...
By default, permissions cannot be defined to support actions using BasicPermission, but the actions can be freely implemented in the subclass, if required. BasicPermission is abstract, even though it contains no abstract methods; it defines all the methods that it extends from the Permission class. The custom defined subclass of the BasicPermission class has to define two constructors to call the most appropriate (one- or two-argument) superclass constructor (the superclass lacks a default constructor). The two-argument constructor also accepts an action even though a basic permission does not use it. This is required for constructing permission objects from the policy file. Note that the custom defined subclass of the BasicPermission class is declared to be final in accordance with guideline SEC07-J. Classes that derive from a sensitive class or implement a sensitive interface should must be declared to be final.
The compliant solution then uses a security manager to check whether the caller has the requisite permission to set the handler. The code throws a SecurityException if the check fails. The custom permission class ExceptionReporterPermission is also defined with the two required constructors.
...