- Direct Known Subclasses:
RMISecurityManager
public class SecurityManager extends Object
The SecurityManager
class contains many methods with
names that begin with the word check
. These methods
are called by various methods in the Java libraries before those
methods perform certain potentially sensitive operations. The
invocation of such a check
method typically looks like this:
SecurityManager security = System.getSecurityManager(); if (security != null) { security.checkXXX(argument, . . . ); }
The security manager is thereby given an opportunity to prevent
completion of the operation by throwing an exception. A security
manager routine simply returns if the operation is permitted, but
throws a SecurityException
if the operation is not
permitted.
Environments using a security manager will typically set the security
manager at startup. In the JDK implementation, this is done by setting
the system property java.security.manager
on the command line to
the class name of the security manager. It can also be set to the empty
String ("") or the special token "default
" to use the
default java.lang.SecurityManager
. If a class name is specified,
it must be java.lang.SecurityManager
or a public subclass and have
a public no-arg constructor. The class is loaded by the
built-in system class loader
if it is not java.lang.SecurityManager
. If the
java.security.manager
system property is not set, the default value
is null
, which means a security manager will not be set at startup.
The Java run-time may also allow, but is not required to allow, the security
manager to be set dynamically by invoking the
setSecurityManager
method.
In the JDK implementation, if the Java virtual machine is started with
the java.security.manager
system property set to the special token
"disallow
" then a security manager will not be set at startup and
cannot be set dynamically (the
setSecurityManager
method will throw an UnsupportedOperationException
). If the
java.security.manager
system property is not set or is set to the
special token "allow
", then a security manager will not be set at
startup but can be set dynamically. Finally, if the
java.security.manager
system property is set to the class name of
the security manager, or to the empty String ("") or the special token
"default
", then a security manager is set at startup (as described
previously) and can also be subsequently replaced (or disabled) dynamically
(subject to the policy of the currently installed security manager). The
following table illustrates the behavior of the JDK implementation for the
different settings of the java.security.manager
system property:
Property Value | The SecurityManager set at startup | System.setSecurityManager run-time behavior |
---|---|---|
null | None | Success or throws SecurityException if not permitted by
the currently installed security manager |
empty String ("") | java.lang.SecurityManager |
Success or throws SecurityException if not permitted by
the currently installed security manager |
"default" | java.lang.SecurityManager |
Success or throws SecurityException if not permitted by
the currently installed security manager |
"disallow" | None | Always throws UnsupportedOperationException |
"allow" | None | Success or throws SecurityException if not permitted by
the currently installed security manager |
a class name | the named class | Success or throws SecurityException if not permitted by
the currently installed security manager |
A future release of the JDK may change the default value of the
java.security.manager
system property to "disallow
".
The current security manager is returned by the
getSecurityManager
method.
The special method
checkPermission(java.security.Permission)
determines whether an access request indicated by a specified
permission should be granted or denied. The
default implementation calls
AccessController.checkPermission(perm);
If a requested access is allowed,
checkPermission
returns quietly. If denied, a
SecurityException
is thrown.
The default implementation of each of the other
check
methods in SecurityManager
is to
call the SecurityManager checkPermission
method
to determine if the calling thread has permission to perform the requested
operation.
Note that the checkPermission
method with
just a single permission argument always performs security checks
within the context of the currently executing thread.
Sometimes a security check that should be made within a given context
will actually need to be done from within a
different context (for example, from within a worker thread).
The getSecurityContext
method
and the checkPermission
method that includes a context argument are provided
for this situation. The
getSecurityContext
method returns a "snapshot"
of the current calling context. (The default implementation
returns an AccessControlContext object.) A sample call is
the following:
Object context = null; SecurityManager sm = System.getSecurityManager(); if (sm != null) context = sm.getSecurityContext();
The checkPermission
method
that takes a context object in addition to a permission
makes access decisions based on that context,
rather than on that of the current execution thread.
Code within a different context can thus call that method,
passing the permission and the
previously-saved context object. A sample call, using the
SecurityManager sm
obtained as in the previous example,
is the following:
if (sm != null) sm.checkPermission(permission, context);
Permissions fall into these categories: File, Socket, Net,
Security, Runtime, Property, AWT, Reflect, and Serializable.
The classes managing these various
permission categories are java.io.FilePermission
,
java.net.SocketPermission
,
java.net.NetPermission
,
java.security.SecurityPermission
,
java.lang.RuntimePermission
,
java.util.PropertyPermission
,
java.awt.AWTPermission
,
java.lang.reflect.ReflectPermission
, and
java.io.SerializablePermission
.
All but the first two (FilePermission and SocketPermission) are
subclasses of java.security.BasicPermission
, which itself
is an abstract subclass of the
top-level class for permissions, which is
java.security.Permission
. BasicPermission defines the
functionality needed for all permissions that contain a name
that follows the hierarchical property naming convention
(for example, "exitVM", "setFactory", "queuePrintJob", etc).
An asterisk
may appear at the end of the name, following a ".", or by itself, to
signify a wildcard match. For example: "a.*" or "*" is valid,
"*a" or "a*b" is not valid.
FilePermission and SocketPermission are subclasses of the
top-level class for permissions
(java.security.Permission
). Classes like these
that have a more complicated name syntax than that used by
BasicPermission subclass directly from Permission rather than from
BasicPermission. For example,
for a java.io.FilePermission
object, the permission name is
the path name of a file (or directory).
Some of the permission classes have an "actions" list that tells
the actions that are permitted for the object. For example,
for a java.io.FilePermission
object, the actions list
(such as "read, write") specifies which actions are granted for the
specified file (or for files in the specified directory).
Other permission classes are for "named" permissions - ones that contain a name but no actions list; you either have the named permission or you don't.
Note: There is also a java.security.AllPermission
permission that implies all permissions. It exists to simplify the work
of system administrators who might need to perform multiple
tasks that require all (or numerous) permissions.
See Permissions in the Java Development Kit (JDK)
for permission-related information.
This document includes a table listing the various SecurityManager
check
methods and the permission(s) the default
implementation of each such method requires.
It also contains a table of the methods
that require permissions, and for each such method tells
which permission it requires.
- Since:
- 1.0
- See Also:
ClassLoader
,SecurityException
,getSecurityManager
,setSecurityManager
,AccessController
,AccessControlContext
,AccessControlException
,Permission
,BasicPermission
,FilePermission
,SocketPermission
,PropertyPermission
,RuntimePermission
,Policy
,SecurityPermission
,ProtectionDomain
-
Constructor Summary
-
Method Summary
Modifier and TypeMethodDescriptionvoid
checkAccept(String host, int port)
Throws aSecurityException
if the calling thread is not permitted to accept a socket connection from the specified host and port number.void
checkAccess(Thread t)
Throws aSecurityException
if the calling thread is not allowed to modify the thread argument.void
Throws aSecurityException
if the calling thread is not allowed to modify the thread group argument.void
checkConnect(String host, int port)
Throws aSecurityException
if the calling thread is not allowed to open a socket connection to the specified host and port number.void
checkConnect(String host, int port, Object context)
Throws aSecurityException
if the specified security context is not allowed to open a socket connection to the specified host and port number.void
Throws aSecurityException
if the calling thread is not allowed to create a new class loader.void
checkDelete(String file)
Throws aSecurityException
if the calling thread is not allowed to delete the specified file.void
Throws aSecurityException
if the calling thread is not allowed to create a subprocess.void
checkExit(int status)
Throws aSecurityException
if the calling thread is not allowed to cause the Java Virtual Machine to halt with the specified status code.void
Throws aSecurityException
if the calling thread is not allowed to dynamic link the library code specified by the string argument file.void
checkListen(int port)
Throws aSecurityException
if the calling thread is not allowed to wait for a connection request on the specified local port number.void
checkMulticast(InetAddress maddr)
Throws aSecurityException
if the calling thread is not allowed to use (join/leave/send/receive) IP multicast.void
checkMulticast(InetAddress maddr, byte ttl)
Deprecated.Use #checkPermission(java.security.Permission) insteadvoid
checkPackageAccess(String pkg)
Throws aSecurityException
if the calling thread is not allowed to access the specified package.void
checkPackageDefinition(String pkg)
Throws aSecurityException
if the calling thread is not allowed to define classes in the specified package.void
checkPermission(Permission perm)
Throws aSecurityException
if the requested access, specified by the given permission, is not permitted based on the security policy currently in effect.void
checkPermission(Permission perm, Object context)
Throws aSecurityException
if the specified security context is denied access to the resource specified by the given permission.void
Throws aSecurityException
if the calling thread is not allowed to initiate a print job request.void
Throws aSecurityException
if the calling thread is not allowed to access or modify the system properties.void
checkPropertyAccess(String key)
Throws aSecurityException
if the calling thread is not allowed to access the system property with the specifiedkey
name.void
checkRead(FileDescriptor fd)
Throws aSecurityException
if the calling thread is not allowed to read from the specified file descriptor.void
Throws aSecurityException
if the calling thread is not allowed to read the file specified by the string argument.void
Throws aSecurityException
if the specified security context is not allowed to read the file specified by the string argument.void
checkSecurityAccess(String target)
Determines whether the permission with the specified permission target name should be granted or denied.void
Throws aSecurityException
if the calling thread is not allowed to set the socket factory used byServerSocket
orSocket
, or the stream handler factory used byURL
.void
checkWrite(FileDescriptor fd)
Throws aSecurityException
if the calling thread is not allowed to write to the specified file descriptor.void
checkWrite(String file)
Throws aSecurityException
if the calling thread is not allowed to write to the file specified by the string argument.protected Class<?>[]
Returns the current execution stack as an array of classes.Creates an object that encapsulates the current execution environment.Returns the thread group into which to instantiate any new thread being created at the time this is being called.
-
Constructor Details
-
SecurityManager
public SecurityManager()Constructs a newSecurityManager
.If there is a security manager already installed, this method first calls the security manager's
checkPermission
method with theRuntimePermission("createSecurityManager")
permission to ensure the calling thread has permission to create a new security manager. This may result in throwing aSecurityException
.- Throws:
SecurityException
- if a security manager already exists and itscheckPermission
method doesn't allow creation of a new security manager.- See Also:
System.getSecurityManager()
,checkPermission
,RuntimePermission
-
-
Method Details
-
getClassContext
Returns the current execution stack as an array of classes.The length of the array is the number of methods on the execution stack. The element at index
0
is the class of the currently executing method, the element at index1
is the class of that method's caller, and so on.- Returns:
- the execution stack.
-
getSecurityContext
Creates an object that encapsulates the current execution environment. The result of this method is used, for example, by the three-argumentcheckConnect
method and by the two-argumentcheckRead
method. These methods are needed because a trusted method may be called on to read a file or open a socket on behalf of another method. The trusted method needs to determine if the other (possibly untrusted) method would be allowed to perform the operation on its own.The default implementation of this method is to return an
AccessControlContext
object.- Returns:
- an implementation-dependent object that encapsulates sufficient information about the current execution environment to perform some security checks later.
- See Also:
checkConnect
,checkRead
,AccessControlContext
-
checkPermission
Throws aSecurityException
if the requested access, specified by the given permission, is not permitted based on the security policy currently in effect.This method calls
AccessController.checkPermission
with the given permission.- Parameters:
perm
- the requested permission.- Throws:
SecurityException
- if access is not permitted based on the current security policy.NullPointerException
- if the permission argument isnull
.- Since:
- 1.2
-
checkPermission
Throws aSecurityException
if the specified security context is denied access to the resource specified by the given permission. The context must be a security context returned by a previous call togetSecurityContext
and the access control decision is based upon the configured security policy for that security context.If
context
is an instance ofAccessControlContext
then theAccessControlContext.checkPermission
method is invoked with the specified permission.If
context
is not an instance ofAccessControlContext
then aSecurityException
is thrown.- Parameters:
perm
- the specified permissioncontext
- a system-dependent security context.- Throws:
SecurityException
- if the specified security context is not an instance ofAccessControlContext
(e.g., isnull
), or is denied access to the resource specified by the given permission.NullPointerException
- if the permission argument isnull
.- Since:
- 1.2
- See Also:
getSecurityContext()
,AccessControlContext.checkPermission(java.security.Permission)
-
checkCreateClassLoader
public void checkCreateClassLoader()Throws aSecurityException
if the calling thread is not allowed to create a new class loader.This method calls
checkPermission
with theRuntimePermission("createClassLoader")
permission.If you override this method, then you should make a call to
super.checkCreateClassLoader
at the point the overridden method would normally throw an exception.- Throws:
SecurityException
- if the calling thread does not have permission to create a new class loader.- See Also:
ClassLoader()
,checkPermission
-
checkAccess
Throws aSecurityException
if the calling thread is not allowed to modify the thread argument.This method is invoked for the current security manager by the
stop
,suspend
,resume
,setPriority
,setName
, andsetDaemon
methods of classThread
.If the thread argument is a system thread (belongs to the thread group with a
null
parent) then this method callscheckPermission
with theRuntimePermission("modifyThread")
permission. If the thread argument is not a system thread, this method just returns silently.Applications that want a stricter policy should override this method. If this method is overridden, the method that overrides it should additionally check to see if the calling thread has the
RuntimePermission("modifyThread")
permission, and if so, return silently. This is to ensure that code granted that permission (such as the JDK itself) is allowed to manipulate any thread.If this method is overridden, then
super.checkAccess
should be called by the first statement in the overridden method, or the equivalent security check should be placed in the overridden method.- Parameters:
t
- the thread to be checked.- Throws:
SecurityException
- if the calling thread does not have permission to modify the thread.NullPointerException
- if the thread argument isnull
.- See Also:
resume
,setDaemon
,setName
,setPriority
,stop
,suspend
,checkPermission
-
checkAccess
Throws aSecurityException
if the calling thread is not allowed to modify the thread group argument.This method is invoked for the current security manager when a new child thread or child thread group is created, and by the
setDaemon
,setMaxPriority
,stop
,suspend
,resume
, anddestroy
methods of classThreadGroup
.If the thread group argument is the system thread group ( has a
null
parent) then this method callscheckPermission
with theRuntimePermission("modifyThreadGroup")
permission. If the thread group argument is not the system thread group, this method just returns silently.Applications that want a stricter policy should override this method. If this method is overridden, the method that overrides it should additionally check to see if the calling thread has the
RuntimePermission("modifyThreadGroup")
permission, and if so, return silently. This is to ensure that code granted that permission (such as the JDK itself) is allowed to manipulate any thread.If this method is overridden, then
super.checkAccess
should be called by the first statement in the overridden method, or the equivalent security check should be placed in the overridden method.- Parameters:
g
- the thread group to be checked.- Throws:
SecurityException
- if the calling thread does not have permission to modify the thread group.NullPointerException
- if the thread group argument isnull
.- See Also:
destroy
,resume
,setDaemon
,setMaxPriority
,stop
,suspend
,checkPermission
-
checkExit
public void checkExit(int status)Throws aSecurityException
if the calling thread is not allowed to cause the Java Virtual Machine to halt with the specified status code.This method is invoked for the current security manager by the
exit
method of classRuntime
. A status of0
indicates success; other values indicate various errors.This method calls
checkPermission
with theRuntimePermission("exitVM."+status)
permission.If you override this method, then you should make a call to
super.checkExit
at the point the overridden method would normally throw an exception.- Parameters:
status
- the exit status.- Throws:
SecurityException
- if the calling thread does not have permission to halt the Java Virtual Machine with the specified status.- See Also:
exit
,checkPermission
-
checkExec
Throws aSecurityException
if the calling thread is not allowed to create a subprocess.This method is invoked for the current security manager by the
exec
methods of classRuntime
.This method calls
checkPermission
with theFilePermission(cmd,"execute")
permission if cmd is an absolute path, otherwise it callscheckPermission
withFilePermission("<<ALL FILES>>","execute")
.If you override this method, then you should make a call to
super.checkExec
at the point the overridden method would normally throw an exception.- Parameters:
cmd
- the specified system command.- Throws:
SecurityException
- if the calling thread does not have permission to create a subprocess.NullPointerException
- if thecmd
argument isnull
.- See Also:
Runtime.exec(java.lang.String)
,Runtime.exec(java.lang.String, java.lang.String[])
,Runtime.exec(java.lang.String[])
,Runtime.exec(java.lang.String[], java.lang.String[])
,checkPermission
-
checkLink
Throws aSecurityException
if the calling thread is not allowed to dynamic link the library code specified by the string argument file. The argument is either a simple library name or a complete filename.This method is invoked for the current security manager by methods
load
andloadLibrary
of classRuntime
.This method calls
checkPermission
with theRuntimePermission("loadLibrary."+lib)
permission.If you override this method, then you should make a call to
super.checkLink
at the point the overridden method would normally throw an exception.- Parameters:
lib
- the name of the library.- Throws:
SecurityException
- if the calling thread does not have permission to dynamically link the library.NullPointerException
- if thelib
argument isnull
.- See Also:
Runtime.load(java.lang.String)
,Runtime.loadLibrary(java.lang.String)
,checkPermission
-
checkRead
Throws aSecurityException
if the calling thread is not allowed to read from the specified file descriptor.This method calls
checkPermission
with theRuntimePermission("readFileDescriptor")
permission.If you override this method, then you should make a call to
super.checkRead
at the point the overridden method would normally throw an exception.- Parameters:
fd
- the system-dependent file descriptor.- Throws:
SecurityException
- if the calling thread does not have permission to access the specified file descriptor.NullPointerException
- if the file descriptor argument isnull
.- See Also:
FileDescriptor
,checkPermission
-
checkRead
Throws aSecurityException
if the calling thread is not allowed to read the file specified by the string argument.This method calls
checkPermission
with theFilePermission(file,"read")
permission.If you override this method, then you should make a call to
super.checkRead
at the point the overridden method would normally throw an exception.- Parameters:
file
- the system-dependent file name.- Throws:
SecurityException
- if the calling thread does not have permission to access the specified file.NullPointerException
- if thefile
argument isnull
.- See Also:
checkPermission
-
checkRead
Throws aSecurityException
if the specified security context is not allowed to read the file specified by the string argument. The context must be a security context returned by a previous call togetSecurityContext
.If
context
is an instance ofAccessControlContext
then theAccessControlContext.checkPermission
method will be invoked with theFilePermission(file,"read")
permission.If
context
is not an instance ofAccessControlContext
then aSecurityException
is thrown.If you override this method, then you should make a call to
super.checkRead
at the point the overridden method would normally throw an exception.- Parameters:
file
- the system-dependent filename.context
- a system-dependent security context.- Throws:
SecurityException
- if the specified security context is not an instance ofAccessControlContext
(e.g., isnull
), or does not have permission to read the specified file.NullPointerException
- if thefile
argument isnull
.- See Also:
getSecurityContext()
,AccessControlContext.checkPermission(java.security.Permission)
-
checkWrite
Throws aSecurityException
if the calling thread is not allowed to write to the specified file descriptor.This method calls
checkPermission
with theRuntimePermission("writeFileDescriptor")
permission.If you override this method, then you should make a call to
super.checkWrite
at the point the overridden method would normally throw an exception.- Parameters:
fd
- the system-dependent file descriptor.- Throws:
SecurityException
- if the calling thread does not have permission to access the specified file descriptor.NullPointerException
- if the file descriptor argument isnull
.- See Also:
FileDescriptor
,checkPermission
-
checkWrite
Throws aSecurityException
if the calling thread is not allowed to write to the file specified by the string argument.This method calls
checkPermission
with theFilePermission(file,"write")
permission.If you override this method, then you should make a call to
super.checkWrite
at the point the overridden method would normally throw an exception.- Parameters:
file
- the system-dependent filename.- Throws:
SecurityException
- if the calling thread does not have permission to access the specified file.NullPointerException
- if thefile
argument isnull
.- See Also:
checkPermission
-
checkDelete
Throws aSecurityException
if the calling thread is not allowed to delete the specified file.This method is invoked for the current security manager by the
delete
method of classFile
.This method calls
checkPermission
with theFilePermission(file,"delete")
permission.If you override this method, then you should make a call to
super.checkDelete
at the point the overridden method would normally throw an exception.- Parameters:
file
- the system-dependent filename.- Throws:
SecurityException
- if the calling thread does not have permission to delete the file.NullPointerException
- if thefile
argument isnull
.- See Also:
File.delete()
,checkPermission
-
checkConnect
Throws aSecurityException
if the calling thread is not allowed to open a socket connection to the specified host and port number.A port number of
-1
indicates that the calling method is attempting to determine the IP address of the specified host name.This method calls
checkPermission
with theSocketPermission(host+":"+port,"connect")
permission if the port is not equal to -1. If the port is equal to -1, then it callscheckPermission
with theSocketPermission(host,"resolve")
permission.If you override this method, then you should make a call to
super.checkConnect
at the point the overridden method would normally throw an exception.- Parameters:
host
- the host name port to connect to.port
- the protocol port to connect to.- Throws:
SecurityException
- if the calling thread does not have permission to open a socket connection to the specifiedhost
andport
.NullPointerException
- if thehost
argument isnull
.- See Also:
checkPermission
-
checkConnect
Throws aSecurityException
if the specified security context is not allowed to open a socket connection to the specified host and port number.A port number of
-1
indicates that the calling method is attempting to determine the IP address of the specified host name.If
context
is not an instance ofAccessControlContext
then aSecurityException
is thrown.Otherwise, the port number is checked. If it is not equal to -1, the
context
'scheckPermission
method is called with aSocketPermission(host+":"+port,"connect")
permission. If the port is equal to -1, then thecontext
'scheckPermission
method is called with aSocketPermission(host,"resolve")
permission.If you override this method, then you should make a call to
super.checkConnect
at the point the overridden method would normally throw an exception.- Parameters:
host
- the host name port to connect to.port
- the protocol port to connect to.context
- a system-dependent security context.- Throws:
SecurityException
- if the specified security context is not an instance ofAccessControlContext
(e.g., isnull
), or does not have permission to open a socket connection to the specifiedhost
andport
.NullPointerException
- if thehost
argument isnull
.- See Also:
getSecurityContext()
,AccessControlContext.checkPermission(java.security.Permission)
-
checkListen
public void checkListen(int port)Throws aSecurityException
if the calling thread is not allowed to wait for a connection request on the specified local port number.This method calls
checkPermission
with theSocketPermission("localhost:"+port,"listen")
.If you override this method, then you should make a call to
super.checkListen
at the point the overridden method would normally throw an exception.- Parameters:
port
- the local port.- Throws:
SecurityException
- if the calling thread does not have permission to listen on the specified port.- See Also:
checkPermission
-
checkAccept
Throws aSecurityException
if the calling thread is not permitted to accept a socket connection from the specified host and port number.This method is invoked for the current security manager by the
accept
method of classServerSocket
.This method calls
checkPermission
with theSocketPermission(host+":"+port,"accept")
permission.If you override this method, then you should make a call to
super.checkAccept
at the point the overridden method would normally throw an exception.- Parameters:
host
- the host name of the socket connection.port
- the port number of the socket connection.- Throws:
SecurityException
- if the calling thread does not have permission to accept the connection.NullPointerException
- if thehost
argument isnull
.- See Also:
ServerSocket.accept()
,checkPermission
-
checkMulticast
Throws aSecurityException
if the calling thread is not allowed to use (join/leave/send/receive) IP multicast.This method calls
checkPermission
with thejava.net.SocketPermission(maddr.getHostAddress(), "accept,connect")
permission.If you override this method, then you should make a call to
super.checkMulticast
at the point the overridden method would normally throw an exception.- Parameters:
maddr
- Internet group address to be used.- Throws:
SecurityException
- if the calling thread is not allowed to use (join/leave/send/receive) IP multicast.NullPointerException
- if the address argument isnull
.- Since:
- 1.1
- See Also:
checkPermission
-
checkMulticast
Deprecated.Use #checkPermission(java.security.Permission) insteadThrows aSecurityException
if the calling thread is not allowed to use (join/leave/send/receive) IP multicast.This method calls
checkPermission
with thejava.net.SocketPermission(maddr.getHostAddress(), "accept,connect")
permission.If you override this method, then you should make a call to
super.checkMulticast
at the point the overridden method would normally throw an exception.- Parameters:
maddr
- Internet group address to be used.ttl
- value in use, if it is multicast send. Note: this particular implementation does not use the ttl parameter.- Throws:
SecurityException
- if the calling thread is not allowed to use (join/leave/send/receive) IP multicast.NullPointerException
- if the address argument isnull
.- Since:
- 1.1
- See Also:
checkPermission
-
checkPropertiesAccess
public void checkPropertiesAccess()Throws aSecurityException
if the calling thread is not allowed to access or modify the system properties.This method is used by the
getProperties
andsetProperties
methods of classSystem
.This method calls
checkPermission
with thePropertyPermission("*", "read,write")
permission.If you override this method, then you should make a call to
super.checkPropertiesAccess
at the point the overridden method would normally throw an exception.- Throws:
SecurityException
- if the calling thread does not have permission to access or modify the system properties.- See Also:
System.getProperties()
,System.setProperties(java.util.Properties)
,checkPermission
-
checkPropertyAccess
Throws aSecurityException
if the calling thread is not allowed to access the system property with the specifiedkey
name.This method is used by the
getProperty
method of classSystem
.This method calls
checkPermission
with thePropertyPermission(key, "read")
permission.If you override this method, then you should make a call to
super.checkPropertyAccess
at the point the overridden method would normally throw an exception.- Parameters:
key
- a system property key.- Throws:
SecurityException
- if the calling thread does not have permission to access the specified system property.NullPointerException
- if thekey
argument isnull
.IllegalArgumentException
- ifkey
is empty.- See Also:
System.getProperty(java.lang.String)
,checkPermission
-
checkPrintJobAccess
public void checkPrintJobAccess()Throws aSecurityException
if the calling thread is not allowed to initiate a print job request.This method calls
checkPermission
with theRuntimePermission("queuePrintJob")
permission.If you override this method, then you should make a call to
super.checkPrintJobAccess
at the point the overridden method would normally throw an exception.- Throws:
SecurityException
- if the calling thread does not have permission to initiate a print job request.- Since:
- 1.1
- See Also:
checkPermission
-
checkPackageAccess
Throws aSecurityException
if the calling thread is not allowed to access the specified package.During class loading, this method may be called by the
loadClass
method of class loaders and by the Java Virtual Machine to ensure that the caller is allowed to access the package of the class that is being loaded.This method checks if the specified package starts with or equals any of the packages in the
package.access
Security Property. An implementation may also check the package against an additional list of restricted packages as noted below. If the package is restricted,checkPermission(Permission)
is called with aRuntimePermission("accessClassInPackage."+pkg)
permission.If this method is overridden, then
super.checkPackageAccess
should be called as the first line in the overridden method.- Implementation Note:
- This implementation also restricts all non-exported packages of modules loaded by the platform class loader or its ancestors. A "non-exported package" refers to a package that is not exported to all modules. Specifically, it refers to a package that either is not exported at all by its containing module or is exported in a qualified fashion by its containing module.
- Parameters:
pkg
- the package name.- Throws:
SecurityException
- if the calling thread does not have permission to access the specified package.NullPointerException
- if the package name argument isnull
.- See Also:
loadClass
,getProperty
,checkPermission
-
checkPackageDefinition
Throws aSecurityException
if the calling thread is not allowed to define classes in the specified package.This method is called by the
loadClass
method of some class loaders.This method checks if the specified package starts with or equals any of the packages in the
package.definition
Security Property. An implementation may also check the package against an additional list of restricted packages as noted below. If the package is restricted,checkPermission(Permission)
is called with aRuntimePermission("defineClassInPackage."+pkg)
permission.If this method is overridden, then
super.checkPackageDefinition
should be called as the first line in the overridden method.- Implementation Note:
- This implementation also restricts all non-exported packages of modules loaded by the platform class loader or its ancestors. A "non-exported package" refers to a package that is not exported to all modules. Specifically, it refers to a package that either is not exported at all by its containing module or is exported in a qualified fashion by its containing module.
- Parameters:
pkg
- the package name.- Throws:
SecurityException
- if the calling thread does not have permission to define classes in the specified package.NullPointerException
- if the package name argument isnull
.- See Also:
ClassLoader.loadClass(String, boolean)
,getProperty
,checkPermission
-
checkSetFactory
public void checkSetFactory()Throws aSecurityException
if the calling thread is not allowed to set the socket factory used byServerSocket
orSocket
, or the stream handler factory used byURL
.This method calls
checkPermission
with theRuntimePermission("setFactory")
permission.If you override this method, then you should make a call to
super.checkSetFactory
at the point the overridden method would normally throw an exception.- Throws:
SecurityException
- if the calling thread does not have permission to specify a socket factory or a stream handler factory.- See Also:
setSocketFactory
,setSocketImplFactory
,setURLStreamHandlerFactory
,checkPermission
-
checkSecurityAccess
Determines whether the permission with the specified permission target name should be granted or denied.If the requested permission is allowed, this method returns quietly. If denied, a SecurityException is raised.
This method creates a
SecurityPermission
object for the given permission target name and callscheckPermission
with it.See the documentation for
for a list of possible permission target names.SecurityPermission
If you override this method, then you should make a call to
super.checkSecurityAccess
at the point the overridden method would normally throw an exception.- Parameters:
target
- the target name of theSecurityPermission
.- Throws:
SecurityException
- if the calling thread does not have permission for the requested access.NullPointerException
- iftarget
is null.IllegalArgumentException
- iftarget
is empty.- Since:
- 1.1
- See Also:
checkPermission
-
getThreadGroup
Returns the thread group into which to instantiate any new thread being created at the time this is being called. By default, it returns the thread group of the current thread. This should be overridden by a specific security manager to return the appropriate thread group.- Returns:
- ThreadGroup that new threads are instantiated into
- Since:
- 1.1
- See Also:
ThreadGroup
-