Java Security, 2nd Edition

Operating on the Security Manager

There are two methods in the System class that are used to work with the security manager itself:

public static SecurityManager getSecurityManager( )

Return a reference to the currently installed security manager object (or null if no security manager is in place). Once obtained, this object can be used to test against various security policies.

public static void setSecurityManager(SecurityManager sm)

Set the system’s security manager to the given object. Code that wants to install a security manager must have the runtime permissions createSecurityManager in order to instantiate the security manager object and setSecurityManager in order to install it.

These methods operate with the understanding that there is a single security manager in the virtual machine; the only operations that are possible on the security manager are setting it (that is, creating an instance of the security manager class and telling the virtual machine that the newly created object should be the security manager) and getting it (that is, asking the virtual machine to return the object that is the security manager so that a method might be invoked upon it).

We’ve already seen how you might use the getSecurityManager( ) method to retrieve the security manager and invoke an operation on it. Setting the security manager is a predictably simple operation:

public static void main(String args[]) { System.setSecurityManager(new SecurityManagerImpl( )); ... do the work of the application ...