Package net.jini.security.policy

Class DynamicPolicyProvider

java.lang.Object
java.security.Policy
net.jini.security.policy.DynamicPolicyProvider
All Implemented Interfaces:
DynamicPolicy
public class DynamicPolicyProvider extends Policy implements DynamicPolicy
Security policy provider that supports dynamic granting of permissions at run-time. This provider is designed as a wrapper to layer dynamic grant functionality on top of an underlying policy provider. If the underlying provider does not implement the DynamicPolicy interface, then its permission mappings are assumed to change only when its refresh method is called. Permissions are granted on the granularity of class loader; granting a permission requires (of the calling context) GrantPermission for that permission.
Since:
2.0
Author:
Sun Microsystems, Inc.

  • Constructor Details

    • DynamicPolicyProvider

      public DynamicPolicyProvider() throws PolicyInitializationException
      Creates a new DynamicPolicyProvider instance that wraps a default underlying policy. The underlying policy is created as follows: if the net.jini.security.policy.DynamicPolicyProvider.basePolicyClass security property is set, then its value is interpreted as the class name of the base (underlying) policy provider; otherwise, a default class name of "net.jini.security.policy.PolicyFileProvider" is used. The base policy is then instantiated using the no-arg public constructor of the named class. If the base policy class is not found, is not instantiable via a public no-arg constructor, or if invocation of its constructor fails, then a PolicyInitializationException is thrown.

      Note that this constructor requires the appropriate "getProperty" SecurityPermission to read the net.jini.security.policy.DynamicPolicyProvider.basePolicyClass security property, and may require "accessClassInPackage.*" RuntimePermissions, depending on the package of the base policy class.

      Throws:
      PolicyInitializationException - if unable to construct the base policy
      SecurityException - if there is a security manager and the calling context does not have adequate permissions to read the net.jini.security.policy.DynamicPolicyProvider.basePolicyClass security property, or if the calling context does not have adequate permissions to access the base policy class

    • DynamicPolicyProvider

      public DynamicPolicyProvider(Policy basePolicy)
      Creates a new DynamicPolicyProvider instance that wraps around the given non-null base policy object.
      Parameters:
      basePolicy - base policy object containing information about non-dynamic grants
      Throws:
      NullPointerException - if basePolicy is null

  • Method Details

    • getPermissions

      public PermissionCollection getPermissions(CodeSource source)
      Behaves as specified by Policy.getPermissions(CodeSource).
      Overrides:
      getPermissions in class Policy

    • getPermissions

      public PermissionCollection getPermissions(ProtectionDomain domain)
      Behaves as specified by Policy.getPermissions(ProtectionDomain).
      Overrides:
      getPermissions in class Policy

    • implies

      public boolean implies(ProtectionDomain domain, Permission permission)
      Behaves as specified by Policy.implies(java.security.ProtectionDomain, java.security.Permission).
      Overrides:
      implies in class Policy

    • refresh

      public void refresh()
      Behaves as specified by Policy.refresh().
      Overrides:
      refresh in class Policy

    • grantSupported

      public boolean grantSupported()
      Description copied from interface: DynamicPolicy
      Returns true if this policy provider supports dynamic permission grants; returns false otherwise. Note that this method may return different values for a given DynamicPolicy instance, depending on context. For example, a policy provider that delegates to different underlying policy implementations depending on thread state would return true from this method when the current delegate supports dynamic permission grants, but return false when another delegate lacking such support is in effect.
      Specified by:
      grantSupported in interface DynamicPolicy
      Returns:
      true if policy supports dynamic permission grants under current context, false otherwise

    • grant

      public void grant(Class cl, Principal[] principals, Permission[] permissions)
      Description copied from interface: DynamicPolicy
      If this security policy provider supports dynamic permission grants, grants the specified permissions to all protection domains (including ones not yet created) that are associated with the class loader of the given class and possess at least the given set of principals. If the given class is null, then the grant applies across all protection domains that possess at least the specified principals. If the list of principals is null or empty, then principals are effectively ignored in determining the protection domains to which the grant applies. If this policy provider does not support dynamic permission grants, then no permissions are granted and an UnsupportedOperationException is thrown.

      The given class, if non-null, must belong to either the system domain or a protection domain whose associated class loader is non-null. If the class does not belong to such a protection domain, then no permissions are granted and an UnsupportedOperationException is thrown.

      If a security manager is installed, its checkPermission method is called with a GrantPermission containing the permissions to grant; if the permission check fails, then no permissions are granted and the resulting SecurityException is thrown. The principals and permissions arrays passed in are neither modified nor retained; subsequent changes to the arrays have no effect on the grant operation.

      Specified by:
      grant in interface DynamicPolicy
      Parameters:
      cl - class to grant permissions to the class loader of, or null if granting across all class loaders
      principals - if non-null, minimum set of principals to which grants apply
      permissions - if non-null, permissions to grant

    • getGrants

      public Permission[] getGrants(Class cl, Principal[] principals)
      Description copied from interface: DynamicPolicy
      If this security policy provider supports dynamic permission grants, returns a new array containing the cumulative set of permissions dynamically granted to protection domains (including ones not yet created) that are associated with the class loader of the given class and possess at least the given set of principals. If the given class is null, then this method returns the cumulative set of permissions dynamically granted across all protection domains that possess at least the specified principals (i.e., through calls to the grant method where the specified class was null). If the list of principals is null or empty, then the permissions returned reflect only grants not qualified by principals (i.e., those performed through calls to the grant method where the specified principals array was null or empty). If this policy provider does not support dynamic permission grants, then an UnsupportedOperationException is thrown.

      The given class, if non-null, must belong to either the system domain or a protection domain whose associated class loader is non-null. If the class does not belong to such a protection domain, then an UnsupportedOperationException is thrown.

      Specified by:
      getGrants in interface DynamicPolicy
      Parameters:
      cl - class to query the permissions dynamically granted to the class loader of, or null if querying permissions granted across all class loaders
      principals - if non-null, principals to query dynamic grants for
      Returns:
      new array containing the permissions dynamically granted to the indicated class loader (if any) and principals