| /* |
| * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package java.security; |
| |
| import sun.security.util.Debug; |
| import jdk.internal.reflect.CallerSensitive; |
| import jdk.internal.reflect.Reflection; |
| |
| /** |
| * <p> The AccessController class is used for access control operations |
| * and decisions. |
| * |
| * <p> More specifically, the AccessController class is used for |
| * three purposes: |
| * |
| * <ul> |
| * <li> to decide whether an access to a critical system |
| * resource is to be allowed or denied, based on the security policy |
| * currently in effect, |
| * <li>to mark code as being "privileged", thus affecting subsequent |
| * access determinations, and |
| * <li>to obtain a "snapshot" of the current calling context so |
| * access-control decisions from a different context can be made with |
| * respect to the saved context. </ul> |
| * |
| * <p> The {@link #checkPermission(Permission) checkPermission} method |
| * determines whether the access request indicated by a specified |
| * permission should be granted or denied. A sample call appears |
| * below. In this example, {@code checkPermission} will determine |
| * whether or not to grant "read" access to the file named "testFile" in |
| * the "/temp" directory. |
| * |
| * <pre> |
| * |
| * FilePermission perm = new FilePermission("/temp/testFile", "read"); |
| * AccessController.checkPermission(perm); |
| * |
| * </pre> |
| * |
| * <p> If a requested access is allowed, |
| * {@code checkPermission} returns quietly. If denied, an |
| * AccessControlException is |
| * thrown. AccessControlException can also be thrown if the requested |
| * permission is of an incorrect type or contains an invalid value. |
| * Such information is given whenever possible. |
| * |
| * Suppose the current thread traversed m callers, in the order of caller 1 |
| * to caller 2 to caller m. Then caller m invoked the |
| * {@code checkPermission} method. |
| * The {@code checkPermission} method determines whether access |
| * is granted or denied based on the following algorithm: |
| * |
| * <pre> {@code |
| * for (int i = m; i > 0; i--) { |
| * |
| * if (caller i's domain does not have the permission) |
| * throw AccessControlException |
| * |
| * else if (caller i is marked as privileged) { |
| * if (a context was specified in the call to doPrivileged) |
| * context.checkPermission(permission) |
| * if (limited permissions were specified in the call to doPrivileged) { |
| * for (each limited permission) { |
| * if (the limited permission implies the requested permission) |
| * return; |
| * } |
| * } else |
| * return; |
| * } |
| * } |
| * |
| * // Next, check the context inherited when the thread was created. |
| * // Whenever a new thread is created, the AccessControlContext at |
| * // that time is stored and associated with the new thread, as the |
| * // "inherited" context. |
| * |
| * inheritedContext.checkPermission(permission); |
| * }</pre> |
| * |
| * <p> A caller can be marked as being "privileged" |
| * (see {@link #doPrivileged(PrivilegedAction) doPrivileged} and below). |
| * When making access control decisions, the {@code checkPermission} |
| * method stops checking if it reaches a caller that |
| * was marked as "privileged" via a {@code doPrivileged} |
| * call without a context argument (see below for information about a |
| * context argument). If that caller's domain has the |
| * specified permission and at least one limiting permission argument (if any) |
| * implies the requested permission, no further checking is done and |
| * {@code checkPermission} |
| * returns quietly, indicating that the requested access is allowed. |
| * If that domain does not have the specified permission, an exception |
| * is thrown, as usual. If the caller's domain had the specified permission |
| * but it was not implied by any limiting permission arguments given in the call |
| * to {@code doPrivileged} then the permission checking continues |
| * until there are no more callers or another {@code doPrivileged} |
| * call matches the requested permission and returns normally. |
| * |
| * <p> The normal use of the "privileged" feature is as follows. If you |
| * don't need to return a value from within the "privileged" block, do |
| * the following: |
| * |
| * <pre> {@code |
| * somemethod() { |
| * ...normal code here... |
| * AccessController.doPrivileged(new PrivilegedAction<Void>() { |
| * public Void run() { |
| * // privileged code goes here, for example: |
| * System.loadLibrary("awt"); |
| * return null; // nothing to return |
| * } |
| * }); |
| * ...normal code here... |
| * }}</pre> |
| * |
| * <p> |
| * PrivilegedAction is an interface with a single method, named |
| * {@code run}. |
| * The above example shows creation of an implementation |
| * of that interface; a concrete implementation of the |
| * {@code run} method is supplied. |
| * When the call to {@code doPrivileged} is made, an |
| * instance of the PrivilegedAction implementation is passed |
| * to it. The {@code doPrivileged} method calls the |
| * {@code run} method from the PrivilegedAction |
| * implementation after enabling privileges, and returns the |
| * {@code run} method's return value as the |
| * {@code doPrivileged} return value (which is |
| * ignored in this example). |
| * |
| * <p> If you need to return a value, you can do something like the following: |
| * |
| * <pre> {@code |
| * somemethod() { |
| * ...normal code here... |
| * String user = AccessController.doPrivileged( |
| * new PrivilegedAction<String>() { |
| * public String run() { |
| * return System.getProperty("user.name"); |
| * } |
| * }); |
| * ...normal code here... |
| * }}</pre> |
| * |
| * <p>If the action performed in your {@code run} method could |
| * throw a "checked" exception (those listed in the {@code throws} clause |
| * of a method), then you need to use the |
| * {@code PrivilegedExceptionAction} interface instead of the |
| * {@code PrivilegedAction} interface: |
| * |
| * <pre> {@code |
| * somemethod() throws FileNotFoundException { |
| * ...normal code here... |
| * try { |
| * FileInputStream fis = AccessController.doPrivileged( |
| * new PrivilegedExceptionAction<FileInputStream>() { |
| * public FileInputStream run() throws FileNotFoundException { |
| * return new FileInputStream("someFile"); |
| * } |
| * }); |
| * } catch (PrivilegedActionException e) { |
| * // e.getException() should be an instance of FileNotFoundException, |
| * // as only "checked" exceptions will be "wrapped" in a |
| * // PrivilegedActionException. |
| * throw (FileNotFoundException) e.getException(); |
| * } |
| * ...normal code here... |
| * }}</pre> |
| * |
| * <p> Be *very* careful in your use of the "privileged" construct, and |
| * always remember to make the privileged code section as small as possible. |
| * You can pass {@code Permission} arguments to further limit the |
| * scope of the "privilege" (see below). |
| * |
| * |
| * <p> Note that {@code checkPermission} always performs security checks |
| * within the context of the currently executing thread. |
| * Sometimes a security check that should be made within a given context |
| * will actually need to be done from within a |
| * <i>different</i> context (for example, from within a worker thread). |
| * The {@link #getContext() getContext} method and |
| * AccessControlContext class are provided |
| * for this situation. The {@code getContext} method takes a "snapshot" |
| * of the current calling context, and places |
| * it in an AccessControlContext object, which it returns. A sample call is |
| * the following: |
| * |
| * <pre> |
| * |
| * AccessControlContext acc = AccessController.getContext() |
| * |
| * </pre> |
| * |
| * <p> |
| * AccessControlContext itself has a {@code checkPermission} method |
| * that makes access decisions based on the context <i>it</i> encapsulates, |
| * rather than that of the current execution thread. |
| * Code within a different context can thus call that method on the |
| * previously-saved AccessControlContext object. A sample call is the |
| * following: |
| * |
| * <pre> |
| * |
| * acc.checkPermission(permission) |
| * |
| * </pre> |
| * |
| * <p> There are also times where you don't know a priori which permissions |
| * to check the context against. In these cases you can use the |
| * doPrivileged method that takes a context. You can also limit the scope |
| * of the privileged code by passing additional {@code Permission} |
| * parameters. |
| * |
| * <pre> {@code |
| * somemethod() { |
| * AccessController.doPrivileged(new PrivilegedAction<Object>() { |
| * public Object run() { |
| * // Code goes here. Any permission checks within this |
| * // run method will require that the intersection of the |
| * // caller's protection domain and the snapshot's |
| * // context have the desired permission. If a requested |
| * // permission is not implied by the limiting FilePermission |
| * // argument then checking of the thread continues beyond the |
| * // caller of doPrivileged. |
| * } |
| * }, acc, new FilePermission("/temp/*", read)); |
| * ...normal code here... |
| * }}</pre> |
| * <p> Passing a limiting {@code Permission} argument of an instance of |
| * {@code AllPermission} is equivalent to calling the equivalent |
| * {@code doPrivileged} method without limiting {@code Permission} |
| * arguments. Passing a zero length array of {@code Permission} disables |
| * the code privileges so that checking always continues beyond the caller of |
| * that {@code doPrivileged} method. |
| * |
| * @see AccessControlContext |
| * |
| * @author Li Gong |
| * @author Roland Schemers |
| */ |
| |
| public final class AccessController { |
| |
| /** |
| * Don't allow anyone to instantiate an AccessController |
| */ |
| private AccessController() { } |
| |
| /** |
| * Performs the specified {@code PrivilegedAction} with privileges |
| * enabled. The action is performed with <i>all</i> of the permissions |
| * possessed by the caller's protection domain. |
| * |
| * <p> If the action's {@code run} method throws an (unchecked) |
| * exception, it will propagate through this method. |
| * |
| * <p> Note that any DomainCombiner associated with the current |
| * AccessControlContext will be ignored while the action is performed. |
| * |
| * @param <T> the type of the value returned by the PrivilegedAction's |
| * {@code run} method. |
| * |
| * @param action the action to be performed. |
| * |
| * @return the value returned by the action's {@code run} method. |
| * |
| * @exception NullPointerException if the action is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction,AccessControlContext) |
| * @see #doPrivileged(PrivilegedExceptionAction) |
| * @see #doPrivilegedWithCombiner(PrivilegedAction) |
| * @see java.security.DomainCombiner |
| */ |
| |
| @CallerSensitive |
| public static native <T> T doPrivileged(PrivilegedAction<T> action); |
| |
| /** |
| * Performs the specified {@code PrivilegedAction} with privileges |
| * enabled. The action is performed with <i>all</i> of the permissions |
| * possessed by the caller's protection domain. |
| * |
| * <p> If the action's {@code run} method throws an (unchecked) |
| * exception, it will propagate through this method. |
| * |
| * <p> This method preserves the current AccessControlContext's |
| * DomainCombiner (which may be null) while the action is performed. |
| * |
| * @param <T> the type of the value returned by the PrivilegedAction's |
| * {@code run} method. |
| * |
| * @param action the action to be performed. |
| * |
| * @return the value returned by the action's {@code run} method. |
| * |
| * @exception NullPointerException if the action is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction) |
| * @see java.security.DomainCombiner |
| * |
| * @since 1.6 |
| */ |
| @CallerSensitive |
| public static <T> T doPrivilegedWithCombiner(PrivilegedAction<T> action) { |
| AccessControlContext acc = getStackAccessControlContext(); |
| if (acc == null) { |
| return AccessController.doPrivileged(action); |
| } |
| DomainCombiner dc = acc.getAssignedCombiner(); |
| return AccessController.doPrivileged(action, |
| preserveCombiner(dc, Reflection.getCallerClass())); |
| } |
| |
| |
| /** |
| * Performs the specified {@code PrivilegedAction} with privileges |
| * enabled and restricted by the specified {@code AccessControlContext}. |
| * The action is performed with the intersection of the permissions |
| * possessed by the caller's protection domain, and those possessed |
| * by the domains represented by the specified {@code AccessControlContext}. |
| * <p> |
| * If the action's {@code run} method throws an (unchecked) exception, |
| * it will propagate through this method. |
| * <p> |
| * If a security manager is installed and the specified |
| * {@code AccessControlContext} was not created by system code and the |
| * caller's {@code ProtectionDomain} has not been granted the |
| * {@literal "createAccessControlContext"} |
| * {@link java.security.SecurityPermission}, then the action is performed |
| * with no permissions. |
| * |
| * @param <T> the type of the value returned by the PrivilegedAction's |
| * {@code run} method. |
| * @param action the action to be performed. |
| * @param context an <i>access control context</i> |
| * representing the restriction to be applied to the |
| * caller's domain's privileges before performing |
| * the specified action. If the context is |
| * {@code null}, then no additional restriction is applied. |
| * |
| * @return the value returned by the action's {@code run} method. |
| * |
| * @exception NullPointerException if the action is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction) |
| * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext) |
| */ |
| @CallerSensitive |
| public static native <T> T doPrivileged(PrivilegedAction<T> action, |
| AccessControlContext context); |
| |
| |
| /** |
| * Performs the specified {@code PrivilegedAction} with privileges |
| * enabled and restricted by the specified |
| * {@code AccessControlContext} and with a privilege scope limited |
| * by specified {@code Permission} arguments. |
| * |
| * The action is performed with the intersection of the permissions |
| * possessed by the caller's protection domain, and those possessed |
| * by the domains represented by the specified |
| * {@code AccessControlContext}. |
| * <p> |
| * If the action's {@code run} method throws an (unchecked) exception, |
| * it will propagate through this method. |
| * <p> |
| * If a security manager is installed and the specified |
| * {@code AccessControlContext} was not created by system code and the |
| * caller's {@code ProtectionDomain} has not been granted the |
| * {@literal "createAccessControlContext"} |
| * {@link java.security.SecurityPermission}, then the action is performed |
| * with no permissions. |
| * |
| * @param <T> the type of the value returned by the PrivilegedAction's |
| * {@code run} method. |
| * @param action the action to be performed. |
| * @param context an <i>access control context</i> |
| * representing the restriction to be applied to the |
| * caller's domain's privileges before performing |
| * the specified action. If the context is |
| * {@code null}, |
| * then no additional restriction is applied. |
| * @param perms the {@code Permission} arguments which limit the |
| * scope of the caller's privileges. The number of arguments |
| * is variable. |
| * |
| * @return the value returned by the action's {@code run} method. |
| * |
| * @throws NullPointerException if action or perms or any element of |
| * perms is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction) |
| * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext) |
| * |
| * @since 1.8 |
| */ |
| @CallerSensitive |
| public static <T> T doPrivileged(PrivilegedAction<T> action, |
| AccessControlContext context, Permission... perms) { |
| |
| AccessControlContext parent = getContext(); |
| if (perms == null) { |
| throw new NullPointerException("null permissions parameter"); |
| } |
| Class <?> caller = Reflection.getCallerClass(); |
| return AccessController.doPrivileged(action, createWrapper(null, |
| caller, parent, context, perms)); |
| } |
| |
| |
| /** |
| * Performs the specified {@code PrivilegedAction} with privileges |
| * enabled and restricted by the specified |
| * {@code AccessControlContext} and with a privilege scope limited |
| * by specified {@code Permission} arguments. |
| * |
| * The action is performed with the intersection of the permissions |
| * possessed by the caller's protection domain, and those possessed |
| * by the domains represented by the specified |
| * {@code AccessControlContext}. |
| * <p> |
| * If the action's {@code run} method throws an (unchecked) exception, |
| * it will propagate through this method. |
| * |
| * <p> This method preserves the current AccessControlContext's |
| * DomainCombiner (which may be null) while the action is performed. |
| * <p> |
| * If a security manager is installed and the specified |
| * {@code AccessControlContext} was not created by system code and the |
| * caller's {@code ProtectionDomain} has not been granted the |
| * {@literal "createAccessControlContext"} |
| * {@link java.security.SecurityPermission}, then the action is performed |
| * with no permissions. |
| * |
| * @param <T> the type of the value returned by the PrivilegedAction's |
| * {@code run} method. |
| * @param action the action to be performed. |
| * @param context an <i>access control context</i> |
| * representing the restriction to be applied to the |
| * caller's domain's privileges before performing |
| * the specified action. If the context is |
| * {@code null}, |
| * then no additional restriction is applied. |
| * @param perms the {@code Permission} arguments which limit the |
| * scope of the caller's privileges. The number of arguments |
| * is variable. |
| * |
| * @return the value returned by the action's {@code run} method. |
| * |
| * @throws NullPointerException if action or perms or any element of |
| * perms is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction) |
| * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext) |
| * @see java.security.DomainCombiner |
| * |
| * @since 1.8 |
| */ |
| @CallerSensitive |
| public static <T> T doPrivilegedWithCombiner(PrivilegedAction<T> action, |
| AccessControlContext context, Permission... perms) { |
| |
| AccessControlContext parent = getContext(); |
| DomainCombiner dc = parent.getCombiner(); |
| if (dc == null && context != null) { |
| dc = context.getCombiner(); |
| } |
| if (perms == null) { |
| throw new NullPointerException("null permissions parameter"); |
| } |
| Class <?> caller = Reflection.getCallerClass(); |
| return AccessController.doPrivileged(action, createWrapper(dc, caller, |
| parent, context, perms)); |
| } |
| |
| /** |
| * Performs the specified {@code PrivilegedExceptionAction} with |
| * privileges enabled. The action is performed with <i>all</i> of the |
| * permissions possessed by the caller's protection domain. |
| * |
| * <p> If the action's {@code run} method throws an <i>unchecked</i> |
| * exception, it will propagate through this method. |
| * |
| * <p> Note that any DomainCombiner associated with the current |
| * AccessControlContext will be ignored while the action is performed. |
| * |
| * @param <T> the type of the value returned by the |
| * PrivilegedExceptionAction's {@code run} method. |
| * |
| * @param action the action to be performed |
| * |
| * @return the value returned by the action's {@code run} method |
| * |
| * @exception PrivilegedActionException if the specified action's |
| * {@code run} method threw a <i>checked</i> exception |
| * @exception NullPointerException if the action is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction) |
| * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext) |
| * @see #doPrivilegedWithCombiner(PrivilegedExceptionAction) |
| * @see java.security.DomainCombiner |
| */ |
| @CallerSensitive |
| public static native <T> T |
| doPrivileged(PrivilegedExceptionAction<T> action) |
| throws PrivilegedActionException; |
| |
| |
| /** |
| * Performs the specified {@code PrivilegedExceptionAction} with |
| * privileges enabled. The action is performed with <i>all</i> of the |
| * permissions possessed by the caller's protection domain. |
| * |
| * <p> If the action's {@code run} method throws an <i>unchecked</i> |
| * exception, it will propagate through this method. |
| * |
| * <p> This method preserves the current AccessControlContext's |
| * DomainCombiner (which may be null) while the action is performed. |
| * |
| * @param <T> the type of the value returned by the |
| * PrivilegedExceptionAction's {@code run} method. |
| * |
| * @param action the action to be performed. |
| * |
| * @return the value returned by the action's {@code run} method |
| * |
| * @exception PrivilegedActionException if the specified action's |
| * {@code run} method threw a <i>checked</i> exception |
| * @exception NullPointerException if the action is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction) |
| * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext) |
| * @see java.security.DomainCombiner |
| * |
| * @since 1.6 |
| */ |
| @CallerSensitive |
| public static <T> T doPrivilegedWithCombiner(PrivilegedExceptionAction<T> action) |
| throws PrivilegedActionException |
| { |
| AccessControlContext acc = getStackAccessControlContext(); |
| if (acc == null) { |
| return AccessController.doPrivileged(action); |
| } |
| DomainCombiner dc = acc.getAssignedCombiner(); |
| return AccessController.doPrivileged(action, |
| preserveCombiner(dc, Reflection.getCallerClass())); |
| } |
| |
| /** |
| * preserve the combiner across the doPrivileged call |
| */ |
| private static AccessControlContext preserveCombiner(DomainCombiner combiner, |
| Class<?> caller) |
| { |
| return createWrapper(combiner, caller, null, null, null); |
| } |
| |
| /** |
| * Create a wrapper to contain the limited privilege scope data. |
| */ |
| private static AccessControlContext |
| createWrapper(DomainCombiner combiner, Class<?> caller, |
| AccessControlContext parent, AccessControlContext context, |
| Permission[] perms) |
| { |
| ProtectionDomain callerPD = getCallerPD(caller); |
| // check if caller is authorized to create context |
| if (context != null && !context.isAuthorized() && |
| System.getSecurityManager() != null && |
| !callerPD.impliesCreateAccessControlContext()) |
| { |
| return getInnocuousAcc(); |
| } else { |
| return new AccessControlContext(callerPD, combiner, parent, |
| context, perms); |
| } |
| } |
| |
| private static class AccHolder { |
| // An AccessControlContext with no granted permissions. |
| // Only initialized on demand when getInnocuousAcc() is called. |
| static final AccessControlContext innocuousAcc = |
| new AccessControlContext(new ProtectionDomain[] { |
| new ProtectionDomain(null, null) }); |
| } |
| private static AccessControlContext getInnocuousAcc() { |
| return AccHolder.innocuousAcc; |
| } |
| |
| private static ProtectionDomain getCallerPD(final Class <?> caller) { |
| ProtectionDomain callerPd = doPrivileged |
| (new PrivilegedAction<>() { |
| public ProtectionDomain run() { |
| return caller.getProtectionDomain(); |
| } |
| }); |
| |
| return callerPd; |
| } |
| |
| /** |
| * Performs the specified {@code PrivilegedExceptionAction} with |
| * privileges enabled and restricted by the specified |
| * {@code AccessControlContext}. The action is performed with the |
| * intersection of the permissions possessed by the caller's |
| * protection domain, and those possessed by the domains represented by the |
| * specified {@code AccessControlContext}. |
| * <p> |
| * If the action's {@code run} method throws an <i>unchecked</i> |
| * exception, it will propagate through this method. |
| * <p> |
| * If a security manager is installed and the specified |
| * {@code AccessControlContext} was not created by system code and the |
| * caller's {@code ProtectionDomain} has not been granted the |
| * {@literal "createAccessControlContext"} |
| * {@link java.security.SecurityPermission}, then the action is performed |
| * with no permissions. |
| * |
| * @param <T> the type of the value returned by the |
| * PrivilegedExceptionAction's {@code run} method. |
| * @param action the action to be performed |
| * @param context an <i>access control context</i> |
| * representing the restriction to be applied to the |
| * caller's domain's privileges before performing |
| * the specified action. If the context is |
| * {@code null}, then no additional restriction is applied. |
| * |
| * @return the value returned by the action's {@code run} method |
| * |
| * @exception PrivilegedActionException if the specified action's |
| * {@code run} method threw a <i>checked</i> exception |
| * @exception NullPointerException if the action is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction) |
| * @see #doPrivileged(PrivilegedAction,AccessControlContext) |
| */ |
| @CallerSensitive |
| public static native <T> T |
| doPrivileged(PrivilegedExceptionAction<T> action, |
| AccessControlContext context) |
| throws PrivilegedActionException; |
| |
| |
| /** |
| * Performs the specified {@code PrivilegedExceptionAction} with |
| * privileges enabled and restricted by the specified |
| * {@code AccessControlContext} and with a privilege scope limited by |
| * specified {@code Permission} arguments. |
| * |
| * The action is performed with the intersection of the permissions |
| * possessed by the caller's protection domain, and those possessed |
| * by the domains represented by the specified |
| * {@code AccessControlContext}. |
| * <p> |
| * If the action's {@code run} method throws an (unchecked) exception, |
| * it will propagate through this method. |
| * <p> |
| * If a security manager is installed and the specified |
| * {@code AccessControlContext} was not created by system code and the |
| * caller's {@code ProtectionDomain} has not been granted the |
| * {@literal "createAccessControlContext"} |
| * {@link java.security.SecurityPermission}, then the action is performed |
| * with no permissions. |
| * |
| * @param <T> the type of the value returned by the |
| * PrivilegedExceptionAction's {@code run} method. |
| * @param action the action to be performed. |
| * @param context an <i>access control context</i> |
| * representing the restriction to be applied to the |
| * caller's domain's privileges before performing |
| * the specified action. If the context is |
| * {@code null}, |
| * then no additional restriction is applied. |
| * @param perms the {@code Permission} arguments which limit the |
| * scope of the caller's privileges. The number of arguments |
| * is variable. |
| * |
| * @return the value returned by the action's {@code run} method. |
| * |
| * @throws PrivilegedActionException if the specified action's |
| * {@code run} method threw a <i>checked</i> exception |
| * @throws NullPointerException if action or perms or any element of |
| * perms is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction) |
| * @see #doPrivileged(PrivilegedAction,AccessControlContext) |
| * |
| * @since 1.8 |
| */ |
| @CallerSensitive |
| public static <T> T doPrivileged(PrivilegedExceptionAction<T> action, |
| AccessControlContext context, Permission... perms) |
| throws PrivilegedActionException |
| { |
| AccessControlContext parent = getContext(); |
| if (perms == null) { |
| throw new NullPointerException("null permissions parameter"); |
| } |
| Class <?> caller = Reflection.getCallerClass(); |
| return AccessController.doPrivileged(action, createWrapper(null, caller, parent, context, perms)); |
| } |
| |
| |
| /** |
| * Performs the specified {@code PrivilegedExceptionAction} with |
| * privileges enabled and restricted by the specified |
| * {@code AccessControlContext} and with a privilege scope limited by |
| * specified {@code Permission} arguments. |
| * |
| * The action is performed with the intersection of the permissions |
| * possessed by the caller's protection domain, and those possessed |
| * by the domains represented by the specified |
| * {@code AccessControlContext}. |
| * <p> |
| * If the action's {@code run} method throws an (unchecked) exception, |
| * it will propagate through this method. |
| * |
| * <p> This method preserves the current AccessControlContext's |
| * DomainCombiner (which may be null) while the action is performed. |
| * <p> |
| * If a security manager is installed and the specified |
| * {@code AccessControlContext} was not created by system code and the |
| * caller's {@code ProtectionDomain} has not been granted the |
| * {@literal "createAccessControlContext"} |
| * {@link java.security.SecurityPermission}, then the action is performed |
| * with no permissions. |
| * |
| * @param <T> the type of the value returned by the |
| * PrivilegedExceptionAction's {@code run} method. |
| * @param action the action to be performed. |
| * @param context an <i>access control context</i> |
| * representing the restriction to be applied to the |
| * caller's domain's privileges before performing |
| * the specified action. If the context is |
| * {@code null}, |
| * then no additional restriction is applied. |
| * @param perms the {@code Permission} arguments which limit the |
| * scope of the caller's privileges. The number of arguments |
| * is variable. |
| * |
| * @return the value returned by the action's {@code run} method. |
| * |
| * @throws PrivilegedActionException if the specified action's |
| * {@code run} method threw a <i>checked</i> exception |
| * @throws NullPointerException if action or perms or any element of |
| * perms is {@code null} |
| * |
| * @see #doPrivileged(PrivilegedAction) |
| * @see #doPrivileged(PrivilegedAction,AccessControlContext) |
| * @see java.security.DomainCombiner |
| * |
| * @since 1.8 |
| */ |
| @CallerSensitive |
| public static <T> T doPrivilegedWithCombiner(PrivilegedExceptionAction<T> action, |
| AccessControlContext context, |
| Permission... perms) |
| throws PrivilegedActionException |
| { |
| AccessControlContext parent = getContext(); |
| DomainCombiner dc = parent.getCombiner(); |
| if (dc == null && context != null) { |
| dc = context.getCombiner(); |
| } |
| if (perms == null) { |
| throw new NullPointerException("null permissions parameter"); |
| } |
| Class <?> caller = Reflection.getCallerClass(); |
| return AccessController.doPrivileged(action, createWrapper(dc, caller, |
| parent, context, perms)); |
| } |
| |
| /** |
| * Returns the AccessControl context. i.e., it gets |
| * the protection domains of all the callers on the stack, |
| * starting at the first class with a non-null |
| * ProtectionDomain. |
| * |
| * @return the access control context based on the current stack or |
| * null if there was only privileged system code. |
| */ |
| |
| private static native AccessControlContext getStackAccessControlContext(); |
| |
| |
| /** |
| * Returns the "inherited" AccessControl context. This is the context |
| * that existed when the thread was created. Package private so |
| * AccessControlContext can use it. |
| */ |
| |
| static native AccessControlContext getInheritedAccessControlContext(); |
| |
| /** |
| * This method takes a "snapshot" of the current calling context, which |
| * includes the current Thread's inherited AccessControlContext and any |
| * limited privilege scope, and places it in an AccessControlContext object. |
| * This context may then be checked at a later point, possibly in another thread. |
| * |
| * @see AccessControlContext |
| * |
| * @return the AccessControlContext based on the current context. |
| */ |
| |
| public static AccessControlContext getContext() |
| { |
| AccessControlContext acc = getStackAccessControlContext(); |
| if (acc == null) { |
| // all we had was privileged system code. We don't want |
| // to return null though, so we construct a real ACC. |
| return new AccessControlContext(null, true); |
| } else { |
| return acc.optimize(); |
| } |
| } |
| |
| /** |
| * Determines whether the access request indicated by the |
| * specified permission should be allowed or denied, based on |
| * the current AccessControlContext and security policy. |
| * This method quietly returns if the access request |
| * is permitted, or throws an AccessControlException otherwise. The |
| * getPermission method of the AccessControlException returns the |
| * {@code perm} Permission object instance. |
| * |
| * @param perm the requested permission. |
| * |
| * @exception AccessControlException if the specified permission |
| * is not permitted, based on the current security policy. |
| * @exception NullPointerException if the specified permission |
| * is {@code null} and is checked based on the |
| * security policy currently in effect. |
| */ |
| |
| public static void checkPermission(Permission perm) |
| throws AccessControlException |
| { |
| //System.err.println("checkPermission "+perm); |
| //Thread.currentThread().dumpStack(); |
| |
| if (perm == null) { |
| throw new NullPointerException("permission can't be null"); |
| } |
| |
| AccessControlContext stack = getStackAccessControlContext(); |
| // if context is null, we had privileged system code on the stack. |
| if (stack == null) { |
| Debug debug = AccessControlContext.getDebug(); |
| boolean dumpDebug = false; |
| if (debug != null) { |
| dumpDebug = !Debug.isOn("codebase="); |
| dumpDebug &= !Debug.isOn("permission=") || |
| Debug.isOn("permission=" + perm.getClass().getCanonicalName()); |
| } |
| |
| if (dumpDebug && Debug.isOn("stack")) { |
| Thread.dumpStack(); |
| } |
| |
| if (dumpDebug && Debug.isOn("domain")) { |
| debug.println("domain (context is null)"); |
| } |
| |
| if (dumpDebug) { |
| debug.println("access allowed "+perm); |
| } |
| return; |
| } |
| |
| AccessControlContext acc = stack.optimize(); |
| acc.checkPermission(perm); |
| } |
| } |
