java.lang.isolate
Class IsolatePermission

java.lang.Object
  |
  +--java.security.Permission
        |
        +--java.security.BasicPermission
              |
              +--java.lang.isolate.IsolatePermission

All Implemented Interfaces:

Guard, Serializable

public class IsolatePermission

extends BasicPermission

This class represents access control to the isolate creation and management. An IsolatePermission contains a target name but no actions list; you either have the named permission or you don't.

The target name is the name of the isolate-related permission (see below). The naming convention follows the hierarchical property naming convention (though only the "send" and "receive" permissions have a hierarchy). The "*" target represents all IsolatePermission permissions.

The following table lists all the possible IsolatePermission target names, and for each provides a description of what the permission allows and a discussion of the risks of granting the permission.

Permission Target Name	What the Permission Allows	Risks of Allowing this Permission	Notes
create	Creating new isolates	This is an extremely dangerous permission to grant. Being able to create an Isolate instance is tantamount to granting AllPermission because the security environment of the new isolate is entirely under the control of the creator.
receive.{link type}	Receipt of a LinkMessage containing the specified type on a Link.	Allows malicious code to receive objects which it should not have access to.	The {link type} should be one of the explicit types defined by the LinkMessage factory methods: "Isolate", "Link", "ByteBuffer", "ByteArray", "String", "Socket", "ServerSocket", "Serializable", "PipeSink", "PipeSource", "Event", or "*". The {link type} is case insensitive.
send.{link type}	Dispersal of a LinkMessage containing the specified type on a Link or via Isolate.start.	Allows malicious or broken code to disperse objects which it should not propagate.	The {link type} should be one of the explicit types defined by the LinkMessage factory methods: "Isolate", "Link", "ByteBuffer", "ByteArray", "String", "Socket", "ServerSocket", "Serializable", "PipeSink", "PipeSource", "Event", or "*". The {link type} is case insensitive.
control	Invoking exit or halt on an Isolate	Allows malicious code to kill other isolates for which it has an Isolate instance.
context	Retrieval of the current isolate's context from Isolate.getContext	Depending on the use of the context, it may allow malicious code to change entries in the context that are used by libraries or other other middleware code.
enumerate	Invoking Isolate.getIsolates to obtain an array of all Isolate instances.	Allows malicious code to retrieve handles on all running isolates. Especially dangerous in conjunction with the "control" permission.

Isolate Security Architecture

Creating a new isolate is a very security sensitive operation because the new isolate has its own security environment that is initialized by standard system properties that, in turn, can be set in the new isolate's context. Code that creates a new isolate must be as trusted as code that creates a new ClassLoader or has permission to invoke Policy.setPolicy. By default, a new isolate will run with the aggregate default security manager settings (which defaults to leaving the relevant values unset, implying there is no default security manager).

See ' Default System and User Policy Files' in Chapter 3 of the Java 2 Platform Security Architecture for details on which standard system properties are used to configure the initial security policy.

The default security policy denies all isolate-related permissions except IsolatePermission("context").

Usage Examples

Default Security Manager:

Start a new isolate with the default security manager by setting the java.security.manager property in the new isolate's context:

 public Isolate isolateWithDefaultSecurity(String mainclass, String[] args) {
   TransientPreferences context = new TransientPreferences();
   // See Isolate.getContext for details:
   context.put("java.preferences/java.security.manager", "");
   Isolate i = new Isolate(mainclass, args, context, null);
   return i;
 }
 

Privileged Proxy:

Use some initial proxy code in a new isolate to set up an environment for running untrusted code.

 import java.security.*;
 import java.lang.isolate.*;

 public class AppProxy {
   private static AccessControlContext allAccessContext;

   // Spawn a new child.  Only code with IsolatePermission("create")
   // can complete this.  New isolate will run Proxy.main first.
   public static void spawn(String appmainclassname) {
     Isolate c = new Isolate(this.getClass().getName(), 
                                 new String[] { appmainclassname });
     c.start(null);
     p.isolate = c;
   }

   // main invoked when a new proxy is created.  Initialize, install
   // security manager, and then execute the "real" app
   public static void main(String[] args) {
     Permission isoCreate = new IsolatePermission("create");

     // don't let user code re-run this method
     AccessController.checkPermission(isoCreate);

     // Do some trusted initialization of the child isolate
     ...  // e.g., open some sockets or files, connect to a database, etc.

     // Save off current security context (all access granted)
     AppProxy.allAccessContext = AccessController.getContext();

     // Install default SecurityManager
     System.setSecurityManager(new SecurityManager())

     runRealApp(args[0]); 
   }

   // let the "real" app do some well-controlled privileged operations
   public static void doPrivilegedOperation() {
     AccessController.doPrivileged(new PrivilegedAction() {
       public Object run() {
          // Do some trusted operations when asked by untrusted code
          ... // e.g., flush to db, get new files/sockets, etc.
       }
     }, AppProxy.allAccessContext);
     return p;
   }

   // Use reflection to look up the "real" app main
   public void runRealApp(String app) { ... }
   
 }
 

See also the Security Section of the specification.

See Also:

Serialized Form

Constructor Summary

IsolatePermission(String name)
Creates a new IsolatePermission with the specified name.

IsolatePermission(String name, String actions)
Creates a new IsolatePermission object with the specified name.

Methods inherited from class java.security.BasicPermission

equals, getActions, hashCode, implies, newPermissionCollection

Methods inherited from class java.security.Permission

checkGuard, getName, toString

Methods inherited from class java.lang.Object

getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

IsolatePermission

public IsolatePermission(String name)

Creates a new IsolatePermission with the specified name. The name is the symbolic name of the IsolatePermission, such as: "create", "send.Link", "receive.*", "control", or "enumerate." The value "*" may be used to indicate all isolate permissions.

Parameters:

name - the name of the IsolatePermission

IsolatePermission

public IsolatePermission(String name,
                         String actions)

Creates a new IsolatePermission object with the specified name. The name is the symbolic name of the IsolatePermission, and the actions string is currently unused and should be null. This constructor exists for use by the Policy object to instantiate new permission objects.

Parameters:

name - the name of the IsolatePermission

actions - should be null