Java Permissions类代码示例

import java.security.Permissions; //导入依赖的package包/类
Permissions getPermissions() {
    if (allowControl.get().get() || allowAccess.get().get() || allowAll.get().get()) {
        PermissionsBuilder builder =  new PermissionsBuilder()
                .addAll(permissions);
        if (allowControl.get().get()) {
            builder.add(LOGGERFINDER_PERMISSION);
        }
        if (allowAccess.get().get()) {
            builder.add(ACCESS_LOGGER);
            builder.add(ACCESS_LOGGING);
        }
        if (allowAll.get().get()) {
            builder.addAll(allPermissions);
        }
        return builder.toPermissions();
    }
    return permissions;
}
 

import java.security.Permissions; //导入依赖的package包/类
static PermissionCollection getRestrictedPermissions() {
    Permissions perms = new Permissions();
    // property/env access needed for parsing
    perms.add(new PropertyPermission("*", "read"));
    perms.add(new RuntimePermission("getenv.TIKA_CONFIG"));

    // add permissions for resource access:
    // classpath
    addReadPermissions(perms, JarHell.parseClassPath());
    // plugin jars
    if (TikaImpl.class.getClassLoader() instanceof URLClassLoader) {
        addReadPermissions(perms, ((URLClassLoader)TikaImpl.class.getClassLoader()).getURLs());
    }
    // jvm's java.io.tmpdir (needs read/write)
    perms.add(new FilePermission(System.getProperty("java.io.tmpdir") + System.getProperty("file.separator") + "-",
                                 "read,readlink,write,delete"));
    // current hacks needed for POI/PDFbox issues:
    perms.add(new SecurityPermission("putProviderProperty.BC"));
    perms.add(new SecurityPermission("insertProvider"));
    perms.add(new ReflectPermission("suppressAccessChecks"));
    // xmlbeans, use by POI, needs to get the context classloader
    perms.add(new RuntimePermission("getClassLoader"));
    perms.setReadOnly();
    return perms;
}
 

import java.security.Permissions; //导入依赖的package包/类
private Loader(URL[] urls, ClassLoader parent) {
    super(urls, parent);
    this.parent = parent;

    /*
     * Precompute the permissions required to access the loader.
     */
    permissions = new Permissions();
    addPermissionsForURLs(urls, permissions, false);

    /*
     * Caching the value of class annotation string here assumes
     * that the protected method addURL() is never called on this
     * class loader.
     */
    annotation = urlsToPath(urls);
}
 

import java.security.Permissions; //导入依赖的package包/类
private void attemptSetNullSecurityManager()
{
	final Permissions permissions = new Permissions();
	permissions.add(new RuntimePermission("setSecurityManager"));
	final AccessControlContext context = new AccessControlContext(new ProtectionDomain[]{new ProtectionDomain(null,
		permissions)});
	AccessController.doPrivileged(new PrivilegedAction<Object>()
	{
		@Override
		public Object run()
		{
			LOGGER.info("About to call System.setSecurityManager(null)");
			System.setSecurityManager(null);
			LOGGER.info("Progressed beyond call to System.setSecurityManager(null)");
			return null;
		}
	}, context);
}
 

import java.security.Permissions; //导入依赖的package包/类
/** Adds access to classpath jars/classes for jar hell scan, etc */
@SuppressForbidden(reason = "accesses fully qualified URLs to configure security")
static void addClasspathPermissions(Permissions policy) throws IOException {
    // add permissions to everything in classpath
    // really it should be covered by lib/, but there could be e.g. agents or similar configured)
    for (URL url : JarHell.parseClassPath()) {
        Path path;
        try {
            path = PathUtils.get(url.toURI());
        } catch (URISyntaxException e) {
            throw new RuntimeException(e);
        }
        // resource itself
        policy.add(new FilePermission(path.toString(), "read,readlink"));
        // classes underneath
        if (Files.isDirectory(path)) {
            policy.add(new FilePermission(path.toString() + path.getFileSystem().getSeparator() + "-", "read,readlink"));
        }
    }
}
 

import java.security.Permissions; //导入依赖的package包/类
Permissions getPermissions() {
    if (allowControl.get().get() || allowAccess.get().get() || allowAll.get().get()) {
        PermissionsBuilder builder =  new PermissionsBuilder()
                .addAll(permissions);
        if (allowControl.get().get()) {
            builder.add(CONTROL);
        }
        if (allowAccess.get().get()) {
            builder.add(ACCESS_LOGGER);
            builder.add(ACCESS_LOGGING);
        }
        if (allowAll.get().get()) {
            builder.addAll(allPermissions);
        }
        return builder.toPermissions();
    }
    return permissions;
}
 

import java.security.Permissions; //导入依赖的package包/类
public SimplePolicy(TestCase test, AtomicBoolean allowAll) {
    this.allowAll = allowAll;
    permissions = new Permissions();
    permissions.add(new LoggingPermission("control", null)); // needed by new FileHandler()
    permissions.add(new FilePermission("<<ALL FILES>>", "read")); // needed by new FileHandler()
    permissions.add(new FilePermission(logFile, "write,delete")); // needed by new FileHandler()
    permissions.add(new FilePermission(logFile+".lck", "write,delete")); // needed by FileHandler.close()
    permissions.add(new FilePermission(logFile+".1", "write,delete")); // needed by new FileHandler()
    permissions.add(new FilePermission(logFile+".1.lck", "write,delete")); // needed by FileHandler.close()
    permissions.add(new FilePermission(tmpLogFile, "write,delete")); // needed by new FileHandler()
    permissions.add(new FilePermission(tmpLogFile+".lck", "write,delete")); // needed by FileHandler.close()
    permissions.add(new FilePermission(tmpLogFile+".1", "write,delete")); // needed by new FileHandler()
    permissions.add(new FilePermission(tmpLogFile+".1.lck", "write,delete")); // needed by FileHandler.close()
    permissions.add(new FilePermission(userDir, "write")); // needed by new FileHandler()
    permissions.add(new FilePermission(tmpDir, "write")); // needed by new FileHandler()
    permissions.add(new PropertyPermission("user.dir", "read"));
    permissions.add(new PropertyPermission("java.io.tmpdir", "read"));
    allPermissions = new Permissions();
    allPermissions.add(new java.security.AllPermission());
}
 

import java.security.Permissions; //导入依赖的package包/类
@Override
protected PermissionCollection getPermissions(CodeSource codeSource) {
    Permissions perms = new Permissions();
    perms.add(new AllPermission());
    perms.setReadOnly();
    return perms;
}
 

import java.security.Permissions; //导入依赖的package包/类
public SystemClassLoader(List<File> files, ClassLoader[] parents, Set<Module> modules) throws IllegalArgumentException {
    super(files, parents, false);
    allPermissions = new Permissions();
    allPermissions.add(new AllPermission());
    allPermissions.setReadOnly();
    size = modules.size();
}
 

import java.security.Permissions; //导入依赖的package包/类
public SimplePolicy(ThreadLocal<AtomicBoolean> allowAll,
        ThreadLocal<AtomicBoolean> allowControl) {
    this.allowAll = allowAll;
    this.allowControl = allowControl;
    permissions = new Permissions();

    withControlPermissions = new Permissions();
    withControlPermissions.add(LOGGERFINDER_PERMISSION);

    // these are used for configuring the test itself...
    allPermissions = new Permissions();
    allPermissions.add(new java.security.AllPermission());
}
 

import java.security.Permissions; //导入依赖的package包/类
protected PermissionCollection getPermissions(CodeSource codesource) {
    Permissions permissions = new Permissions();
    permissions.add(new AllPermission());
    permissions.setReadOnly();
    
    return permissions;
}
 

import java.security.Permissions; //导入依赖的package包/类
private Class<?> defineFinderClass(String name)
    throws ClassNotFoundException {
    final Object obj = getClassLoadingLock(name);
    synchronized(obj) {
        if (finderClasses.get(name) != null) return finderClasses.get(name);
        if (testLoggerFinderClass == null) {
            // Hack: we  load testLoggerFinderClass to get its code source.
            //       we can't use this.getClass() since we are in the boot.
            testLoggerFinderClass = super.loadClass("BaseDefaultLoggerFinderTest$TestLoggerFinder");
        }
        URL url = testLoggerFinderClass.getProtectionDomain().getCodeSource().getLocation();
        File file = new File(url.getPath(), name+".class");
        if (file.canRead()) {
            try {
                byte[] b = Files.readAllBytes(file.toPath());
                Permissions perms = new Permissions();
                perms.add(new AllPermission());
                Class<?> finderClass = defineClass(
                        name, b, 0, b.length, new ProtectionDomain(
                        this.getClass().getProtectionDomain().getCodeSource(),
                        perms));
                System.out.println("Loaded " + name);
                finderClasses.put(name, finderClass);
                return finderClass;
            } catch (Throwable ex) {
                ex.printStackTrace();
                throw new ClassNotFoundException(name, ex);
            }
        } else {
            throw new ClassNotFoundException(name,
                    new IOException(file.toPath() + ": can't read"));
        }
    }
}
 

import java.security.Permissions; //导入依赖的package包/类
/**
 * test with null location
 * <p>
 * its unclear when/if this happens, see https://bugs.openjdk.java.net/browse/JDK-8129972
 */
public void testNullLocation() throws Exception {
    assumeTrue("test cannot run with security manager", System.getSecurityManager() == null);
    PermissionCollection noPermissions = new Permissions();
    ESPolicy policy = new ESPolicy(noPermissions, Collections.emptyMap(), true);
    assertFalse(policy.implies(new ProtectionDomain(new CodeSource(null, (Certificate[]) null), noPermissions),
            new FilePermission("foo", "read")));
}
 

import java.security.Permissions; //导入依赖的package包/类
public SimplePolicy(TestCase test, ThreadLocal<AtomicBoolean> allowAll) {
    this.allowAll = allowAll;
    // we don't actually need any permission to create our
    // FileHandlers because we're passing invalid parameters
    // which will make the creation fail...
    permissions = new Permissions();
    permissions.add(new RuntimePermission("accessClassInPackage.jdk.internal.misc"));

    // these are used for configuring the test itself...
    allPermissions = new Permissions();
    allPermissions.add(new java.security.AllPermission());

}
 

import java.security.Permissions; //导入依赖的package包/类
/**
 * Creates an access control context limited to only the specified permissions.
 * @param permissions the permissions for the newly created access control context.
 * @return a new access control context limited to only the specified permissions.
 */
public static AccessControlContext createAccessControlContext(final Permission... permissions) {
    final Permissions perms = new Permissions();
    for(final Permission permission: permissions) {
        perms.add(permission);
    }
    return new AccessControlContext(new ProtectionDomain[] { new ProtectionDomain(null, perms) });
}