Java tutorial
/* * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation. Oracle designates this * particular file as subject to the "Classpath" exception as provided * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. */ package java.security; import java.security.*; import java.util.Enumeration; import java.util.Hashtable; import java.util.StringTokenizer; /** * This class is for security permissions. A {@code SecurityPermission} * contains a name (also referred to as a "target name") but no actions list; * you either have the named permission or you don't. * <p> * The target name is the name of a security configuration parameter * (see below). Currently the {@code SecurityPermission} object is used to * guard access to the {@link AccessControlContext}, {@link Policy}, * {@link Provider}, {@link Security}, {@link Signer}, and {@link Identity} * objects. * <p> * The following table lists the standard {@code SecurityPermission} * target names, and for each provides a description of what the permission * allows and a discussion of the risks of granting code the permission. * * <table class="striped"> * <caption style="display:none">target name, what the permission allows, and associated risks</caption> * <thead> * <tr> * <th scope="col">Permission Target Name</th> * <th scope="col">What the Permission Allows</th> * <th scope="col">Risks of Allowing this Permission</th> * </tr> * </thead> * <tbody> * * <tr> * <th scope="row">authProvider.{provider name}</th> * <td>Allow the named provider to be an AuthProvider for login and * logout operations. </td> * <td>This allows the named provider to perform login and logout * operations. The named provider must extend {@code AuthProvider} * and care must be taken to grant to a trusted provider since * login operations involve sensitive authentication information * such as PINs and passwords. </td> * </tr> * * <tr> * <th scope="row">createAccessControlContext</th> * <td>Creation of an AccessControlContext</td> * <td>This allows someone to instantiate an AccessControlContext * with a {@code DomainCombiner}. Extreme care must be taken when * granting this permission. Malicious code could create a DomainCombiner * that augments the set of permissions granted to code, and even grant the * code {@link java.security.AllPermission}.</td> * </tr> * * <tr> * <th scope="row">getDomainCombiner</th> * <td>Retrieval of an AccessControlContext's DomainCombiner</td> * <td>This allows someone to retrieve an AccessControlContext's * {@code DomainCombiner}. Since DomainCombiners may contain * sensitive information, this could potentially lead to a privacy leak.</td> * </tr> * * <tr> * <th scope="row">getPolicy</th> * <td>Retrieval of the system-wide security policy (specifically, of the * currently-installed Policy object)</td> * <td>This allows someone to query the policy via the * {@code getPermissions} call, * which discloses which permissions would be granted to a given CodeSource. * While revealing the policy does not compromise the security of * the system, it does provide malicious code with additional information * which it may use to better aim an attack. It is wise * not to divulge more information than necessary.</td> * </tr> * * <tr> * <th scope="row">setPolicy</th> * <td>Setting of the system-wide security policy (specifically, * the Policy object)</td> * <td>Granting this permission is extremely dangerous, as malicious * code may grant itself all the necessary permissions it needs * to successfully mount an attack on the system.</td> * </tr> * * <tr> * <th scope="row">createPolicy.{policy type}</th> * <td>Getting an instance of a Policy implementation from a provider</td> * <td>Granting this permission enables code to obtain a Policy object. * Malicious code may query the Policy object to determine what permissions * have been granted to code other than itself. </td> * </tr> * * <tr> * <th scope="row">getProperty.{key}</th> * <td>Retrieval of the security property with the specified key</td> * <td>Depending on the particular key for which access has * been granted, the code may have access to the list of security * providers, as well as the location of the system-wide and user * security policies. while revealing this information does not * compromise the security of the system, it does provide malicious * code with additional information which it may use to better aim * an attack. </td> * </tr> * * <tr> * <th scope="row">setProperty.{key}</th> * <td>Setting of the security property with the specified key</td> * <td>This could include setting a security provider or defining * the location of the system-wide security policy. Malicious * code that has permission to set a new security provider may * set a rogue provider that steals confidential information such * as cryptographic private keys. In addition, malicious code with * permission to set the location of the system-wide security policy * may point it to a security policy that grants the attacker * all the necessary permissions it requires to successfully mount * an attack on the system. </td> * </tr> * * <tr> * <th scope="row">insertProvider</th> * <td>Addition of a new provider</td> * <td>This would allow somebody to introduce a possibly * malicious provider (e.g., one that discloses the private keys passed * to it) as the highest-priority provider. This would be possible * because the Security object (which manages the installed providers) * currently does not check the integrity or authenticity of a provider * before attaching it. The "insertProvider" permission subsumes the * "insertProvider.{provider name}" permission (see the section below for * more information). * </td> * </tr> * * <tr> * <th scope="row">removeProvider.{provider name}</th> * <td>Removal of the specified provider</td> * <td>This may change the behavior or disable execution of other * parts of the program. If a provider subsequently requested by the * program has been removed, execution may fail. Also, if the removed * provider is not explicitly requested by the rest of the program, but * it would normally be the provider chosen when a cryptography service * is requested (due to its previous order in the list of providers), * a different provider will be chosen instead, or no suitable provider * will be found, thereby resulting in program failure.</td> * </tr> * * <tr> * <th scope="row">clearProviderProperties.{provider name}</th> * <td>"Clearing" of a Provider so that it no longer contains the properties * used to look up services implemented by the provider</td> * <td>This disables the lookup of services implemented by the provider. * This may thus change the behavior or disable execution of other * parts of the program that would normally utilize the Provider, as * described under the "removeProvider.{provider name}" permission.</td> * </tr> * * <tr> * <th scope="row">putProviderProperty.{provider name}</th> * <td>Setting of properties for the specified Provider</td> * <td>The provider properties each specify the name and location * of a particular service implemented by the provider. By granting * this permission, you let code replace the service specification * with another one, thereby specifying a different implementation.</td> * </tr> * * <tr> * <th scope="row">removeProviderProperty.{provider name}</th> * <td>Removal of properties from the specified Provider</td> * <td>This disables the lookup of services implemented by the * provider. They are no longer accessible due to removal of the properties * specifying their names and locations. This * may change the behavior or disable execution of other * parts of the program that would normally utilize the Provider, as * described under the "removeProvider.{provider name}" permission.</td> * </tr> * * </tbody> * </table> * * <P> * The following permissions have been superseded by newer permissions or are * associated with classes that have been deprecated: {@link Identity}, * {@link IdentityScope}, {@link Signer}. Use of them is discouraged. See the * applicable classes for more information. * * <table class="striped"> * <caption style="display:none">target name, what the permission allows, and associated risks</caption> * <thead> * <tr> * <th scope="col">Permission Target Name</th> * <th scope="col">What the Permission Allows</th> * <th scope="col">Risks of Allowing this Permission</th> * </tr> * </thead> * * <tbody> * <tr> * <th scope="row">insertProvider.{provider name}</th> * <td>Addition of a new provider, with the specified name</td> * <td>Use of this permission is discouraged from further use because it is * possible to circumvent the name restrictions by overriding the * {@link java.security.Provider#getName} method. Also, there is an equivalent * level of risk associated with granting code permission to insert a provider * with a specific name, or any name it chooses. Users should use the * "insertProvider" permission instead. * <p>This would allow somebody to introduce a possibly * malicious provider (e.g., one that discloses the private keys passed * to it) as the highest-priority provider. This would be possible * because the Security object (which manages the installed providers) * currently does not check the integrity or authenticity of a provider * before attaching it.</td> * </tr> * * <tr> * <th scope="row">setSystemScope</th> * <td>Setting of the system identity scope</td> * <td>This would allow an attacker to configure the system identity scope with * certificates that should not be trusted, thereby granting applet or * application code signed with those certificates privileges that * would have been denied by the system's original identity scope.</td> * </tr> * * <tr> * <th scope="row">setIdentityPublicKey</th> * <td>Setting of the public key for an Identity</td> * <td>If the identity is marked as "trusted", this allows an attacker to * introduce a different public key (e.g., its own) that is not trusted * by the system's identity scope, thereby granting applet or * application code signed with that public key privileges that * would have been denied otherwise.</td> * </tr> * * <tr> * <th scope="row">setIdentityInfo</th> * <td>Setting of a general information string for an Identity</td> * <td>This allows attackers to set the general description for * an identity. This may trick applications into using a different * identity than intended or may prevent applications from finding a * particular identity.</td> * </tr> * * <tr> * <th scope="row">addIdentityCertificate</th> * <td>Addition of a certificate for an Identity</td> * <td>This allows attackers to set a certificate for * an identity's public key. This is dangerous because it affects * the trust relationship across the system. This public key suddenly * becomes trusted to a wider audience than it otherwise would be.</td> * </tr> * * <tr> * <th scope="row">removeIdentityCertificate</th> * <td>Removal of a certificate for an Identity</td> * <td>This allows attackers to remove a certificate for * an identity's public key. This is dangerous because it affects * the trust relationship across the system. This public key suddenly * becomes considered less trustworthy than it otherwise would be.</td> * </tr> * * <tr> * <th scope="row">printIdentity</th> * <td>Viewing the name of a principal * and optionally the scope in which it is used, and whether * or not it is considered "trusted" in that scope</td> * <td>The scope that is printed out may be a filename, in which case * it may convey local system information. For example, here's a sample * printout of an identity named "carol", who is * marked not trusted in the user's identity database:<br> * carol[/home/luehe/identitydb.obj][not trusted]</td> *</tr> * * <tr> * <th scope="row">getSignerPrivateKey</th> * <td>Retrieval of a Signer's private key</td> * <td>It is very dangerous to allow access to a private key; private * keys are supposed to be kept secret. Otherwise, code can use the * private key to sign various files and claim the signature came from * the Signer.</td> * </tr> * * <tr> * <th scope="row">setSignerKeyPair</th> * <td>Setting of the key pair (public key and private key) for a Signer</td> * <td>This would allow an attacker to replace somebody else's (the "target's") * keypair with a possibly weaker keypair (e.g., a keypair of a smaller * keysize). This also would allow the attacker to listen in on encrypted * communication between the target and its peers. The target's peers * might wrap an encryption session key under the target's "new" public * key, which would allow the attacker (who possesses the corresponding * private key) to unwrap the session key and decipher the communication * data encrypted under that session key.</td> * </tr> * * </tbody> * </table> * * @implNote * Implementations may define additional target names, but should use naming * conventions such as reverse domain name notation to avoid name clashes. * * @see java.security.BasicPermission * @see java.security.Permission * @see java.security.Permissions * @see java.security.PermissionCollection * @see java.lang.SecurityManager * * * @author Marianne Mueller * @author Roland Schemers * @since 1.2 */ public final class SecurityPermission extends BasicPermission { private static final long serialVersionUID = 5236109936224050470L; /** * Creates a new SecurityPermission with the specified name. * The name is the symbolic name of the SecurityPermission. An asterisk * may appear at the end of the name, following a ".", or by itself, to * signify a wildcard match. * * @param name the name of the SecurityPermission * * @throws NullPointerException if {@code name} is {@code null}. * @throws IllegalArgumentException if {@code name} is empty. */ public SecurityPermission(String name) { super(name); } /** * Creates a new SecurityPermission object with the specified name. * The name is the symbolic name of the SecurityPermission, and the * actions String is currently unused and should be null. * * @param name the name of the SecurityPermission * @param actions should be null. * * @throws NullPointerException if {@code name} is {@code null}. * @throws IllegalArgumentException if {@code name} is empty. */ public SecurityPermission(String name, String actions) { super(name, actions); } }