Examples with Permission java.security.Permission used on opensource projects

Example 21 with Permission

use of java.security.Permission in project jdk8u_jdk by JetBrains.

the class LoaderHandler method addPermissionsForURLs.

/**
     * Adds to the specified permission collection the permissions
     * necessary to load classes from a loader with the specified URL
     * path; if "forLoader" is true, also adds URL-specific
     * permissions necessary for the security context that such a
     * loader operates within, such as permissions necessary for
     * granting automatic permissions to classes defined by the
     * loader.  A given permission is only added to the collection if
     * it is not already implied by the collection.
     */
private static void addPermissionsForURLs(URL[] urls, PermissionCollection perms, boolean forLoader) {
    for (int i = 0; i < urls.length; i++) {
        URL url = urls[i];
        try {
            URLConnection urlConnection = url.openConnection();
            Permission p = urlConnection.getPermission();
            if (p != null) {
                if (p instanceof FilePermission) {
                    /*
                         * If the codebase is a file, the permission required
                         * to actually read classes from the codebase URL is
                         * the permission to read all files beneath the last
                         * directory in the file path, either because JAR
                         * files can refer to other JAR files in the same
                         * directory, or because permission to read a
                         * directory is not implied by permission to read the
                         * contents of a directory, which all that might be
                         * granted.
                         */
                    String path = p.getName();
                    int endIndex = path.lastIndexOf(File.separatorChar);
                    if (endIndex != -1) {
                        path = path.substring(0, endIndex + 1);
                        if (path.endsWith(File.separator)) {
                            path += "-";
                        }
                        Permission p2 = new FilePermission(path, "read");
                        if (!perms.implies(p2)) {
                            perms.add(p2);
                        }
                        perms.add(new FilePermission(path, "read"));
                    } else {
                        /*
                             * No directory separator: use permission to
                             * read the file.
                             */
                        if (!perms.implies(p)) {
                            perms.add(p);
                        }
                    }
                } else {
                    if (!perms.implies(p)) {
                        perms.add(p);
                    }
                    /*
                         * If the purpose of these permissions is to grant
                         * them to an instance of a URLClassLoader subclass,
                         * we must add permission to connect to and accept
                         * from the host of non-"file:" URLs, otherwise the
                         * getPermissions() method of URLClassLoader will
                         * throw a security exception.
                         */
                    if (forLoader) {
                        // get URL with meaningful host component
                        URL hostURL = url;
                        for (URLConnection conn = urlConnection; conn instanceof JarURLConnection; ) {
                            hostURL = ((JarURLConnection) conn).getJarFileURL();
                            conn = hostURL.openConnection();
                        }
                        String host = hostURL.getHost();
                        if (host != null && p.implies(new SocketPermission(host, "resolve"))) {
                            Permission p2 = new SocketPermission(host, "connect,accept");
                            if (!perms.implies(p2)) {
                                perms.add(p2);
                            }
                        }
                    }
                }
            }
        } catch (IOException e) {
        /*
                 * This shouldn't happen, although it is declared to be
                 * thrown by openConnection() and getPermission().  If it
                 * does, don't bother granting or requiring any permissions
                 * for this URL.
                 */
        }
    }
}

Example 22 with Permission

use of java.security.Permission in project jdk8u_jdk by JetBrains.

the class RMIConnectionImpl method withPermissions.

private static AccessControlContext withPermissions(Permission... perms) {
    Permissions col = new Permissions();
    for (Permission thePerm : perms) {
        col.add(thePerm);
    }
    final ProtectionDomain pd = new ProtectionDomain(null, col);
    return new AccessControlContext(new ProtectionDomain[] { pd });
}

Example 23 with Permission

use of java.security.Permission in project jdk8u_jdk by JetBrains.

the class SubjectDomainCombiner method combineJavaxPolicy.

/**
     * Use the javax.security.auth.Policy implementation
     */
private ProtectionDomain[] combineJavaxPolicy(ProtectionDomain[] currentDomains, ProtectionDomain[] assignedDomains) {
    if (!allowCaching) {
        java.security.AccessController.doPrivileged(new PrivilegedAction<Void>() {

            @SuppressWarnings("deprecation")
            public Void run() {
                // Call refresh only caching is disallowed
                javax.security.auth.Policy.getPolicy().refresh();
                return null;
            }
        });
    }
    int cLen = (currentDomains == null ? 0 : currentDomains.length);
    int aLen = (assignedDomains == null ? 0 : assignedDomains.length);
    // the ProtectionDomains for the new AccessControlContext
    // that we will return
    ProtectionDomain[] newDomains = new ProtectionDomain[cLen + aLen];
    synchronized (cachedPDs) {
        if (!subject.isReadOnly() && !subject.getPrincipals().equals(principalSet)) {
            // if the Subject was mutated, clear the PD cache
            Set<Principal> newSet = subject.getPrincipals();
            synchronized (newSet) {
                principalSet = new java.util.HashSet<Principal>(newSet);
            }
            principals = principalSet.toArray(new Principal[principalSet.size()]);
            cachedPDs.clear();
            if (debug != null) {
                debug.println("Subject mutated - clearing cache");
            }
        }
        for (int i = 0; i < cLen; i++) {
            ProtectionDomain pd = currentDomains[i];
            ProtectionDomain subjectPd = cachedPDs.getValue(pd);
            if (subjectPd == null) {
                if (pdAccess.getStaticPermissionsField(pd)) {
                    // keep static ProtectionDomain objects static
                    subjectPd = new ProtectionDomain(pd.getCodeSource(), pd.getPermissions());
                } else {
                    // XXX
                    // we must first add the original permissions.
                    // that way when we later add the new JAAS permissions,
                    // any unresolved JAAS-related permissions will
                    // automatically get resolved.
                    // get the original perms
                    Permissions perms = new Permissions();
                    PermissionCollection coll = pd.getPermissions();
                    java.util.Enumeration<Permission> e;
                    if (coll != null) {
                        synchronized (coll) {
                            e = coll.elements();
                            while (e.hasMoreElements()) {
                                Permission newPerm = e.nextElement();
                                perms.add(newPerm);
                            }
                        }
                    }
                    // get perms from the policy
                    final java.security.CodeSource finalCs = pd.getCodeSource();
                    final Subject finalS = subject;
                    PermissionCollection newPerms = java.security.AccessController.doPrivileged(new PrivilegedAction<PermissionCollection>() {

                        @SuppressWarnings("deprecation")
                        public PermissionCollection run() {
                            return javax.security.auth.Policy.getPolicy().getPermissions(finalS, finalCs);
                        }
                    });
                    // avoiding duplicates
                    synchronized (newPerms) {
                        e = newPerms.elements();
                        while (e.hasMoreElements()) {
                            Permission newPerm = e.nextElement();
                            if (!perms.implies(newPerm)) {
                                perms.add(newPerm);
                                if (debug != null)
                                    debug.println("Adding perm " + newPerm + "\n");
                            }
                        }
                    }
                    subjectPd = new ProtectionDomain(finalCs, perms, pd.getClassLoader(), principals);
                }
                if (allowCaching)
                    cachedPDs.putValue(pd, subjectPd);
            }
            newDomains[i] = subjectPd;
        }
    }
    if (debug != null) {
        debug.println("updated current: ");
        for (int i = 0; i < cLen; i++) {
            debug.println("\tupdated[" + i + "] = " + newDomains[i]);
        }
    }
    // now add on the assigned domains
    if (aLen > 0) {
        System.arraycopy(assignedDomains, 0, newDomains, cLen, aLen);
    }
    if (debug != null) {
        if (newDomains == null || newDomains.length == 0) {
            debug.println("returning null");
        } else {
            debug.println("combinedDomains: ");
            for (int i = 0; i < newDomains.length; i++) {
                debug.println("newDomain " + i + ": " + newDomains[i].toString());
            }
        }
    }
    // return the new ProtectionDomains
    if (newDomains == null || newDomains.length == 0) {
        return null;
    } else {
        return newDomains;
    }
}

Example 24 with Permission

use of java.security.Permission in project jdk8u_jdk by JetBrains.

the class DefaultMBeanServerInterceptor method checkMBeanTrustPermission.

private static void checkMBeanTrustPermission(final Class<?> theClass) throws SecurityException {
    SecurityManager sm = System.getSecurityManager();
    if (sm != null) {
        Permission perm = new MBeanTrustPermission("register");
        PrivilegedAction<ProtectionDomain> act = new PrivilegedAction<ProtectionDomain>() {

            public ProtectionDomain run() {
                return theClass.getProtectionDomain();
            }
        };
        ProtectionDomain pd = AccessController.doPrivileged(act);
        AccessControlContext acc = new AccessControlContext(new ProtectionDomain[] { pd });
        sm.checkPermission(perm, acc);
    }
}

Example 25 with Permission

use of java.security.Permission in project jdk8u_jdk by JetBrains.

the class JmxMBeanServer method checkNewMBeanServerPermission.

private static void checkNewMBeanServerPermission() {
    SecurityManager sm = System.getSecurityManager();
    if (sm != null) {
        Permission perm = new MBeanServerPermission("newMBeanServer");
        sm.checkPermission(perm);
    }
}