Java Security, 2nd Edition

Appendix D. The Secure Java Container

In this appendix, we’ll outline a container that is capable of running Java programs securely. The term container is most often used to refer to a Java 2 Enterprise Edition (J2EE) application server; the application server provides an environment in which you run your programs. But containers need not be J2EE application servers: Java-enabled browsers are applet containers, the Java command line sets up a J2SE application container, and so on. A container is just a shell that runs other code.

In Java 2, when you execute the Java program, you’re actually starting a container that is referred to as the launcher. The launcher is set up to run applications security within the Java 2 framework (assuming that you’ve specified the -Djava.security.manager option). In order to achieve something similar in Java 1.1, you have to write a container from scratch; the container is responsible for setting a security manager, using an appropriate class loader, and so on.

Hence, the container that we outline in this appendix is most appropriate for Java 1.1. However, there are times even in Java 2 when you might want to write your own container for standard edition applications. If you want to use a different policy class, for instance, you must instantiate and register the policy class, instantiate a new class loader, and then execute your program from the new class loader. Similarly, you may want to install a new security manager that doesn’t use (or supplements ...