2 * Copyright (c) 1997, 2007, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
26 package java.security;
29 * <p> The AccessController class is used for access control operations
32 * <p> More specifically, the AccessController class is used for
36 * <li> to decide whether an access to a critical system
37 * resource is to be allowed or denied, based on the security policy
38 * currently in effect,<p>
39 * <li>to mark code as being "privileged", thus affecting subsequent
40 * access determinations, and<p>
41 * <li>to obtain a "snapshot" of the current calling context so
42 * access-control decisions from a different context can be made with
43 * respect to the saved context. </ul>
45 * <p> The {@link #checkPermission(Permission) checkPermission} method
46 * determines whether the access request indicated by a specified
47 * permission should be granted or denied. A sample call appears
48 * below. In this example, <code>checkPermission</code> will determine
49 * whether or not to grant "read" access to the file named "testFile" in
50 * the "/temp" directory.
54 * FilePermission perm = new FilePermission("/temp/testFile", "read");
55 * AccessController.checkPermission(perm);
59 * <p> If a requested access is allowed,
60 * <code>checkPermission</code> returns quietly. If denied, an
61 * AccessControlException is
62 * thrown. AccessControlException can also be thrown if the requested
63 * permission is of an incorrect type or contains an invalid value.
64 * Such information is given whenever possible.
66 * Suppose the current thread traversed m callers, in the order of caller 1
67 * to caller 2 to caller m. Then caller m invoked the
68 * <code>checkPermission</code> method.
69 * The <code>checkPermission </code>method determines whether access
70 * is granted or denied based on the following algorithm:
73 * for (int i = m; i > 0; i--) {
75 * if (caller i's domain does not have the permission)
76 * throw AccessControlException
78 * else if (caller i is marked as privileged) {
79 * if (a context was specified in the call to doPrivileged)
80 * context.checkPermission(permission)
85 * // Next, check the context inherited when the thread was created.
86 * // Whenever a new thread is created, the AccessControlContext at
87 * // that time is stored and associated with the new thread, as the
88 * // "inherited" context.
90 * inheritedContext.checkPermission(permission);
93 * <p> A caller can be marked as being "privileged"
94 * (see {@link #doPrivileged(PrivilegedAction) doPrivileged} and below).
95 * When making access control decisions, the <code>checkPermission</code>
96 * method stops checking if it reaches a caller that
97 * was marked as "privileged" via a <code>doPrivileged</code>
98 * call without a context argument (see below for information about a
99 * context argument). If that caller's domain has the
100 * specified permission, no further checking is done and
101 * <code>checkPermission</code>
102 * returns quietly, indicating that the requested access is allowed.
103 * If that domain does not have the specified permission, an exception
104 * is thrown, as usual.
106 * <p> The normal use of the "privileged" feature is as follows. If you
107 * don't need to return a value from within the "privileged" block, do
112 * ...normal code here...
113 * AccessController.doPrivileged(new PrivilegedAction<Void>() {
114 * public Void run() {
115 * // privileged code goes here, for example:
116 * System.loadLibrary("awt");
117 * return null; // nothing to return
120 * ...normal code here...
124 * PrivilegedAction is an interface with a single method, named
126 * The above example shows creation of an implementation
127 * of that interface; a concrete implementation of the
128 * <code>run</code> method is supplied.
129 * When the call to <code>doPrivileged</code> is made, an
130 * instance of the PrivilegedAction implementation is passed
131 * to it. The <code>doPrivileged</code> method calls the
132 * <code>run</code> method from the PrivilegedAction
133 * implementation after enabling privileges, and returns the
134 * <code>run</code> method's return value as the
135 * <code>doPrivileged</code> return value (which is
136 * ignored in this example).
138 * <p> If you need to return a value, you can do something like the following:
142 * ...normal code here...
143 * String user = AccessController.doPrivileged(
144 * new PrivilegedAction<String>() {
145 * public String run() {
146 * return System.getProperty("user.name");
149 * ...normal code here...
152 * <p>If the action performed in your <code>run</code> method could
153 * throw a "checked" exception (those listed in the <code>throws</code> clause
154 * of a method), then you need to use the
155 * <code>PrivilegedExceptionAction</code> interface instead of the
156 * <code>PrivilegedAction</code> interface:
159 * somemethod() throws FileNotFoundException {
160 * ...normal code here...
162 * FileInputStream fis = AccessController.doPrivileged(
163 * new PrivilegedExceptionAction<FileInputStream>() {
164 * public FileInputStream run() throws FileNotFoundException {
165 * return new FileInputStream("someFile");
168 * } catch (PrivilegedActionException e) {
169 * // e.getException() should be an instance of FileNotFoundException,
170 * // as only "checked" exceptions will be "wrapped" in a
171 * // PrivilegedActionException.
172 * throw (FileNotFoundException) e.getException();
174 * ...normal code here...
177 * <p> Be *very* careful in your use of the "privileged" construct, and
178 * always remember to make the privileged code section as small as possible.
180 * <p> Note that <code>checkPermission</code> always performs security checks
181 * within the context of the currently executing thread.
182 * Sometimes a security check that should be made within a given context
183 * will actually need to be done from within a
184 * <i>different</i> context (for example, from within a worker thread).
185 * The {@link #getContext() getContext} method and
186 * AccessControlContext class are provided
187 * for this situation. The <code>getContext</code> method takes a "snapshot"
188 * of the current calling context, and places
189 * it in an AccessControlContext object, which it returns. A sample call is
194 * AccessControlContext acc = AccessController.getContext()
199 * AccessControlContext itself has a <code>checkPermission</code> method
200 * that makes access decisions based on the context <i>it</i> encapsulates,
201 * rather than that of the current execution thread.
202 * Code within a different context can thus call that method on the
203 * previously-saved AccessControlContext object. A sample call is the
208 * acc.checkPermission(permission)
212 * <p> There are also times where you don't know a priori which permissions
213 * to check the context against. In these cases you can use the
214 * doPrivileged method that takes a context:
218 * AccessController.doPrivileged(new PrivilegedAction<Object>() {
219 * public Object run() {
220 * // Code goes here. Any permission checks within this
221 * // run method will require that the intersection of the
222 * // callers protection domain and the snapshot's
223 * // context have the desired permission.
226 * ...normal code here...
229 * @see AccessControlContext
232 * @author Roland Schemers
235 public final class AccessController {
238 * Don't allow anyone to instantiate an AccessController
240 private AccessController() { }
243 * Performs the specified <code>PrivilegedAction</code> with privileges
244 * enabled. The action is performed with <i>all</i> of the permissions
245 * possessed by the caller's protection domain.
247 * <p> If the action's <code>run</code> method throws an (unchecked)
248 * exception, it will propagate through this method.
250 * <p> Note that any DomainCombiner associated with the current
251 * AccessControlContext will be ignored while the action is performed.
253 * @param action the action to be performed.
255 * @return the value returned by the action's <code>run</code> method.
257 * @exception NullPointerException if the action is <code>null</code>
259 * @see #doPrivileged(PrivilegedAction,AccessControlContext)
260 * @see #doPrivileged(PrivilegedExceptionAction)
261 * @see #doPrivilegedWithCombiner(PrivilegedAction)
262 * @see java.security.DomainCombiner
265 public static <T> T doPrivileged(PrivilegedAction<T> action) {
270 * Performs the specified <code>PrivilegedAction</code> with privileges
271 * enabled. The action is performed with <i>all</i> of the permissions
272 * possessed by the caller's protection domain.
274 * <p> If the action's <code>run</code> method throws an (unchecked)
275 * exception, it will propagate through this method.
277 * <p> This method preserves the current AccessControlContext's
278 * DomainCombiner (which may be null) while the action is performed.
280 * @param action the action to be performed.
282 * @return the value returned by the action's <code>run</code> method.
284 * @exception NullPointerException if the action is <code>null</code>
286 * @see #doPrivileged(PrivilegedAction)
287 * @see java.security.DomainCombiner
291 public static <T> T doPrivilegedWithCombiner(PrivilegedAction<T> action) {
297 * Performs the specified <code>PrivilegedAction</code> with privileges
298 * enabled and restricted by the specified
299 * <code>AccessControlContext</code>.
300 * The action is performed with the intersection of the permissions
301 * possessed by the caller's protection domain, and those possessed
302 * by the domains represented by the specified
303 * <code>AccessControlContext</code>.
305 * If the action's <code>run</code> method throws an (unchecked) exception,
306 * it will propagate through this method.
308 * @param action the action to be performed.
309 * @param context an <i>access control context</i>
310 * representing the restriction to be applied to the
311 * caller's domain's privileges before performing
312 * the specified action. If the context is
314 * then no additional restriction is applied.
316 * @return the value returned by the action's <code>run</code> method.
318 * @exception NullPointerException if the action is <code>null</code>
320 * @see #doPrivileged(PrivilegedAction)
321 * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)
323 // public static native <T> T doPrivileged(PrivilegedAction<T> action,
324 // AccessControlContext context);
327 * Performs the specified <code>PrivilegedExceptionAction</code> with
328 * privileges enabled. The action is performed with <i>all</i> of the
329 * permissions possessed by the caller's protection domain.
331 * <p> If the action's <code>run</code> method throws an <i>unchecked</i>
332 * exception, it will propagate through this method.
334 * <p> Note that any DomainCombiner associated with the current
335 * AccessControlContext will be ignored while the action is performed.
337 * @param action the action to be performed
339 * @return the value returned by the action's <code>run</code> method
341 * @exception PrivilegedActionException if the specified action's
342 * <code>run</code> method threw a <i>checked</i> exception
343 * @exception NullPointerException if the action is <code>null</code>
345 * @see #doPrivileged(PrivilegedAction)
346 * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)
347 * @see #doPrivilegedWithCombiner(PrivilegedExceptionAction)
348 * @see java.security.DomainCombiner
351 doPrivileged(PrivilegedExceptionAction<T> action)
352 throws PrivilegedActionException {
355 } catch (Exception ex) {
356 throw new PrivilegedActionException(ex);
362 * Performs the specified <code>PrivilegedExceptionAction</code> with
363 * privileges enabled. The action is performed with <i>all</i> of the
364 * permissions possessed by the caller's protection domain.
366 * <p> If the action's <code>run</code> method throws an <i>unchecked</i>
367 * exception, it will propagate through this method.
369 * <p> This method preserves the current AccessControlContext's
370 * DomainCombiner (which may be null) while the action is performed.
372 * @param action the action to be performed.
374 * @return the value returned by the action's <code>run</code> method
376 * @exception PrivilegedActionException if the specified action's
377 * <code>run</code> method threw a <i>checked</i> exception
378 * @exception NullPointerException if the action is <code>null</code>
380 * @see #doPrivileged(PrivilegedAction)
381 * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)
382 * @see java.security.DomainCombiner
386 public static <T> T doPrivilegedWithCombiner
387 (PrivilegedExceptionAction<T> action) throws PrivilegedActionException {
388 return doPrivileged(action);
392 * Performs the specified <code>PrivilegedExceptionAction</code> with
393 * privileges enabled and restricted by the specified
394 * <code>AccessControlContext</code>. The action is performed with the
395 * intersection of the permissions possessed by the caller's
396 * protection domain, and those possessed by the domains represented by the
397 * specified <code>AccessControlContext</code>.
399 * If the action's <code>run</code> method throws an <i>unchecked</i>
400 * exception, it will propagate through this method.
402 * @param action the action to be performed
403 * @param context an <i>access control context</i>
404 * representing the restriction to be applied to the
405 * caller's domain's privileges before performing
406 * the specified action. If the context is
408 * then no additional restriction is applied.
410 * @return the value returned by the action's <code>run</code> method
412 * @exception PrivilegedActionException if the specified action's
413 * <code>run</code> method
414 * threw a <i>checked</i> exception
415 * @exception NullPointerException if the action is <code>null</code>
417 * @see #doPrivileged(PrivilegedAction)
418 * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)
420 // public static native <T> T
421 // doPrivileged(PrivilegedExceptionAction<T> action,
422 // AccessControlContext context)
423 // throws PrivilegedActionException;
426 * This method takes a "snapshot" of the current calling context, which
427 * includes the current Thread's inherited AccessControlContext,
428 * and places it in an AccessControlContext object. This context may then
429 * be checked at a later point, possibly in another thread.
431 * @see AccessControlContext
433 * @return the AccessControlContext based on the current context.
436 // public static AccessControlContext getContext()
438 // AccessControlContext acc = getStackAccessControlContext();
439 // if (acc == null) {
440 // // all we had was privileged system code. We don't want
441 // // to return null though, so we construct a real ACC.
442 // return new AccessControlContext(null, true);
444 // return acc.optimize();
449 * Determines whether the access request indicated by the
450 * specified permission should be allowed or denied, based on
451 * the current AccessControlContext and security policy.
452 * This method quietly returns if the access request
453 * is permitted, or throws an AccessControlException otherwise. The
454 * getPermission method of the AccessControlException returns the
455 * <code>perm</code> Permission object instance.
457 * @param perm the requested permission.
459 * @exception AccessControlException if the specified permission
460 * is not permitted, based on the current security policy.
461 * @exception NullPointerException if the specified permission
462 * is <code>null</code> and is checked based on the
463 * security policy currently in effect.
466 // public static void checkPermission(Permission perm)
467 // throws AccessControlException
469 // //System.err.println("checkPermission "+perm);
470 // //Thread.currentThread().dumpStack();
472 // if (perm == null) {
473 // throw new NullPointerException("permission can't be null");
476 // AccessControlContext stack = getStackAccessControlContext();
477 // // if context is null, we had privileged system code on the stack.
478 // if (stack == null) {
479 // Debug debug = AccessControlContext.getDebug();
480 // boolean dumpDebug = false;
481 // if (debug != null) {
482 // dumpDebug = !Debug.isOn("codebase=");
483 // dumpDebug &= !Debug.isOn("permission=") ||
484 // Debug.isOn("permission=" + perm.getClass().getCanonicalName());
487 // if (dumpDebug && Debug.isOn("stack")) {
488 // Thread.currentThread().dumpStack();
491 // if (dumpDebug && Debug.isOn("domain")) {
492 // debug.println("domain (context is null)");
496 // debug.println("access allowed "+perm);
501 // AccessControlContext acc = stack.optimize();
502 // acc.checkPermission(perm);