securitymanager | 易学教程

Java classLoader源码分析（上）

阅读更多关于 Java classLoader源码分析（上）

Launcher类的构造函数 public Launcher() { Launcher.ExtClassLoader var1; try { //1.先通过内部类获取ExtClassLoader var1 = Launcher.ExtClassLoader.getExtClassLoader(); } catch (IOException var10) { throw new InternalError("Could not create extension class loader"); } try { //2.再通过内部类获取AppClassLoader然后初始化classLoader对象 this.loader = Launcher.AppClassLoader.getAppClassLoader(var1); } catch (IOException var9) { throw new InternalError("Could not create application class loader"); } //将当前线程的上下文类加载器设置为 AppClassLoader Thread.currentThread().setContextClassLoader(this.loader); String var2 = System.getProperty("java

Security manager rarely used on server?

阅读更多关于 Security manager rarely used on server?

问题 A recent question on SO lead me to an older answer about the Java Security Manager. My question about this line in that answer: The security manager impacts performances though, and it is rarely used on the server side. Can someone please back this up or refute? I thought there is always a security manager, a custom one or the default and that containers use it all the time. 回答1: In server-side code that you yourself write, I can't think for any need for you to use a SecurityManager, since if

How to unit test Java code that is expected to run within an applet Security Manager

阅读更多关于 How to unit test Java code that is expected to run within an applet Security Manager

问题 I have some Java library code which sometimes runs as an unsigned applet. Because of this it is not always allowed to do some operations (for instance checking for system properties). I would like to run some unit tests with an Applet-like security manager so that I can verify that the code is either not performing any restricted operations, or correctly handling any security exceptions. What is the best way to run these unit-tests with a realistic Security-Manager configuration? Preferable

Should I use Security Manager in Java web applications?

阅读更多关于 Should I use Security Manager in Java web applications?

问题 Is it sufficient to secure a Java web application with the rights of the user that is running the application server process or is it reasonable also to use SecurityManager with a suitable policy file? I have used to do the former and not the latter, but some customers would like us to also use SecurityManager that would explicitly give permissions to every third-party component to be sure there isn't any evil code lurking there. I've seen some Servlet containers, like Resin to propose not

How to authenticate exist-db users in RESTXQ

阅读更多关于 How to authenticate exist-db users in RESTXQ

问题 (complete rephrase - since no answer): I am developing an exist-db application with user authentication and RESTXQ. My users log in via the login:set-user function from the login module. Here a snippet from the controller: import module namespace login="http://exist-db.org/xquery/login" at "resource:org/exist/xquery/modules/persistentlogin/login.xql"; declare variable $local:login_domain := "org.exist-db.superApp"; declare variable $local:user := $local:login_domain || '.user'; let $logout :=

Security Manager in Clojure

阅读更多关于 Security Manager in Clojure

问题 I try to install a security manager from a Clojure program and am stuck short after a good start. This one works for me in Clojures simple REPL , in the Lein REPL, and in the Cider REPL in Emacs. It prevents the use of ( System/exit n ). (def SM (proxy [SecurityManager] [] (checkPermission [^java.security.Permission p] (when (.startsWith (.getName p) "exitVM") (throw (SecurityException. "exit")))))) (System/setSecurityManager SM) But I want to do this security manager to do more. E.g. log any

console log not goes to tomcat.log(catalina start -security > tomcat.log)

阅读更多关于 console log not goes to tomcat.log(catalina start -security > tomcat.log)

问题 Im using security manager in my tomcat. I need all the consol logs to be written in the tomcat.log file. Fo this im using this cmd catalina start -security > tomcat.log But the log not goes to tomcat.log rather it is again writing in console only. How can i write this log into a separate file? 回答1: Check out your catalina.out file. By default logs are redirected to $CATALINA_BASE/logs/catalina.out file. To override default configuration ,you can set Tomcat environment variables CATALINA_OUT

Does Java Security Manager decrease performance?

阅读更多关于 Does Java Security Manager decrease performance?

问题 Does implementing the Java Security Manager result in decreased performance? 回答1: That depends entirely on the details of the implementation, and on the application. It's certainly possible to implement a Security Manager that takes a long time to check certain permissions and an application that requires these premissions to be checked very frequently, resulting in horrible performance. But typically, checking permissions does not happen often enough to cause significant performance

A java SecurityManager that is identical to NO security manager except for a single check adjustment for System.exit

阅读更多关于 A java SecurityManager that is identical to NO security manager except for a single check adjustment for System.exit

问题 I am not well versed in java security managers and therefore want to confirm my understanding: I have a java process that randomly stops (shutdown hook runs) even though there is no trace of someone killing it. As a result I decided to install a security manager and override checkExit(int status) to make sure the reason for the stop is not something calling System.exit() . Basically I wrote this: System.setSecurityManager(new SecurityManager() { @Override public void checkExit(int status) {

How to automatically copy data to new RMI threads?

阅读更多关于 How to automatically copy data to new RMI threads?

问题 I am adapting a little rmi client-server application. I have written several things : HelloInterface -> A Hello World interface for RMI Server -> The server app' Client -> The client app' Nothing special, but... I have put my hands in a new RMISecurityManager, which calls a JNI method and checks the permission for a separate user: package rmi; import java.rmi.RMISecurityManager; import java.io.*; public class NativeRMISecurityManager extends RMISecurityManager { private boolean unix;