| Wiki Markup |
|---|
According to the Java API \[[API 2006|AA. JavaBibliography#API References#API 06]\], class {{SecurityManager}} documentation |
...
| Wiki Markup |
|---|
Regarding the implementation and use of custom security managers as opposed to default ones, the Java Security Architecture Specification \[[SecuritySpec 2008|AA. Java References#SecuritySpecBibliography#SecuritySpec 08]\] states |
We encourage the use of
AccessControllerin application code, while customization of a security manager (via subclassing) should be the last resort and should be done with extreme care. Moreover, a customized security manager, such as one that always checks the time of the day before invoking standard security checks, could and should utilize the algorithm provided byAccessControllerwhenever appropriate.
...
| Wiki Markup |
|---|
Notably, the policy file specified in the argument is ignored when the {{policy.allowSystemProperty}} property in the security properties file ({{java.security}}) is set to {{false}}. Its default value is {{true}}. The document "Default Policy Implementation and Policy File Syntax" \[[Policy 2002|AA. JavaBibliography#Policy References#Policy 02]\] discusses writing policy files in depth. |
...
| Wiki Markup |
|---|
\[[API 2006|AA. JavaBibliography#API References#API 06]\] [Class SecurityManager|http://java.sun.com/javase/6/docs/api/java/lang/SecurityManager.html], Class AccessControlContext, Class AccessController \[[Policy 2002|AA. Java References#PolicyBibliography#Policy 02]\] \[[Pistoia 2004|AA. JavaBibliography#Pistoia References#Pistoia 04]\] Section 7.4, The Security Manager \[[Gong 2003|AA. Java References#GongBibliography#Gong 03]\] Section 6.1, Security Manager \[[SecuritySpec 2008|AA. JavaBibliography#SecuritySpec References#SecuritySpec 08]\] 6.2 SecurityManager versus AccessController \[[MITRE 2009|AA. Java References#MITREBibliography#MITRE 09]\] [CWE ID 358|http://cwe.mitre.org/data/definitions/358.html] "Improperly Implemented Security Check for Standard" |
...