Page History

According

 to \[[API 06|AA. Java References#API 06]\], Class {{SecurityManager}} documentation:

The security manager is a class that allows applications to implement a security policy. It allows an application to determine, before performing a possibly unsafe or sensitive operation, what the operation is and whether it is being attempted in a security context that allows the operation to be performed. The application can allow or disallow the operation.

...

As an example, the security manager denies applets all but the most essential privileges. The security manager It is designed to protect inadvertent system modification, information leakage and user impersonation. From Java 2 Platform onwards, SecurityManager is a non-abstract class. As a result, there is no explicit requirement of overriding its methods. To use a security manager, the code must have the runtime permissions createSecurityManager (to instantiate SecurityManager and avoid certain information leakage) and setSecurityManager to install it.

...

By default, the SecurityManager checkPermission method(s) forward all calls to the java.security.Accesscontroller.checkPermission. Sometimes it is required to perform checks against a different context than the currently executing threads' context. This can be done using the checkPermission(Permission perm, Object context) method which takes an extra argument (like AccessControlContext) as the context of the desired thread.

The default policy file {{java.policy}} grants a few permissions (reading system properties, binding to unprivileged ports and so on) and can be found in the {{~/java.home/lib/security}} directory on *nix based systems and its equivalent on Microsoft Windows systems. The document \[[Policy 02|AA. Java References#Policy 02]\] discusses writing policy files in depth.

...