Hi all,
I am working on an application where user are allowed to submit their
own classes, given that they implement a specific interface which I
provide.
I will execute the provided classes in a separate thread which I
create.
Due to obvious reasons, I need to run the thread with a very strict
securitymanager, a kind of sandbox. However, I do not want to restrict
the main thread's securitymanager, so System.setSecurityManager is not
an option.
My qyestion is, how can I apply a custom securityManager to specific
threads? I have been browsing the java api-documentation, but I cannot
get a grasp of the full picture.
Any help is highly appreciated!!!
Regards
Niklas Grünbaum
Rogan Dawes - 05 May 2004 13:01 GMT
> Hi all,
>
[quoted text clipped - 18 lines]
> Regards
> Niklas Grünbaum
From the docs for SecurityManager (1.4.2):
Note that the checkPermission method with just a single permission
argument always performs security checks within the context of the
currently executing thread. Sometimes a security check that should be
made within a given context will actually need to be done from within a
different context (for example, from within a worker thread). The
getSecurityContext method and the checkPermission method that includes
a context argument are provided for this situation. The
getSecurityContext method returns a "snapshot" of the current calling
context. (The default implementation returns an AccessControlContext
object.) A sample call is the following:
Object context = null;
SecurityManager sm = System.getSecurityManager();
if (sm != null) context = sm.getSecurityContext();
The checkPermission method that takes a context object in addition to a
permission makes access decisions based on that context, rather than on
that of the current execution thread. Code within a different context
can thus call that method, passing the permission and the
previously-saved context object. A sample call, using the
SecurityManager sm obtained as in the previous example, is the following:
if (sm != null) sm.checkPermission(permission, context);
Perhaps you can code your SecurityManager to differentiate based on the
context that it is in?
Good luck!
Rogan

Signature
Rogan Dawes
*ALL* messages to discard@dawes.za.net will be dropped, and added
to my blacklist. Please respond to "nntp AT dawes DOT za DOT net"