8

How to enforce reflection security by not allow the Method, Field, Constructor object to call setAccessible(true) ? SecurityPolicy File or something else?

Normally for stand-alone Java applications there is no SecurityManager registered.

I using this System.setSecurityManager(new SecurityManager());

This approach will work for calling methods.

I would like to enforce the whole jar or client code that uses the jar is not allow to call setAccessible(true);

Any better approach ?

Thanks.

1 Answer 1

5

Um, it does work for setAccessible. See:

class A {
  private String method1() {
    return "Hello World!";
  }
}

and

import java.lang.reflect.Method;

class B {
  public static void main(String[] args) throws Exception {
    System.setSecurityManager(new SecurityManager());
    Class clazz = A.class;
    Method m = clazz.getDeclaredMethod("method1");
    m.setAccessible(true);
  }
}

Results in

Exception in thread "main" java.security.AccessControlException: access denied ("java.lang.reflect.ReflectPermission" "suppressAccessChecks")
        at java.security.AccessControlContext.checkPermission(Unknown Source)
        at java.security.AccessController.checkPermission(Unknown Source)
        at java.lang.SecurityManager.checkPermission(Unknown Source)
        at java.lang.reflect.AccessibleObject.setAccessible(Unknown Source)
        at B.main(B.java:8)

One reason it might've not worked for you is that according to comments in this post it didn't use to work in Java 1.5, but works in 6 and thereafter.


Edit: to deny it for specific jars, you need to either use a policy file, example:

// specific file
grant codeBase "file:/test/path/tools.jar" {
  // no permissions for this one
};

// default to giving all
grant {
  permission java.security.AllPermission;
};

There's two ways of specifying the policy file, either give it as additions to default, or give only those that are specified (source):

If you use

java -Djava.security.manager -Djava.security.policy==someURL SomeApp

(note the double equals) then just the specified policy file will be used; all the ones indicated in the security properties file will be ignored.

...or implement a custom security manager, which doesn't look that hard. Haven't done that myself though.

5
  • There seems to be another thread about the same subject, too.
    – eis
    Commented Feb 1, 2013 at 15:44
  • I want to enforce no calling to setAccessible method in my apps.
    – nicholas
    Commented Feb 5, 2013 at 6:24
  • @peterwkc yes, and I've answered that you can do that with SecurityManager?
    – eis
    Commented Feb 5, 2013 at 7:06
  • How to do that with SecurityManager ? u mean custom security manager ?
    – nicholas
    Commented Feb 7, 2013 at 8:35
  • @peterwkc no, using standard one, like in my example. but you'd need to use either a policy file or a custom security manager to deny it only for specific jar(s).
    – eis
    Commented Feb 7, 2013 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.