Page History

According to the Java API API Class SecurityManager documentation [API 2011] Class SecurityManager documentation ,

The security manager is a class that allows applications to implement a security policy. It allows an application to determine, before performing a possibly unsafe or sensitive operation, what the operation is and whether it is being attempted in a security context that allows the operation to be performed. The application can allow or disallow the operation.

...

Many of the Java SE APIs perform security manager checks by default before performing sensitive operations. For example, the constructor of class java.io.FileInputStream throws a SecurityException if the caller does not have the permission to read a file. Because SecurityException is a subclass of RuntimeException, the declarations of some API methods (e.g.for example, those of the java.io.FileReader class) may lack a throws clause that lists the SecurityException. Avoid depending on the presence or absence of security manager checks that are not specified in the API method's documentation.

...

Use double equals (==) instead of the single equals (=) when overriding the global Java security policy file with a custom policy file.:

java -Djava.security.manager -Djava.security.policy==policyURL LocalJavaApp

...

try {
  System.setSecurityManager(null);
} catch (SecurityException se) {
  // cannotCannot set security manager, log to file
}

...

This compliant solution instantiates and sets the default security manager.:

try {
  System.setSecurityManager(new SecurityManager());
} catch (SecurityException se) {
  // cannotCannot set security manager, log to file
}

...

try {
  System.setSecurityManager(new CustomSecurityManager("password here"));
} catch (SecurityException se) {
  // cannotCannot set security manager, log to file
}

...

Programmatic detection of the presence or absence of a SecurityManager at runtime is straightforward. Static analysis can address the presence or absence of code that would attempt to install a SecurityManager if the code were executed. Checking whether the SecurityManager is installed early enough, whether it specifies the desired properties, or whether it is guaranteed to be installed may be possible in some special cases but is not feasible in full generality.

Related Guidelines

...

...

Bibliography

...

...

...

...

...

...

Image Modified