u1.hasMoreElements()) |
| return u1.nextElement(); |
| if (u2.hasMoreElements()) |
| return u2.nextElement(); |
| if (g1.hasMoreElements()) |
| return g1.nextElement(); |
| if (g2.hasMoreElements()) |
| return g2.nextElement(); |
| } |
| throw new NoSuchElementException("Acl Enumerator"); |
| } |
| } |
