Programs must comply with the principle of least privilege not only by providing privileged blocks with the minimum permissions required for correct operation (see 16. Avoid granting excess privileges), but also by ensuring that privileged code contains only those operations that require the increased privileges. Superfluous code contained within a privileged block necessarily operates must operate with the privileges of that block, increasing the attack surface.
...
This example violates the principle of least privilege because an unprivileged caller will could also cause the authentication library to be loaded. An unprivileged caller should not be allowed to cannot invoke the System.loadLibrary() method , especially via the doPrivileged mechanism, because System.loadLibrary uses only the immediate caller's class loader to find and load the library. Unprivileged code is seldom granted privileges to load libraries because doing so would directly, because this could expose native methods to the unprivileged code code [SCG 2010]. Furthermore, the System.loadLibrary method checks only the privileges of its immediate caller, so it should be used only with great care. For more information, see
Compliant Solution
This compliant solution moves the call to System.loadLibrary() outside the doPrivileged() block. Doing so allows unprivileged code to perform preliminary password-reset checks using the file, but prevents it from loading the authentication library.
...
The loadLibrary() invocation could also occur before preliminary password - reset checks are performed; in this caseexample, it is deferred for performance reasons.
...