(from Class 27) How does the Java programming language satisfy low-level code safety properties:
What kinds of properties can not be enforced by ideal reference monitors?
How does the Java security manager differ from an ideal reference monitor?
public class Permission {
public abstract boolean implies(Permission permission)
EFFECTS: Returns true iff the specified permission is implied by
this.
... // other methods not shown
}
public final class AllPermission extends Permission {
The AllPermission is a permission that implies all other permissions.
From the Java API documentation:
public boolean implies(Permission p)
Checks if the specified permission is "implied" by this object.
This method always returns true.
public final class FilePermission extends Permission {
From the Java API documentation:
FilePermission(String path, String actions)
REQUIRES: actions is a comma-separated list of keywords selected
from "read", "write", "execute", and "delete"
EFFECTS: Creates a new FilePermission object with the specified
actions.
public boolean implies(Permission p)
EFFECTS: Returns true iff the specified permission is implied by
this object, false if not.
More specifically, this method returns true if:
* p is an instanceof FilePermission,
* p's actions are a proper subset of this object's actions, and
* p's pathname is implied by this object's pathname. For example, "/tmp/*"
implies "/tmp/foo", since "/tmp/*" encompasses the "/tmp" directory and
all files in that directory, including the one named "foo".
}
Do the Permission subtypes follow behavioral subtying?
What should SecurityManager.checkDelete(String file) do?
Permissions policy = new Permissions ();
// pathname\\- means pathname and all files (recursively) contained
Permission p1 = new FilePermission ("C:\\-", "read,write,execute");
Permission p2 = new AllPermission ();
Permission p3 = new FilePermission
("C:\\Program Files\\Java\\jre1.5.0_06\\bin", "write");
policy.add(p1);
policy.add(p2);
policy.add(p3);
// Which of these are true:
// p1.implies(p3)
// p3.implies(p1)
// p2.implies(p2)
// p2.implies(p3)
// policy.implies(new javax.sound.sampled.AudioPermission("play"))
What is granting permissions (usually) better than enumerating
disallowed actions?
What can go wrong with Java security?
Bruce Schneier, Secrets and Lies, 2000.