sun.security.util.SecurityConstants Java Examples

/**
 * Creates one of the well-known permissions directly instead of
 * via reflection. Keep list short to not penalize non-JDK-defined
 * permissions.
 */
private static final Permission getKnownInstance(Class<?> claz,
    String name, String actions) {
    if (claz.equals(FilePermission.class)) {
        return new FilePermission(name, actions);
    } else if (claz.equals(SocketPermission.class)) {
        return new SocketPermission(name, actions);
    } else if (claz.equals(RuntimePermission.class)) {
        return new RuntimePermission(name, actions);
    } else if (claz.equals(PropertyPermission.class)) {
        return new PropertyPermission(name, actions);
    } else if (claz.equals(NetPermission.class)) {
        return new NetPermission(name, actions);
    } else if (claz.equals(AllPermission.class)) {
        return SecurityConstants.ALL_PERMISSION;
    } else {
        return null;
    }
}
 

PrivilegedCallableUsingCurrentClassLoader(Callable<T> task) {
    SecurityManager sm = System.getSecurityManager();
    if (sm != null) {
        // Calls to getContextClassLoader from this class
        // never trigger a security check, but we check
        // whether our callers have this permission anyways.
        sm.checkPermission(SecurityConstants.GET_CLASSLOADER_PERMISSION);

        // Whether setContextClassLoader turns out to be necessary
        // or not, we fail fast if permission is not available.
        sm.checkPermission(new RuntimePermission("setContextClassLoader"));
    }
    this.task = task;
    this.acc = AccessController.getContext();
    this.ccl = Thread.currentThread().getContextClassLoader();
}
 

/**
 * Does a conservative approximation of member access check. Use this if
 * you don't have an actual 'userland' caller Class/ClassLoader available.
 * This might be more restrictive than a precise member access check where
 * you have a caller, but should never allow a member access that is
 * forbidden.
 *
 * @param m the {@code Member} about to be accessed
 */
public static void conservativeCheckMemberAccess(Member m) throws SecurityException{
    final SecurityManager sm = System.getSecurityManager();
    if (sm == null)
        return;

    // Check for package access on the declaring class.
    //
    // In addition, unless the member and the declaring class are both
    // public check for access declared member permissions.
    //
    // This is done regardless of ClassLoader relations between the {@code
    // Member m} and any potential caller.

    final Class<?> declaringClass = m.getDeclaringClass();

    checkPackageAccess(declaringClass);

    if (Modifier.isPublic(m.getModifiers()) &&
            Modifier.isPublic(declaringClass.getModifiers()))
        return;

    // Check for declared member access.
    sm.checkPermission(SecurityConstants.CHECK_MEMBER_ACCESS_PERMISSION);
}
 

/**
 * Does a conservative approximation of member access check. Use this if
 * you don't have an actual 'userland' caller Class/ClassLoader available.
 * This might be more restrictive than a precise member access check where
 * you have a caller, but should never allow a member access that is
 * forbidden.
 *
 * @param m the {@code Member} about to be accessed
 */
public static void conservativeCheckMemberAccess(Member m) throws SecurityException{
    final SecurityManager sm = System.getSecurityManager();
    if (sm == null)
        return;

    // Check for package access on the declaring class.
    //
    // In addition, unless the member and the declaring class are both
    // public check for access declared member permissions.
    //
    // This is done regardless of ClassLoader relations between the {@code
    // Member m} and any potential caller.

    final Class<?> declaringClass = m.getDeclaringClass();

    checkPackageAccess(declaringClass);

    if (Modifier.isPublic(m.getModifiers()) &&
            Modifier.isPublic(declaringClass.getModifiers()))
        return;

    // Check for declared member access.
    sm.checkPermission(SecurityConstants.CHECK_MEMBER_ACCESS_PERMISSION);
}
 

/**
 * Does a conservative approximation of member access check. Use this if
 * you don't have an actual 'userland' caller Class/ClassLoader available.
 * This might be more restrictive than a precise member access check where
 * you have a caller, but should never allow a member access that is
 * forbidden.
 *
 * @param m the {@code Member} about to be accessed
 */
public static void conservativeCheckMemberAccess(Member m) throws SecurityException{
    final SecurityManager sm = System.getSecurityManager();
    if (sm == null)
        return;

    // Check for package access on the declaring class.
    //
    // In addition, unless the member and the declaring class are both
    // public check for access declared member permissions.
    //
    // This is done regardless of ClassLoader relations between the {@code
    // Member m} and any potential caller.

    final Class<?> declaringClass = m.getDeclaringClass();

    checkPackageAccess(declaringClass);

    if (Modifier.isPublic(m.getModifiers()) &&
            Modifier.isPublic(declaringClass.getModifiers()))
        return;

    // Check for declared member access.
    sm.checkPermission(SecurityConstants.CHECK_MEMBER_ACCESS_PERMISSION);
}
 

/**
 * Creates one of the well-known permissions directly instead of
 * via reflection. Keep list short to not penalize non-JDK-defined
 * permissions.
 */
private static final Permission getKnownInstance(Class<?> claz,
    String name, String actions) {
    if (claz.equals(FilePermission.class)) {
        return new FilePermission(name, actions);
    } else if (claz.equals(SocketPermission.class)) {
        return new SocketPermission(name, actions);
    } else if (claz.equals(RuntimePermission.class)) {
        return new RuntimePermission(name, actions);
    } else if (claz.equals(PropertyPermission.class)) {
        return new PropertyPermission(name, actions);
    } else if (claz.equals(NetPermission.class)) {
        return new NetPermission(name, actions);
    } else if (claz.equals(AllPermission.class)) {
        return SecurityConstants.ALL_PERMISSION;
    } else {
        return null;
    }
}
 

@Override
public Path readSymbolicLink(Path obj1) throws IOException {
    UnixPath link = UnixPath.toUnixPath(obj1);
    // permission check
    SecurityManager sm = System.getSecurityManager();
    if (sm != null) {
        FilePermission perm = new FilePermission(link.getPathForPermissionCheck(),
            SecurityConstants.FILE_READLINK_ACTION);
        sm.checkPermission(perm);
    }
    try {
        byte[] target = readlink(link);
        return new UnixPath(link.getFileSystem(), target);
    } catch (UnixException x) {
       if (x.errno() == UnixConstants.EINVAL)
            throw new NotLinkException(link.getPathForExceptionMessage());
        x.rethrowAsIOException(link);
        return null;    // keep compiler happy
    }
}
 

PrivilegedCallableUsingCurrentClassLoader(Callable<T> task) {
    SecurityManager sm = System.getSecurityManager();
    if (sm != null) {
        // Calls to getContextClassLoader from this class
        // never trigger a security check, but we check
        // whether our callers have this permission anyways.
        sm.checkPermission(SecurityConstants.GET_CLASSLOADER_PERMISSION);

        // Whether setContextClassLoader turns out to be necessary
        // or not, we fail fast if permission is not available.
        sm.checkPermission(new RuntimePermission("setContextClassLoader"));
    }
    this.task = task;
    this.acc = AccessController.getContext();
    this.ccl = Thread.currentThread().getContextClassLoader();
}
 

/**
 * Creates one of the well-known permissions directly instead of
 * via reflection. Keep list short to not penalize non-JDK-defined
 * permissions.
 */
private static final Permission getKnownInstance(Class<?> claz,
    String name, String actions) {
    if (claz.equals(FilePermission.class)) {
        return new FilePermission(name, actions);
    } else if (claz.equals(SocketPermission.class)) {
        return new SocketPermission(name, actions);
    } else if (claz.equals(RuntimePermission.class)) {
        return new RuntimePermission(name, actions);
    } else if (claz.equals(PropertyPermission.class)) {
        return new PropertyPermission(name, actions);
    } else if (claz.equals(NetPermission.class)) {
        return new NetPermission(name, actions);
    } else if (claz.equals(AllPermission.class)) {
        return SecurityConstants.ALL_PERMISSION;
    } else {
        return null;
    }
}
 

/**
 * checks the security permissions for accessing system clipboard
 *
 * for untrusted context (see isTrustedContext) checks the
 * permissions for the current event being handled
 *
 */
public static boolean canAccessSystemClipboard() {
    boolean canAccess = false;
    if (!GraphicsEnvironment.isHeadless()) {
        SecurityManager sm = System.getSecurityManager();
        if (sm == null) {
            canAccess = true;
        } else {
            try {
                sm.checkPermission(SecurityConstants.AWT.ACCESS_CLIPBOARD_PERMISSION);
                canAccess = true;
            } catch (SecurityException e) {
            }
            if (canAccess && ! isTrustedContext()) {
                canAccess = canCurrentEventAccessSystemClipboard(true);
            }
        }
    }
    return canAccess;
}
 

private boolean canAccessSystemClipboard() {
    boolean b = false;

    if (!GraphicsEnvironment.isHeadless()) {
        SecurityManager sm = System.getSecurityManager();
        if (sm != null) {
            try {
                sm.checkPermission(SecurityConstants.AWT.ACCESS_CLIPBOARD_PERMISSION);
                b = true;
            } catch (SecurityException se) {
                if (logger.isLoggable(PlatformLogger.Level.FINE)) {
                    logger.fine("InputEvent.canAccessSystemClipboard() got SecurityException ", se);
                }
            }
        } else {
            b = true;
        }
    }

    return b;
}
 

private void checkMemberAccess(int which, Class<?> caller, boolean checkProxyInterfaces) {
    final SecurityManager s = System.getSecurityManager();
    if (s != null) {
        /* Default policy allows access to all {@link Member#PUBLIC} members,
         * as well as access to classes that have the same class loader as the caller.
         * In all other cases, it requires RuntimePermission("accessDeclaredMembers")
         * permission.
         */
        final ClassLoader ccl = ClassLoader.getClassLoader(caller);
        final ClassLoader cl = getClassLoader0();
        if (which != Member.PUBLIC) {
            if (ccl != cl) {
                s.checkPermission(SecurityConstants.CHECK_MEMBER_ACCESS_PERMISSION);
            }
        }
        this.checkPackageAccess(ccl, checkProxyInterfaces);
    }
}
 

private void setWarningString() {
    warningString = null;
    SecurityManager sm = System.getSecurityManager();
    if (sm != null) {
        try {
            sm.checkPermission(SecurityConstants.AWT.TOPLEVEL_WINDOW_PERMISSION);
        } catch (SecurityException se) {
            // make sure the privileged action is only
            // for getting the property! We don't want the
            // above checkPermission call to always succeed!
            warningString = AccessController.doPrivileged(
                  new GetPropertyAction("awt.appletWarning",
                                        "Java Applet Window"));
        }
    }
}
 

/**
 * Perform necessary <a href="MethodHandles.Lookup.html#secmgr">access checks</a>.
 * Determines a trustable caller class to compare with refc, the symbolic reference class.
 * If this lookup object has private access, then the caller class is the lookupClass.
 */
void checkSecurityManager(Class<?> refc, MemberName m) {
    SecurityManager smgr = System.getSecurityManager();
    if (smgr == null)  return;
    if (allowedModes == TRUSTED)  return;

    // Step 1:
    boolean fullPowerLookup = hasPrivateAccess();
    if (!fullPowerLookup ||
        !VerifyAccess.classLoaderIsAncestor(lookupClass, refc)) {
        ReflectUtil.checkPackageAccess(refc);
    }

    // Step 2:
    if (m.isPublic()) return;
    if (!fullPowerLookup) {
        smgr.checkPermission(SecurityConstants.CHECK_MEMBER_ACCESS_PERMISSION);
    }

    // Step 3:
    Class<?> defc = m.getDeclaringClass();
    if (!fullPowerLookup && defc != refc) {
        ReflectUtil.checkPackageAccess(defc);
    }
}
 

/**
 * Return true (merge policy permissions) in the following cases:
 *
 * . SecurityManager is null
 *
 * . SecurityManager is not null,
 *          debug is not null,
 *          SecurityManager impelmentation is in bootclasspath,
 *          Policy implementation is in bootclasspath
 *          (the bootclasspath restrictions avoid recursion)
 *
 * . SecurityManager is not null,
 *          debug is null,
 *          caller has Policy.getPolicy permission
 */
private static boolean seeAllp() {
    SecurityManager sm = System.getSecurityManager();

    if (sm == null) {
        return true;
    } else {
        if (DebugHolder.debug != null) {
            if (sm.getClass().getClassLoader() == null &&
                Policy.getPolicyNoCheck().getClass().getClassLoader()
                                                            == null) {
                return true;
            }
        } else {
            try {
                sm.checkPermission(SecurityConstants.GET_POLICY_PERMISSION);
                return true;
            } catch (SecurityException se) {
                // fall thru and return false
            }
        }
    }

    return false;
}
 

/**
 * Does a conservative approximation of member access check. Use this if
 * you don't have an actual 'userland' caller Class/ClassLoader available.
 * This might be more restrictive than a precise member access check where
 * you have a caller, but should never allow a member access that is
 * forbidden.
 *
 * @param m the {@code Member} about to be accessed
 */
public static void conservativeCheckMemberAccess(Member m) throws SecurityException{
    final SecurityManager sm = System.getSecurityManager();
    if (sm == null)
        return;

    // Check for package access on the declaring class.
    //
    // In addition, unless the member and the declaring class are both
    // public check for access declared member permissions.
    //
    // This is done regardless of ClassLoader relations between the {@code
    // Member m} and any potential caller.

    final Class<?> declaringClass = m.getDeclaringClass();

    checkPackageAccess(declaringClass);

    if (Modifier.isPublic(m.getModifiers()) &&
            Modifier.isPublic(declaringClass.getModifiers()))
        return;

    // Check for declared member access.
    sm.checkPermission(SecurityConstants.CHECK_MEMBER_ACCESS_PERMISSION);
}
 

public Clipboard getSystemClipboard() {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(SecurityConstants.AWT.ACCESS_CLIPBOARD_PERMISSION);
    }
    synchronized (this) {
        if (clipboard == null) {
            clipboard = new WClipboard();
        }
    }
    return clipboard;
}
 

private static void checkScreenCaptureAllowed() {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(
            SecurityConstants.AWT.READ_DISPLAY_PIXELS_PERMISSION);
    }
}
 

/**
 * Returns an enumeration of all the AllPermission objects in the
 * container.
 *
 * @return an enumeration of all the AllPermission objects.
 */
public Enumeration<Permission> elements() {
    return new Enumeration<Permission>() {
        private boolean hasMore = all_allowed;

        public boolean hasMoreElements() {
            return hasMore;
        }

        public Permission nextElement() {
            hasMore = false;
            return SecurityConstants.ALL_PERMISSION;
        }
    };
}
 

/**
 * Assigns a valid value to the canAccessClipboard instance variable.
 */
private boolean canAccessClipboard() {
    SecurityManager sm = System.getSecurityManager();
    if (sm == null) return true;
    try {
        sm.checkPermission(SecurityConstants.AWT.ACCESS_CLIPBOARD_PERMISSION);
        return true;
    } catch (SecurityException e) {}
    return false;
}
 

@Override
public final Clipboard getSystemClipboard() {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(SecurityConstants.AWT.ACCESS_CLIPBOARD_PERMISSION);
    }

    synchronized (this) {
        if (clipboard == null) {
            clipboard = createPlatformClipboard();
        }
    }
    return clipboard;
}
 

private void checkModalityPermission(ModalityType mt) {
    if (mt == ModalityType.TOOLKIT_MODAL) {
        SecurityManager sm = System.getSecurityManager();
        if (sm != null) {
            sm.checkPermission(
                SecurityConstants.AWT.TOOLKIT_MODALITY_PERMISSION
            );
        }
    }
}
 

/**
 * Returns a <code>PointerInfo</code> instance that represents the current
 * location of the mouse pointer.
 * The <code>GraphicsDevice</code> stored in this <code>PointerInfo</code>
 * contains the mouse pointer. The coordinate system used for the mouse position
 * depends on whether or not the <code>GraphicsDevice</code> is part of a virtual
 * screen device.
 * For virtual screen devices, the coordinates are given in the virtual
 * coordinate system, otherwise they are returned in the coordinate system
 * of the <code>GraphicsDevice</code>. See {@link GraphicsConfiguration}
 * for more information about the virtual screen devices.
 * On systems without a mouse, returns <code>null</code>.
 * <p>
 * If there is a security manager, its <code>checkPermission</code> method
 * is called with an <code>AWTPermission("watchMousePointer")</code>
 * permission before creating and returning a <code>PointerInfo</code>
 * object. This may result in a <code>SecurityException</code>.
 *
 * @exception HeadlessException if GraphicsEnvironment.isHeadless() returns true
 * @exception SecurityException if a security manager exists and its
 *            <code>checkPermission</code> method doesn't allow the operation
 * @see       GraphicsConfiguration
 * @see       SecurityManager#checkPermission
 * @see       java.awt.AWTPermission
 * @return    location of the mouse pointer
 * @since     1.5
 */
public static PointerInfo getPointerInfo() throws HeadlessException {
    if (GraphicsEnvironment.isHeadless()) {
        throw new HeadlessException();
    }

    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(SecurityConstants.AWT.WATCH_MOUSE_PERMISSION);
    }

    Point point = new Point(0, 0);
    int deviceNum = Toolkit.getDefaultToolkit().getMouseInfoPeer().fillPointWithCoords(point);
    GraphicsDevice[] gds = GraphicsEnvironment.getLocalGraphicsEnvironment().
                               getScreenDevices();
    PointerInfo retval = null;
    if (areScreenDevicesIndependent(gds)) {
        retval = new PointerInfo(gds[deviceNum], point);
    } else {
        for (int i = 0; i < gds.length; i++) {
            GraphicsConfiguration gc = gds[i].getDefaultConfiguration();
            Rectangle bounds = gc.getBounds();
            if (bounds.contains(point)) {
                retval = new PointerInfo(gds[i], point);
            }
        }
    }

    return retval;
}
 

public  Clipboard getSystemClipboard() {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(SecurityConstants.AWT.ACCESS_CLIPBOARD_PERMISSION);
    }
    synchronized (this) {
        if (clipboard == null) {
            clipboard = new XClipboard("System", "CLIPBOARD");
        }
    }
    return clipboard;
}
 

@Override
public Clipboard getSystemClipboard() {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(SecurityConstants.AWT.ACCESS_CLIPBOARD_PERMISSION);
    }
    synchronized (this) {
        if (clipboard == null) {
            clipboard = new WClipboard();
        }
    }
    return clipboard;
}
 

private static Void checkPermission() {
    SecurityManager sm = System.getSecurityManager();
    if (sm != null) {
        sm.checkPermission(SecurityConstants.SET_SOCKETIMPL_PERMISSION);
    }
    return null;
}
 

/**
 * Returns whether popup is allowed to be shown above the task bar.
 * This is a default implementation of this method, which checks
 * corresponding security permission.
 */
public boolean canPopupOverlapTaskBar() {
    boolean result = true;
    try {
        SecurityManager sm = System.getSecurityManager();
        if (sm != null) {
            sm.checkPermission(
                    SecurityConstants.AWT.SET_WINDOW_ALWAYS_ON_TOP_PERMISSION);
        }
    } catch (SecurityException se) {
        // There is no permission to show popups over the task bar
        result = false;
    }
    return result;
}
 

/**
 * returns true if the current context has been granted AllPermission
 */
private boolean hasAllPermission()
{
    try {
        checkPermission(SecurityConstants.ALL_PERMISSION);
        return true;
    } catch (SecurityException se) {
        return false;
    }
}
 

/**
 * Applets are not allowed to manipulate threads outside
 * applet thread groups. However a terminated thread no longer belongs
 * to any group.
 */
public void checkAccess(Thread t) {
    /* When multiple applets is reloaded simultaneously, there will be
     * multiple invocations to this method from plugin's SecurityManager.
     * This method should not be synchronized to avoid deadlock when
     * a page with multiple applets is reloaded
     */
    if ((t.getState() != Thread.State.TERMINATED) && !inThreadGroup(t)) {
        checkPermission(SecurityConstants.MODIFY_THREAD_PERMISSION);
    }
}
 

private static void checkScreenCaptureAllowed() {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(
            SecurityConstants.AWT.READ_DISPLAY_PIXELS_PERMISSION);
    }
}