Jared Krull

That's interesting because from my reading I'd thought that a security manager would not be installed on a standard application without that command line addidion. I tested my app without the command line options and wrote a custom Policy class, installing it before invoking the method in the loaded library and sure enough the security then worked fine. So I guess there must have been a seucrity manager present as you said.

14 years ago

Paul Clapham wrote:There was a security manager loaded, just not the one you thought was loaded.

Could you elaborate?

14 years ago

I just figured the problem - didnt load the security manager on the command line!

I needed to add this in and set a policy class giving the loading class the createClassLoader and other file based permissions.

All seems ok now.

Strange that the exception given didnt hint that the security manager wasnt loaded. It just denied access as if it were already loaded. Ah well.

14 years ago

I'm playing around with a custom class loader and granting permissions to the classes loaded (without a policy file)

I have the following class that sets up a custom permission and loads another class with that permission (The "getPermissions" override in my classloader adds this permission to the class being loaded).

Inside the loaded class I check for this permission but it always fails. I have overrided the "implies" method and it looks like the permissions are being checked and the function is returning true (meaning that the permission loaded does "imply" the one I am checking. Nevertheless, the call to AccessController.checkPermission throws an AccessControlException with "access denied".

Can someone kindly look through my code and tell me where I'm going wrong?

First my permission class

Now my loader class (and main entry point)

package testprotected;
import java.lang.reflect.InvocationTargetException;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLClassLoader;
import java.net.URLStreamHandlerFactory;
import java.security.CodeSource;
import java.security.PermissionCollection;
import java.lang.reflect.Method;
import java.util.logging.Level;
import java.util.logging.Logger;
class MyLoader extends URLClassLoader{
public MyLoader(URL[] urls, ClassLoader parent, URLStreamHandlerFactory factory) {
super(urls, parent, factory);
}
public MyLoader(URL[] urls) {
super(urls);
}
public MyLoader(URL[] urls, ClassLoader parent) {
super(urls, parent);
}
@Override
protected PermissionCollection getPermissions(CodeSource codesource) {
PermissionCollection perms = super.getPermissions(codesource);
MyPermission p = new MyPermission("fooby.runCode");
System.out.println(String.format("Permission granted: %s", p));
perms.add(p);
return perms;
}
}
public class Main {
public static void main(String[] args) {
try {
String path = "C:\\<PATH_TO_MY_LOADED_CLASS\\build\\classes\\";
URL[] urls = new URL[1];
urls[0] = new URL("file://" + path);
MyLoader load = new MyLoader(urls);
Class c = load.loadClass("fooby.Protected");
Object o = c.newInstance();
Method m = c.getMethod("doFoob", (Class [])null);
m.invoke(o, (Object []) null);
} catch (IllegalArgumentException ex) {
Logger.getLogger(Main.class.getName()).log(Level.SEVERE, null, ex);
} catch (InvocationTargetException ex) {
Logger.getLogger(Main.class.getName()).log(Level.SEVERE, null, ex);
} catch (NoSuchMethodException ex) {
Logger.getLogger(Main.class.getName()).log(Level.SEVERE, null, ex);
} catch (SecurityException ex) {
Logger.getLogger(Main.class.getName()).log(Level.SEVERE, null, ex);
} catch (InstantiationException ex) {
Logger.getLogger(Main.class.getName()).log(Level.SEVERE, null, ex);
} catch (IllegalAccessException ex) {
Logger.getLogger(Main.class.getName()).log(Level.SEVERE, null, ex);
} catch (ClassNotFoundException ex) {
Logger.getLogger(Main.class.getName()).log(Level.SEVERE, null, ex);
} catch (MalformedURLException ex) {
Logger.getLogger(Main.class.getName()).log(Level.SEVERE, null, ex);
}
}
}

Here's the class that is loaded and checks the permission

And here's the console output - as you can see the permissions look ok and implies returns true, but an exception is still caught.

Permission granted: (testprotected.MyPermission fooby.runCode)
Permission to check: (testprotected.MyPermission fooby.runCode)
Inside the implies method
This - Name:fooby.runCode - Hash:-1934868025
That - Name:fooby.runCode - Hash:-1934868025
Return from implies - true
Sorry, you dont have permission access denied (testprotected.MyPermission fooby.runCode)
Details (testprotected.MyPermission fooby.runCode)

Any help would be great.>

14 years ago

JAAS - NTSID to "friendly" name

I'm using JAAS to authenticate my app against an NT domain and would like to use my app to look through the different security groups associated with the user.

I create my LoginContext, then login, then looking through the returned Principal objects:

All's well so far but when the Principal is a group, the only data I can get is the SID reference (looks like "S-1-5-22-534") and not the name that is used to setup the group.

I'd like to find a way to resolve the SID to the actual name of the group.

Is that possible?

14 years ago

Rob Prime wrote:

Hector Floyd wrote:public class Accessor<T> { public Accessor(Class runtimeClass){} public List<T> getMultipleObjects(){} //.... } Accessor<Foobar> foo = new Accessor<Foobar>(Foobar.class);

Ugly.

Ugly and error prone. The constructor signature should be changed to this, should you still want to use this:
public Accessor(Class<T> runtimeClass)Possibly that class can be <? extends T>, but you definitely want to make it bound by T. Otherwise, the following would be allowed:
new Accessor<Foobar>(String.class);

Noted, though the example I gave was trying to show the inelegance of the method not how best it should be employed.

I've had a play with Guice and it seems to do just what I wanted. Thanks for that David Newton, your a lifesaver

15 years ago

David Newton wrote:I vaguely remember something about Guice 2.0 and the ability to reify type erased doodads--see Guice20. May not be what you want or need, but it's interesting.

Oooh..now that looks promising. I'll have a good play around with that!

Thanks guys.

15 years ago

Hector Floyd wrote:

Yeah... I know about type erasure, but does anyone have any suggestions on methods or patterns that work in Java to help deal with my problem?

Sometime last year, I looked into this. Trying to get info on T into runtime. And failed miserably.

You probably noticed that you can't instantiate based on T. You can't type check T. So, there is no way to figure T out. I couldn't even get info from reflection. At one point, I thought I got it as reflection did return generic type data, but that was for the upper and lower bounds.

Sorry,
Henry

Hmm...seems like to make my original idea work I might have to pass the type twice: one for compile time one for runtime, ala

Ugly.

15 years ago

There, name changed.

David Newton wrote:http://java.sun.com/docs/books/tutorial/java/generics/erasure.html

(And http://java.sun.com/j2se/1.5.0/docs/guide/language/generics.html)

Yeah... I know about type erasure, but does anyone have any suggestions on methods or patterns that work in Java to help deal with my problem?

15 years ago

I have a library that creates an manipulates lots of javabean based objects based on a mysql database (using IBatis).

Each type of object is created and has annotations that are accessible at runtime to give various string commands used to search, update, delete and add objects

I want to generalize manipulation of these objects to a specific class that will take the command annotations at runtime and provide typesafe methods for these commands.

Ideally, this Accessor class would harvest the command annotations at runtime and use them with the framework to manipulate objects. It uses generics to provide typesafe return types that I dont have to recast

The problem I have is that I cannot for the life of me work out how to access these annotations based on the "T" generic type. It seems that I cannot instantiate a class of type "T" or query its properties at runtime. The Generic benefits are locked at compile time and the annotations benefits are locked at runtime and trying to get them to work together is rather hard.

I'm more used to C++ Templates, so please forgive me if there's a simple answer to this.

15 years ago