/* * Copyright (c) 1997, 2007, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation.  Oracle designates this * particular file as subject to the "Classpath" exception as provided * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. */ package java.security; import sun.security.util.Debug; /** * <p> The AccessController class is used for access control operations * and decisions. * * <p> More specifically, the AccessController class is used for * three purposes: * * <ul> * <li> to decide whether an access to a critical system * resource is to be allowed or denied, based on the security policy * currently in effect,<p> * <li>to mark code as being "privileged", thus affecting subsequent * access determinations, and<p> * <li>to obtain a "snapshot" of the current calling context so * access-control decisions from a different context can be made with * respect to the saved context. </ul> * * <p> The {@link #checkPermission(Permission) checkPermission} method * determines whether the access request indicated by a specified * permission should be granted or denied. A sample call appears * below. In this example, <code>checkPermission</code> will determine * whether or not to grant "read" access to the file named "testFile" in * the "/temp" directory. * * <pre> * * FilePermission perm = new FilePermission("/temp/testFile", "read"); * AccessController.checkPermission(perm); * * </pre> * * <p> If a requested access is allowed, * <code>checkPermission</code> returns quietly. If denied, an * AccessControlException is * thrown. AccessControlException can also be thrown if the requested * permission is of an incorrect type or contains an invalid value. * Such information is given whenever possible. * * Suppose the current thread traversed m callers, in the order of caller 1 * to caller 2 to caller m. Then caller m invoked the * <code>checkPermission</code> method. * The <code>checkPermission </code>method determines whether access * is granted or denied based on the following algorithm: * *  <pre> {@code * for (int i = m; i > 0; i--) { * *     if (caller i's domain does not have the permission) *         throw AccessControlException * *     else if (caller i is marked as privileged) { *         if (a context was specified in the call to doPrivileged) *             context.checkPermission(permission) *         return; *     } * }; * * // Next, check the context inherited when the thread was created. * // Whenever a new thread is created, the AccessControlContext at * // that time is stored and associated with the new thread, as the * // "inherited" context. * * inheritedContext.checkPermission(permission); * }</pre> * * <p> A caller can be marked as being "privileged" * (see {@link #doPrivileged(PrivilegedAction) doPrivileged} and below). * When making access control decisions, the <code>checkPermission</code> * method stops checking if it reaches a caller that * was marked as "privileged" via a <code>doPrivileged</code> * call without a context argument (see below for information about a * context argument). If that caller's domain has the * specified permission, no further checking is done and * <code>checkPermission</code> * returns quietly, indicating that the requested access is allowed. * If that domain does not have the specified permission, an exception * is thrown, as usual. * * <p> The normal use of the "privileged" feature is as follows. If you * don't need to return a value from within the "privileged" block, do * the following: * *  <pre> {@code * somemethod() { *     ...normal code here... *     AccessController.doPrivileged(new PrivilegedAction<Void>() { *         public Void run() { *             // privileged code goes here, for example: *             System.loadLibrary("awt"); *             return null; // nothing to return *         } *     }); *     ...normal code here... * }}</pre> * * <p> * PrivilegedAction is an interface with a single method, named * <code>run</code>. * The above example shows creation of an implementation * of that interface; a concrete implementation of the * <code>run</code> method is supplied. * When the call to <code>doPrivileged</code> is made, an * instance of the PrivilegedAction implementation is passed * to it. The <code>doPrivileged</code> method calls the * <code>run</code> method from the PrivilegedAction * implementation after enabling privileges, and returns the * <code>run</code> method's return value as the * <code>doPrivileged</code> return value (which is * ignored in this example). * * <p> If you need to return a value, you can do something like the following: * *  <pre> {@code * somemethod() { *     ...normal code here... *     String user = AccessController.doPrivileged( *         new PrivilegedAction<String>() { *         public String run() { *             return System.getProperty("user.name"); *             } *         }); *     ...normal code here... * }}</pre> * * <p>If the action performed in your <code>run</code> method could * throw a "checked" exception (those listed in the <code>throws</code> clause * of a method), then you need to use the * <code>PrivilegedExceptionAction</code> interface instead of the * <code>PrivilegedAction</code> interface: * *  <pre> {@code * somemethod() throws FileNotFoundException { *     ...normal code here... *     try { *         FileInputStream fis = AccessController.doPrivileged( *         new PrivilegedExceptionAction<FileInputStream>() { *             public FileInputStream run() throws FileNotFoundException { *                 return new FileInputStream("someFile"); *             } *         }); *     } catch (PrivilegedActionException e) { *         // e.getException() should be an instance of FileNotFoundException, *         // as only "checked" exceptions will be "wrapped" in a *         // PrivilegedActionException. *         throw (FileNotFoundException) e.getException(); *     } *     ...normal code here... *  }}</pre> * * <p> Be *very* careful in your use of the "privileged" construct, and * always remember to make the privileged code section as small as possible. * * <p> Note that <code>checkPermission</code> always performs security checks * within the context of the currently executing thread. * Sometimes a security check that should be made within a given context * will actually need to be done from within a * <i>different</i> context (for example, from within a worker thread). * The {@link #getContext() getContext} method and * AccessControlContext class are provided * for this situation. The <code>getContext</code> method takes a "snapshot" * of the current calling context, and places * it in an AccessControlContext object, which it returns. A sample call is * the following: * * <pre> * * AccessControlContext acc = AccessController.getContext() * * </pre> * * <p> * AccessControlContext itself has a <code>checkPermission</code> method * that makes access decisions based on the context <i>it</i> encapsulates, * rather than that of the current execution thread. * Code within a different context can thus call that method on the * previously-saved AccessControlContext object. A sample call is the * following: * * <pre> * * acc.checkPermission(permission) * * </pre> * * <p> There are also times where you don't know a priori which permissions * to check the context against. In these cases you can use the * doPrivileged method that takes a context: * *  <pre> {@code * somemethod() { *     AccessController.doPrivileged(new PrivilegedAction<Object>() { *         public Object run() { *             // Code goes here. Any permission checks within this *             // run method will require that the intersection of the *             // callers protection domain and the snapshot's *             // context have the desired permission. *         } *     }, acc); *     ...normal code here... * }}</pre> * * @see AccessControlContext * * @author Li Gong * @author Roland Schemers */ public final class AccessController {     /**     * Don't allow anyone to instantiate an AccessController     */    private AccessController() { }     /**     * Performs the specified <code>PrivilegedAction</code> with privileges     * enabled. The action is performed with <i>all</i> of the permissions     * possessed by the caller's protection domain.     *     * <p> If the action's <code>run</code> method throws an (unchecked)     * exception, it will propagate through this method.     *     * <p> Note that any DomainCombiner associated with the current     * AccessControlContext will be ignored while the action is performed.     *     * @param action the action to be performed.     *     * @return the value returned by the action's <code>run</code> method.     *     * @exception NullPointerException if the action is <code>null</code>     *     * @see #doPrivileged(PrivilegedAction,AccessControlContext)     * @see #doPrivileged(PrivilegedExceptionAction)     * @see #doPrivilegedWithCombiner(PrivilegedAction)     * @see java.security.DomainCombiner     */     public static native <T> T doPrivileged(PrivilegedAction<T> action);     /**     * Performs the specified <code>PrivilegedAction</code> with privileges     * enabled. The action is performed with <i>all</i> of the permissions     * possessed by the caller's protection domain.     *     * <p> If the action's <code>run</code> method throws an (unchecked)     * exception, it will propagate through this method.     *     * <p> This method preserves the current AccessControlContext's     * DomainCombiner (which may be null) while the action is performed.     *     * @param action the action to be performed.     *     * @return the value returned by the action's <code>run</code> method.     *     * @exception NullPointerException if the action is <code>null</code>     *     * @see #doPrivileged(PrivilegedAction)     * @see java.security.DomainCombiner     *     * @since 1.6     */    public static <T> T doPrivilegedWithCombiner(PrivilegedAction<T> action) {         DomainCombiner dc = null;        AccessControlContext acc = getStackAccessControlContext();        if (acc == null || (dc = acc.getAssignedCombiner()) == null) {            return AccessController.doPrivileged(action);        }        return AccessController.doPrivileged(action, preserveCombiner(dc));    }      /**     * Performs the specified <code>PrivilegedAction</code> with privileges     * enabled and restricted by the specified     * <code>AccessControlContext</code>.     * The action is performed with the intersection of the permissions     * possessed by the caller's protection domain, and those possessed     * by the domains represented by the specified     * <code>AccessControlContext</code>.     * <p>     * If the action's <code>run</code> method throws an (unchecked) exception,     * it will propagate through this method.     *     * @param action the action to be performed.     * @param context an <i>access control context</i>     *                representing the restriction to be applied to the     *                caller's domain's privileges before performing     *                the specified action.  If the context is     *                <code>null</code>,     *                then no additional restriction is applied.     *     * @return the value returned by the action's <code>run</code> method.     *     * @exception NullPointerException if the action is <code>null</code>     *     * @see #doPrivileged(PrivilegedAction)     * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)     */    public static native <T> T doPrivileged(PrivilegedAction<T> action,                                            AccessControlContext context);     /**     * Performs the specified <code>PrivilegedExceptionAction</code> with     * privileges enabled.  The action is performed with <i>all</i> of the     * permissions possessed by the caller's protection domain.     *     * <p> If the action's <code>run</code> method throws an <i>unchecked</i>     * exception, it will propagate through this method.     *     * <p> Note that any DomainCombiner associated with the current     * AccessControlContext will be ignored while the action is performed.     *     * @param action the action to be performed     *     * @return the value returned by the action's <code>run</code> method     *     * @exception PrivilegedActionException if the specified action's     *         <code>run</code> method threw a <i>checked</i> exception     * @exception NullPointerException if the action is <code>null</code>     *     * @see #doPrivileged(PrivilegedAction)     * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)     * @see #doPrivilegedWithCombiner(PrivilegedExceptionAction)     * @see java.security.DomainCombiner     */    public static native <T> T        doPrivileged(PrivilegedExceptionAction<T> action)        throws PrivilegedActionException;      /**     * Performs the specified <code>PrivilegedExceptionAction</code> with     * privileges enabled.  The action is performed with <i>all</i> of the     * permissions possessed by the caller's protection domain.     *     * <p> If the action's <code>run</code> method throws an <i>unchecked</i>     * exception, it will propagate through this method.     *     * <p> This method preserves the current AccessControlContext's     * DomainCombiner (which may be null) while the action is performed.     *     * @param action the action to be performed.     *     * @return the value returned by the action's <code>run</code> method     *     * @exception PrivilegedActionException if the specified action's     *         <code>run</code> method threw a <i>checked</i> exception     * @exception NullPointerException if the action is <code>null</code>     *     * @see #doPrivileged(PrivilegedAction)     * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)     * @see java.security.DomainCombiner     *     * @since 1.6     */    public static <T> T doPrivilegedWithCombiner        (PrivilegedExceptionAction<T> action) throws PrivilegedActionException {         DomainCombiner dc = null;        AccessControlContext acc = getStackAccessControlContext();        if (acc == null || (dc = acc.getAssignedCombiner()) == null) {            return AccessController.doPrivileged(action);        }        return AccessController.doPrivileged(action, preserveCombiner(dc));    }     /**     * preserve the combiner across the doPrivileged call     */    private static AccessControlContext preserveCombiner                                        (DomainCombiner combiner) {         /**         * callerClass[0] = Reflection.getCallerClass         * callerClass[1] = AccessController.preserveCombiner         * callerClass[2] = AccessController.doPrivileged         * callerClass[3] = caller         */        final Class callerClass = sun.reflect.Reflection.getCallerClass(3);        ProtectionDomain callerPd = doPrivileged            (new PrivilegedAction<ProtectionDomain>() {            public ProtectionDomain run() {                return callerClass.getProtectionDomain();            }        });         // perform 'combine' on the caller of doPrivileged,        // even if the caller is from the bootclasspath        ProtectionDomain[] pds = new ProtectionDomain[] {callerPd};        return new AccessControlContext(combiner.combine(pds, null), combiner);    }      /**     * Performs the specified <code>PrivilegedExceptionAction</code> with     * privileges enabled and restricted by the specified     * <code>AccessControlContext</code>.  The action is performed with the     * intersection of the permissions possessed by the caller's     * protection domain, and those possessed by the domains represented by the     * specified <code>AccessControlContext</code>.     * <p>     * If the action's <code>run</code> method throws an <i>unchecked</i>     * exception, it will propagate through this method.     *     * @param action the action to be performed     * @param context an <i>access control context</i>     *                representing the restriction to be applied to the     *                caller's domain's privileges before performing     *                the specified action.  If the context is     *                <code>null</code>,     *                then no additional restriction is applied.     *     * @return the value returned by the action's <code>run</code> method     *     * @exception PrivilegedActionException if the specified action's     *         <code>run</code> method     *         threw a <i>checked</i> exception     * @exception NullPointerException if the action is <code>null</code>     *     * @see #doPrivileged(PrivilegedAction)     * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)     */    public static native <T> T        doPrivileged(PrivilegedExceptionAction<T> action,                     AccessControlContext context)        throws PrivilegedActionException;     /**     * Returns the AccessControl context. i.e., it gets     * the protection domains of all the callers on the stack,     * starting at the first class with a non-null     * ProtectionDomain.     *     * @return the access control context based on the current stack or     *         null if there was only privileged system code.     */     private static native AccessControlContext getStackAccessControlContext();     /**     * Returns the "inherited" AccessControl context. This is the context     * that existed when the thread was created. Package private so     * AccessControlContext can use it.     */     static native AccessControlContext getInheritedAccessControlContext();     /**     * This method takes a "snapshot" of the current calling context, which     * includes the current Thread's inherited AccessControlContext,     * and places it in an AccessControlContext object. This context may then     * be checked at a later point, possibly in another thread.     *     * @see AccessControlContext     *     * @return the AccessControlContext based on the current context.     */     public static AccessControlContext getContext()    {        AccessControlContext acc = getStackAccessControlContext();        if (acc == null) {            // all we had was privileged system code. We don't want            // to return null though, so we construct a real ACC.            return new AccessControlContext(null, true);        } else {            return acc.optimize();        }    } 

Lines 1–500 of 557. Load more