Learning Java

The Security Manager

A Java application’s access to system resources, such as the display, the filesystem, threads, external processes, and the network, can be controlled at a single point with a security manager. The class that implements this functionality in the Java API is the java.lang.SecurityManager class.

As you saw in Chapter 3, the Java 2 platform provides a default security manager that you can use with the Java interpreter. For many applications, this default security manager is sufficient; for some types of applications, such as those that do custom class loading, you may need to write your own security manager.

An instance of the SecurityManager class can be installed once, and only once, in the life of the Java runtime environment. Thereafter, every access to a fundamental system resource is filtered through specific methods of the SecurityManager object by the core Java packages. By installing a specialized SecurityManager, we can implement arbitrarily complex (or simple) security policies for allowing access to individual resources.

When the Java runtime system starts executing, it’s in a wide-open state until a SecurityManager is installed. The “null” security manager grants all requests, so the Java runtime system can perform any activity with the same level of access as other programs running under the user’s authority. If the application that is running needs to ensure a secure environment, it can install a SecurityManager with the static System.setSecurityManager( ...