SecureService.java Source code

Introduction

Here is the source code for SecureService.java

Source

/*
 * Copyright (c) 2000 David Flanagan.  All rights reserved.
 * This code is from the book Java Examples in a Nutshell, 2nd Edition.
 * It is provided AS-IS, WITHOUT ANY WARRANTY either expressed or implied.
 * You may study, use, and modify it for any non-commercial purpose.
 * You may distribute it non-commercially as long as you retain this notice.
 * For a commercial use license, or to purchase the book (recommended),
 * visit http://www.davidflanagan.com/javaexamples2.
 */

import java.io.File;
import java.io.FileOutputStream;
import java.io.FileReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.PrintWriter;

import com.sun.corba.se.spi.activation.Server;

/**
 * This is a demonstration service. It attempts to do things that may or may not
 * be allowed by the security policy and reports the results of its attempts to
 * the client.
 */
public class SecureService implements Server.Service {
    public void serve(InputStream i, OutputStream o) throws IOException {
        PrintWriter out = new PrintWriter(o);

        // Try to install our own security manager. If we can do this,
        // we can defeat any access control.
        out.println("Trying to create and install a security manager...");
        try {
            System.setSecurityManager(new SecurityManager());
            out.println("Success!");
        } catch (Exception e) {
            out.println("Failed: " + e);
        }

        // Try to make the Server and the Java VM exit.
        // This is a denial of service attack, and it should not succeed!
        out.println();
        out.println("Trying to exit...");
        try {
            System.exit(-1);
        } catch (Exception e) {
            out.println("Failed: " + e);
        }

        // The default system policy allows this property to be read
        out.println();
        out.println("Attempting to find java version...");
        try {
            out.println(System.getProperty("java.version"));
        } catch (Exception e) {
            out.println("Failed: " + e);
        }

        // The default system policy does not allow this property to be read
        out.println();
        out.println("Attempting to find home directory...");
        try {
            out.println(System.getProperty("user.home"));
        } catch (Exception e) {
            out.println("Failed: " + e);
        }

        // Our custom policy explicitly allows this property to be read
        out.println();
        out.println("Attempting to read service.tmp property...");
        try {
            String tmpdir = System.getProperty("service.tmp");
            out.println(tmpdir);
            File dir = new File(tmpdir);
            File f = new File(dir, "testfile");

            // Check whether we've been given permission to write files to
            // the tmpdir directory
            out.println();
            out.println("Attempting to write a file in " + tmpdir + "...");
            try {
                new FileOutputStream(f);
                out.println("Opened file for writing: " + f);
            } catch (Exception e) {
                out.println("Failed: " + e);
            }

            // Check whether we've been given permission to read files from
            // the tmpdir directory
            out.println();
            out.println("Attempting to read from " + tmpdir + "...");
            try {
                FileReader in = new FileReader(f);
                out.println("Opened file for reading: " + f);
            } catch (Exception e) {
                out.println("Failed: " + e);
            }
        } catch (Exception e) {
            out.println("Failed: " + e);
        }

        // Close the Service sockets
        out.close();
        i.close();
    }
}

/*
    
//Server.policy
    
//These lines grant permissions to any code loaded from the directory shown.
//Edit the directory to match the installation on your system.
//On Windows systems, change the forward slashes to double backslashes: "\\".
grant codeBase "file:/home/david/Books/JavaExamples2/Examples" {
   // Allow the server to listen for and accept network connections
   // from any host on any port > 1024
   permission java.net.SocketPermission "*:1024-", "listen,accept";
};
    
*/