src/java.base/share/classes/sun/security/provider/PolicyFile.java
author weijun
Wed, 01 Aug 2018 13:35:08 +0800
changeset 51272 9d92ff04a29c
parent 50817 fa1e04811ff6
child 52427 3c6aa484536c
permissions -rw-r--r--
8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer Reviewed-by: xuelei
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     1
/*
48757
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
     2
 * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     3
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
90ce3da70b43 Initial load
duke
parents:
diff changeset
     4
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
     5
 * This code is free software; you can redistribute it and/or modify it
90ce3da70b43 Initial load
duke
parents:
diff changeset
     6
 * under the terms of the GNU General Public License version 2 only, as
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5194
diff changeset
     7
 * published by the Free Software Foundation.  Oracle designates this
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     8
 * particular file as subject to the "Classpath" exception as provided
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5194
diff changeset
     9
 * by Oracle in the LICENSE file that accompanied this code.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    10
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    11
 * This code is distributed in the hope that it will be useful, but WITHOUT
90ce3da70b43 Initial load
duke
parents:
diff changeset
    12
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    13
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
90ce3da70b43 Initial load
duke
parents:
diff changeset
    14
 * version 2 for more details (a copy is included in the LICENSE file that
90ce3da70b43 Initial load
duke
parents:
diff changeset
    15
 * accompanied this code).
90ce3da70b43 Initial load
duke
parents:
diff changeset
    16
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    17
 * You should have received a copy of the GNU General Public License version
90ce3da70b43 Initial load
duke
parents:
diff changeset
    18
 * 2 along with this work; if not, write to the Free Software Foundation,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    19
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    20
 *
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5194
diff changeset
    21
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5194
diff changeset
    22
 * or visit www.oracle.com if you need additional information or have any
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5194
diff changeset
    23
 * questions.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    24
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    25
90ce3da70b43 Initial load
duke
parents:
diff changeset
    26
package sun.security.provider;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    27
90ce3da70b43 Initial load
duke
parents:
diff changeset
    28
import java.io.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    29
import java.lang.reflect.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    30
import java.net.MalformedURLException;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    31
import java.net.URL;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    32
import java.net.URI;
49285
4d2e3f5abb48 8194746: (fs) Add equivalents of Paths.get to Path interface
bpb
parents: 49150
diff changeset
    33
import java.nio.file.Path;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    34
import java.util.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    35
import java.security.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    36
import java.security.cert.Certificate;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    37
import java.security.cert.X509Certificate;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    38
import javax.security.auth.Subject;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    39
import javax.security.auth.x500.X500Principal;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    40
import java.io.FilePermission;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    41
import java.net.SocketPermission;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    42
import java.net.NetPermission;
49864
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
    43
import java.util.concurrent.ConcurrentHashMap;
49588
ae568aefc5aa 8152821: Merge jdk.internal.misc.JavaSecurityAccess and jdk.internal.misc.JavaSecurityProtectionDomainAccess shared secrets
redestad
parents: 49285
diff changeset
    44
import jdk.internal.misc.JavaSecurityAccess;
ae568aefc5aa 8152821: Merge jdk.internal.misc.JavaSecurityAccess and jdk.internal.misc.JavaSecurityProtectionDomainAccess shared secrets
redestad
parents: 49285
diff changeset
    45
import static jdk.internal.misc.JavaSecurityAccess.ProtectionDomainCache;
32834
e1dca5fe4de3 8137056: Move SharedSecrets and interface friends out of sun.misc
chegar
parents: 31538
diff changeset
    46
import jdk.internal.misc.SharedSecrets;
50817
fa1e04811ff6 8066709: Make some JDK system properties read only
rriggs
parents: 49864
diff changeset
    47
import jdk.internal.util.StaticProperty;
41377
271ee055cb31 8164705: Remove pathname canonicalization from FilePermission
weijun
parents: 39884
diff changeset
    48
import sun.security.util.*;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    49
import sun.net.www.ParseUtil;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    50
90ce3da70b43 Initial load
duke
parents:
diff changeset
    51
/**
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    52
 * This class represents a default Policy implementation for the
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    53
 * "JavaPolicy" type.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    54
 *
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    55
 * <p> This object stores the policy for the entire Java runtime,
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    56
 * and is the amalgamation of multiple static policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
    57
 * configurations that resides in files.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    58
 * The algorithm for locating the policy file(s) and reading their
90ce3da70b43 Initial load
duke
parents:
diff changeset
    59
 * information into this <code>Policy</code> object is:
90ce3da70b43 Initial load
duke
parents:
diff changeset
    60
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    61
 * <ol>
90ce3da70b43 Initial load
duke
parents:
diff changeset
    62
 * <li>
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    63
 *   Read in and load the default policy file named
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    64
 *   &lt;JAVA_HOME&gt;/lib/security/default.policy. &lt;JAVA_HOME&gt; refers
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    65
 *   to the value of the java.home system property, and specifies the directory
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    66
 *   where the JRE is installed. This policy file grants permissions to the
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    67
 *   modules loaded by the platform class loader. If the default policy file
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    68
 *   cannot be loaded, a fatal InternalError is thrown as these permissions
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    69
 *   are needed in order for the runtime to operate correctly.
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    70
 * <li>
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    71
 *   Loop through the <code>java.security.Security</code> properties,
49150
a4a816f88e58 8191139: Remove deprecated javax.security.auth.Policy API
weijun
parents: 48757
diff changeset
    72
 *   and <i>policy.url.1</i>, <i>policy.url.2</i>, ...,
a4a816f88e58 8191139: Remove deprecated javax.security.auth.Policy API
weijun
parents: 48757
diff changeset
    73
 *   <i>policy.url.X</i>".  These properties are set
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    74
 *   in the Java security properties file, which is located in the file named
27565
729f9700483a 8049367: Modular Run-Time Images
chegar
parents: 25859
diff changeset
    75
 *   &lt;JAVA_HOME&gt;/conf/security/java.security.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    76
 *   Each property value specifies a <code>URL</code> pointing to a
90ce3da70b43 Initial load
duke
parents:
diff changeset
    77
 *   policy file to be loaded.  Read in and load each policy.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    78
 *
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    79
 *   If none of these could be loaded, use a builtin static policy
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    80
 *   equivalent to the conf/security/java.policy file.
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    81
 *
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    82
 * <li>
90ce3da70b43 Initial load
duke
parents:
diff changeset
    83
 *   The <code>java.lang.System</code> property <i>java.security.policy</i>
90ce3da70b43 Initial load
duke
parents:
diff changeset
    84
 *   may also be set to a <code>URL</code> pointing to another policy file
90ce3da70b43 Initial load
duke
parents:
diff changeset
    85
 *   (which is the case when a user uses the -D switch at runtime).
90ce3da70b43 Initial load
duke
parents:
diff changeset
    86
 *   If this property is defined, and its use is allowed by the
90ce3da70b43 Initial load
duke
parents:
diff changeset
    87
 *   security property file (the Security property,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    88
 *   <i>policy.allowSystemProperty</i> is set to <i>true</i>),
90ce3da70b43 Initial load
duke
parents:
diff changeset
    89
 *   also load that policy.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    90
 *
49150
a4a816f88e58 8191139: Remove deprecated javax.security.auth.Policy API
weijun
parents: 48757
diff changeset
    91
 *   If the <i>java.security.policy</i> property is defined using
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    92
 *   "==" (rather than "="), then load the specified policy file and ignore
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    93
 *   all other configured policies. Note, that the default.policy file is
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    94
 *   also loaded, as specified in the first step of the algorithm above.
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    95
 *   If the specified policy file cannot be loaded, use a builtin static policy
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
    96
 *   equivalent to the default conf/security/java.policy file.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    97
 * </ol>
90ce3da70b43 Initial load
duke
parents:
diff changeset
    98
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    99
 * Each policy file consists of one or more grant entries, each of
90ce3da70b43 Initial load
duke
parents:
diff changeset
   100
 * which consists of a number of permission entries.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   101
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   102
 * <pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   103
 *   grant signedBy "<b>alias</b>", codeBase "<b>URL</b>",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   104
 *         principal <b>principalClass</b> "<b>principalName</b>",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   105
 *         principal <b>principalClass</b> "<b>principalName</b>",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   106
 *         ... {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   107
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   108
 *     permission <b>Type</b> "<b>name</b> "<b>action</b>",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   109
 *         signedBy "<b>alias</b>";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   110
 *     permission <b>Type</b> "<b>name</b> "<b>action</b>",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   111
 *         signedBy "<b>alias</b>";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   112
 *     ....
90ce3da70b43 Initial load
duke
parents:
diff changeset
   113
 *   };
90ce3da70b43 Initial load
duke
parents:
diff changeset
   114
 * </pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   115
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   116
 * All non-bold items above must appear as is (although case
90ce3da70b43 Initial load
duke
parents:
diff changeset
   117
 * doesn't matter and some are optional, as noted below).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   118
 * principal entries are optional and need not be present.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   119
 * Italicized items represent variable values.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   120
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   121
 * <p> A grant entry must begin with the word <code>grant</code>.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   122
 * The <code>signedBy</code>,<code>codeBase</code> and <code>principal</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   123
 * name/value pairs are optional.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   124
 * If they are not present, then any signer (including unsigned code)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   125
 * will match, and any codeBase will match.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   126
 * Note that the <i>principalClass</i>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   127
 * may be set to the wildcard value, *, which allows it to match
90ce3da70b43 Initial load
duke
parents:
diff changeset
   128
 * any <code>Principal</code> class.  In addition, the <i>principalName</i>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   129
 * may also be set to the wildcard value, *, allowing it to match
90ce3da70b43 Initial load
duke
parents:
diff changeset
   130
 * any <code>Principal</code> name.  When setting the <i>principalName</i>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   131
 * to the *, do not surround the * with quotes.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   132
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   133
 * <p> A permission entry must begin with the word <code>permission</code>.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   134
 * The word <code><i>Type</i></code> in the template above is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   135
 * a specific permission type, such as <code>java.io.FilePermission</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   136
 * or <code>java.lang.RuntimePermission</code>.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   137
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   138
 * <p> The "<i>action</i>" is required for
90ce3da70b43 Initial load
duke
parents:
diff changeset
   139
 * many permission types, such as <code>java.io.FilePermission</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   140
 * (where it specifies what type of file access that is permitted).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   141
 * It is not required for categories such as
90ce3da70b43 Initial load
duke
parents:
diff changeset
   142
 * <code>java.lang.RuntimePermission</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   143
 * where it is not necessary - you either have the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   144
 * permission specified by the <code>"<i>name</i>"</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   145
 * value following the type name or you don't.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   146
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   147
 * <p> The <code>signedBy</code> name/value pair for a permission entry
90ce3da70b43 Initial load
duke
parents:
diff changeset
   148
 * is optional. If present, it indicates a signed permission. That is,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   149
 * the permission class itself must be signed by the given alias in
90ce3da70b43 Initial load
duke
parents:
diff changeset
   150
 * order for it to be granted. For example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   151
 * suppose you have the following grant entry:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   152
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   153
 * <pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   154
 *   grant principal foo.com.Principal "Duke" {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   155
 *     permission Foo "foobar", signedBy "FooSoft";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   156
 *   }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   157
 * </pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   158
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   159
 * <p> Then this permission of type <i>Foo</i> is granted if the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   160
 * <code>Foo.class</code> permission has been signed by the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   161
 * "FooSoft" alias, or if XXX <code>Foo.class</code> is a
90ce3da70b43 Initial load
duke
parents:
diff changeset
   162
 * system class (i.e., is found on the CLASSPATH).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   163
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   164
 * <p> Items that appear in an entry must appear in the specified order
90ce3da70b43 Initial load
duke
parents:
diff changeset
   165
 * (<code>permission</code>, <i>Type</i>, "<i>name</i>", and
90ce3da70b43 Initial load
duke
parents:
diff changeset
   166
 * "<i>action</i>"). An entry is terminated with a semicolon.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   167
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   168
 * <p> Case is unimportant for the identifiers (<code>permission</code>,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   169
 * <code>signedBy</code>, <code>codeBase</code>, etc.) but is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   170
 * significant for the <i>Type</i>
30374
2abaf49910ea 8079478: some docs cleanup for sun.security
avstepan
parents: 28059
diff changeset
   171
 * or for any string that is passed in as a value.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   172
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   173
 * <p> An example of two entries in a policy configuration file is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   174
 * <pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   175
 *   // if the code is comes from "foo.com" and is running as "Duke",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   176
 *   // grant it read/write to all files in /tmp.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   177
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   178
 *   grant codeBase "foo.com", principal foo.com.Principal "Duke" {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   179
 *              permission java.io.FilePermission "/tmp/*", "read,write";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   180
 *   };
90ce3da70b43 Initial load
duke
parents:
diff changeset
   181
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   182
 *   // grant any code running as "Duke" permission to read
90ce3da70b43 Initial load
duke
parents:
diff changeset
   183
 *   // the "java.vendor" Property.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   184
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   185
 *   grant principal foo.com.Principal "Duke" {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   186
 *         permission java.util.PropertyPermission "java.vendor";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   187
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   188
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   189
 * </pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   190
 *  This Policy implementation supports special handling of any
90ce3da70b43 Initial load
duke
parents:
diff changeset
   191
 *  permission that contains the string, "<b>${{self}}</b>", as part of
90ce3da70b43 Initial load
duke
parents:
diff changeset
   192
 *  its target name.  When such a permission is evaluated
90ce3da70b43 Initial load
duke
parents:
diff changeset
   193
 *  (such as during a security check), <b>${{self}}</b> is replaced
90ce3da70b43 Initial load
duke
parents:
diff changeset
   194
 *  with one or more Principal class/name pairs.  The exact
90ce3da70b43 Initial load
duke
parents:
diff changeset
   195
 *  replacement performed depends upon the contents of the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   196
 *  grant clause to which the permission belongs.
30374
2abaf49910ea 8079478: some docs cleanup for sun.security
avstepan
parents: 28059
diff changeset
   197
 * <p>
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   198
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   199
 *  If the grant clause does not contain any principal information,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   200
 *  the permission will be ignored (permissions containing
90ce3da70b43 Initial load
duke
parents:
diff changeset
   201
 *  <b>${{self}}</b> in their target names are only valid in the context
90ce3da70b43 Initial load
duke
parents:
diff changeset
   202
 *  of a principal-based grant clause).  For example, BarPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   203
 *  will always be ignored in the following grant clause:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   204
 *
30374
2abaf49910ea 8079478: some docs cleanup for sun.security
avstepan
parents: 28059
diff changeset
   205
 * <pre>
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   206
 *    grant codebase "www.foo.com", signedby "duke" {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   207
 *      permission BarPermission "... ${{self}} ...";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   208
 *    };
30374
2abaf49910ea 8079478: some docs cleanup for sun.security
avstepan
parents: 28059
diff changeset
   209
 * </pre>
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   210
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   211
 *  If the grant clause contains principal information, <b>${{self}}</b>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   212
 *  will be replaced with that same principal information.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   213
 *  For example, <b>${{self}}</b> in BarPermission will be replaced by
90ce3da70b43 Initial load
duke
parents:
diff changeset
   214
 *  <b>javax.security.auth.x500.X500Principal "cn=Duke"</b>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   215
 *  in the following grant clause:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   216
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   217
 *  <pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   218
 *    grant principal javax.security.auth.x500.X500Principal "cn=Duke" {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   219
 *      permission BarPermission "... ${{self}} ...";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   220
 *    };
90ce3da70b43 Initial load
duke
parents:
diff changeset
   221
 *  </pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   222
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   223
 *  If there is a comma-separated list of principals in the grant
90ce3da70b43 Initial load
duke
parents:
diff changeset
   224
 *  clause, then <b>${{self}}</b> will be replaced by the same
90ce3da70b43 Initial load
duke
parents:
diff changeset
   225
 *  comma-separated list or principals.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   226
 *  In the case where both the principal class and name are
90ce3da70b43 Initial load
duke
parents:
diff changeset
   227
 *  wildcarded in the grant clause, <b>${{self}}</b> is replaced
90ce3da70b43 Initial load
duke
parents:
diff changeset
   228
 *  with all the principals associated with the <code>Subject</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   229
 *  in the current <code>AccessControlContext</code>.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   230
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   231
 * <p> For PrivateCredentialPermissions, you can also use "<b>self</b>"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   232
 * instead of "<b>${{self}}</b>". However the use of "<b>self</b>" is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   233
 * deprecated in favour of "<b>${{self}}</b>".
90ce3da70b43 Initial load
duke
parents:
diff changeset
   234
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   235
 * @see java.security.CodeSource
90ce3da70b43 Initial load
duke
parents:
diff changeset
   236
 * @see java.security.Permissions
90ce3da70b43 Initial load
duke
parents:
diff changeset
   237
 * @see java.security.ProtectionDomain
90ce3da70b43 Initial load
duke
parents:
diff changeset
   238
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   239
public class PolicyFile extends java.security.Policy {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   240
90ce3da70b43 Initial load
duke
parents:
diff changeset
   241
    private static final Debug debug = Debug.getInstance("policy");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   242
90ce3da70b43 Initial load
duke
parents:
diff changeset
   243
    private static final String SELF = "${{self}}";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   244
    private static final String X500PRINCIPAL =
90ce3da70b43 Initial load
duke
parents:
diff changeset
   245
                        "javax.security.auth.x500.X500Principal";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   246
    private static final String POLICY = "java.security.policy";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   247
    private static final String POLICY_URL = "policy.url.";
90ce3da70b43 Initial load
duke
parents:
diff changeset
   248
90ce3da70b43 Initial load
duke
parents:
diff changeset
   249
    private static final int DEFAULT_CACHE_SIZE = 1;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   250
90ce3da70b43 Initial load
duke
parents:
diff changeset
   251
    // contains the policy grant entries, PD cache, and alias mapping
49864
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
   252
    // can be updated if refresh() is called
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
   253
    private volatile PolicyInfo policyInfo;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   254
90ce3da70b43 Initial load
duke
parents:
diff changeset
   255
    private boolean expandProperties = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   256
    private boolean allowSystemProperties = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   257
    private boolean notUtf8 = false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   258
    private URL url;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   259
90ce3da70b43 Initial load
duke
parents:
diff changeset
   260
    // for use with the reflection API
22041
3638966a5c02 8030082: Fix raw types lint warnings, etc. in various sun.security libraries
darcy
parents: 16046
diff changeset
   261
    private static final Class<?>[] PARAMS0 = { };
3638966a5c02 8030082: Fix raw types lint warnings, etc. in various sun.security libraries
darcy
parents: 16046
diff changeset
   262
    private static final Class<?>[] PARAMS1 = { String.class };
3638966a5c02 8030082: Fix raw types lint warnings, etc. in various sun.security libraries
darcy
parents: 16046
diff changeset
   263
    private static final Class<?>[] PARAMS2 = { String.class, String.class };
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   264
90ce3da70b43 Initial load
duke
parents:
diff changeset
   265
    /**
38324
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   266
     * When a policy file has a syntax error, the exception code may generate
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   267
     * another permission check and this can cause the policy file to be parsed
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   268
     * repeatedly, leading to a StackOverflowError or ClassCircularityError.
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   269
     * To avoid this, this set is populated with policy files that have been
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   270
     * previously parsed and have syntax errors, so that they can be
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   271
     * subsequently ignored.
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   272
     */
49864
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
   273
    private static Set<URL> badPolicyURLs =
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
   274
        Collections.newSetFromMap(new ConcurrentHashMap<URL,Boolean>());
38324
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   275
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   276
    // The default.policy file
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   277
    private static final URL DEFAULT_POLICY_URL =
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   278
        AccessController.doPrivileged(new PrivilegedAction<>() {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   279
            @Override
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   280
            public URL run() {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   281
                String sep = File.separator;
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   282
                try {
50817
fa1e04811ff6 8066709: Make some JDK system properties read only
rriggs
parents: 49864
diff changeset
   283
                    return Path.of(StaticProperty.javaHome(),
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   284
                                     "lib", "security",
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   285
                                     "default.policy").toUri().toURL();
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   286
                } catch (MalformedURLException mue) {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   287
                    // should not happen
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   288
                    throw new Error("Malformed default.policy URL: " + mue);
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   289
                }
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   290
            }
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   291
        });
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   292
38324
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   293
    /**
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   294
     * Initializes the Policy object and reads the default policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   295
     * configuration file(s) into the Policy object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   296
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   297
    public PolicyFile() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   298
        init((URL)null);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   299
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   300
90ce3da70b43 Initial load
duke
parents:
diff changeset
   301
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   302
     * Initializes the Policy object and reads the default policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   303
     * from the specified URL only.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   304
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   305
    public PolicyFile(URL url) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   306
        this.url = url;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   307
        init(url);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   308
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   309
90ce3da70b43 Initial load
duke
parents:
diff changeset
   310
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   311
     * Initializes the Policy object and reads the default policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   312
     * configuration file(s) into the Policy object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   313
     *
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   314
     * See the class description for details on the algorithm used to
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   315
     * initialize the Policy object.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   316
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   317
    private void init(URL url) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   318
        // Properties are set once for each init(); ignore changes between
90ce3da70b43 Initial load
duke
parents:
diff changeset
   319
        // between diff invocations of initPolicyFile(policy, url, info).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   320
        String numCacheStr =
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   321
          AccessController.doPrivileged(new PrivilegedAction<>() {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   322
            @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   323
            public String run() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   324
                expandProperties = "true".equalsIgnoreCase
90ce3da70b43 Initial load
duke
parents:
diff changeset
   325
                    (Security.getProperty("policy.expandProperties"));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   326
                allowSystemProperties = "true".equalsIgnoreCase
90ce3da70b43 Initial load
duke
parents:
diff changeset
   327
                    (Security.getProperty("policy.allowSystemProperty"));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   328
                notUtf8 = "false".equalsIgnoreCase
90ce3da70b43 Initial load
duke
parents:
diff changeset
   329
                    (System.getProperty("sun.security.policy.utf8"));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   330
                return System.getProperty("sun.security.policy.numcaches");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   331
            }});
90ce3da70b43 Initial load
duke
parents:
diff changeset
   332
90ce3da70b43 Initial load
duke
parents:
diff changeset
   333
        int numCaches;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   334
        if (numCacheStr != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   335
            try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   336
                numCaches = Integer.parseInt(numCacheStr);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   337
            } catch (NumberFormatException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   338
                numCaches = DEFAULT_CACHE_SIZE;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   339
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   340
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   341
            numCaches = DEFAULT_CACHE_SIZE;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   342
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   343
        // System.out.println("number caches=" + numCaches);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   344
        PolicyInfo newInfo = new PolicyInfo(numCaches);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   345
        initPolicyFile(newInfo, url);
49864
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
   346
        policyInfo = newInfo;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   347
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   348
90ce3da70b43 Initial load
duke
parents:
diff changeset
   349
    private void initPolicyFile(final PolicyInfo newInfo, final URL url) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   350
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   351
        // always load default.policy
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   352
        if (debug != null) {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   353
            debug.println("reading " + DEFAULT_POLICY_URL);
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   354
        }
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   355
        AccessController.doPrivileged(new PrivilegedAction<>() {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   356
            @Override
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   357
            public Void run() {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   358
                init(DEFAULT_POLICY_URL, newInfo, true);
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   359
                return null;
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   360
            }
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   361
        });
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   362
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   363
        if (url != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   364
90ce3da70b43 Initial load
duke
parents:
diff changeset
   365
            /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   366
             * If the caller specified a URL via Policy.getInstance,
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   367
             * we only read from default.policy and that URL.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   368
             */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   369
90ce3da70b43 Initial load
duke
parents:
diff changeset
   370
            if (debug != null) {
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   371
                debug.println("reading " + url);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   372
            }
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   373
            AccessController.doPrivileged(new PrivilegedAction<>() {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   374
                @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   375
                public Void run() {
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   376
                    if (init(url, newInfo, false) == false) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   377
                        // use static policy if all else fails
90ce3da70b43 Initial load
duke
parents:
diff changeset
   378
                        initStaticPolicy(newInfo);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   379
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   380
                    return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   381
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   382
            });
90ce3da70b43 Initial load
duke
parents:
diff changeset
   383
90ce3da70b43 Initial load
duke
parents:
diff changeset
   384
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   385
90ce3da70b43 Initial load
duke
parents:
diff changeset
   386
            /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   387
             * Caller did not specify URL via Policy.getInstance.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   388
             * Read from URLs listed in the java.security properties file.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   389
             */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   390
90ce3da70b43 Initial load
duke
parents:
diff changeset
   391
            boolean loaded_one = initPolicyFile(POLICY, POLICY_URL, newInfo);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   392
            // To maintain strict backward compatibility
90ce3da70b43 Initial load
duke
parents:
diff changeset
   393
            // we load the static policy only if POLICY load failed
90ce3da70b43 Initial load
duke
parents:
diff changeset
   394
            if (!loaded_one) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   395
                // use static policy if all else fails
90ce3da70b43 Initial load
duke
parents:
diff changeset
   396
                initStaticPolicy(newInfo);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   397
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   398
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   399
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   400
90ce3da70b43 Initial load
duke
parents:
diff changeset
   401
    private boolean initPolicyFile(final String propname, final String urlname,
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   402
                                   final PolicyInfo newInfo) {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   403
        boolean loadedPolicy =
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   404
            AccessController.doPrivileged(new PrivilegedAction<>() {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   405
            @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   406
            public Boolean run() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   407
                boolean loaded_policy = false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   408
90ce3da70b43 Initial load
duke
parents:
diff changeset
   409
                if (allowSystemProperties) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   410
                    String extra_policy = System.getProperty(propname);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   411
                    if (extra_policy != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   412
                        boolean overrideAll = false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   413
                        if (extra_policy.startsWith("=")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   414
                            overrideAll = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   415
                            extra_policy = extra_policy.substring(1);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   416
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   417
                        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   418
                            extra_policy =
90ce3da70b43 Initial load
duke
parents:
diff changeset
   419
                                PropertyExpander.expand(extra_policy);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   420
                            URL policyURL;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   421
90ce3da70b43 Initial load
duke
parents:
diff changeset
   422
                            File policyFile = new File(extra_policy);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   423
                            if (policyFile.exists()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   424
                                policyURL = ParseUtil.fileToEncodedURL
90ce3da70b43 Initial load
duke
parents:
diff changeset
   425
                                    (new File(policyFile.getCanonicalPath()));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   426
                            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   427
                                policyURL = new URL(extra_policy);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   428
                            }
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   429
                            if (debug != null) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   430
                                debug.println("reading "+policyURL);
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   431
                            }
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   432
                            if (init(policyURL, newInfo, false)) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   433
                                loaded_policy = true;
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   434
                            }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   435
                        } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   436
                            // ignore.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   437
                            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   438
                                debug.println("caught exception: "+e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   439
                            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   440
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   441
                        if (overrideAll) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   442
                            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   443
                                debug.println("overriding other policies!");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   444
                            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   445
                            return Boolean.valueOf(loaded_policy);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   446
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   447
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   448
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   449
90ce3da70b43 Initial load
duke
parents:
diff changeset
   450
                int n = 1;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   451
                String policy_uri;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   452
90ce3da70b43 Initial load
duke
parents:
diff changeset
   453
                while ((policy_uri = Security.getProperty(urlname+n)) != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   454
                    try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   455
                        URL policy_url = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   456
                        String expanded_uri = PropertyExpander.expand
90ce3da70b43 Initial load
duke
parents:
diff changeset
   457
                                (policy_uri).replace(File.separatorChar, '/');
90ce3da70b43 Initial load
duke
parents:
diff changeset
   458
90ce3da70b43 Initial load
duke
parents:
diff changeset
   459
                        if (policy_uri.startsWith("file:${java.home}/") ||
90ce3da70b43 Initial load
duke
parents:
diff changeset
   460
                            policy_uri.startsWith("file:${user.home}/")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   461
90ce3da70b43 Initial load
duke
parents:
diff changeset
   462
                            // this special case accommodates
90ce3da70b43 Initial load
duke
parents:
diff changeset
   463
                            // the situation java.home/user.home
90ce3da70b43 Initial load
duke
parents:
diff changeset
   464
                            // expand to a single slash, resulting in
90ce3da70b43 Initial load
duke
parents:
diff changeset
   465
                            // a file://foo URI
90ce3da70b43 Initial load
duke
parents:
diff changeset
   466
                            policy_url = new File
90ce3da70b43 Initial load
duke
parents:
diff changeset
   467
                                (expanded_uri.substring(5)).toURI().toURL();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   468
                        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   469
                            policy_url = new URI(expanded_uri).toURL();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   470
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   471
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   472
                        if (debug != null) {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   473
                            debug.println("reading " + policy_url);
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   474
                        }
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   475
                        if (init(policy_url, newInfo, false)) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   476
                            loaded_policy = true;
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   477
                        }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   478
                    } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   479
                        if (debug != null) {
48080
18a4438eb690 8185855: Debug exception stacks should be clearer
coffeys
parents: 47478
diff changeset
   480
                            debug.println(
18a4438eb690 8185855: Debug exception stacks should be clearer
coffeys
parents: 47478
diff changeset
   481
                                "Debug info only. Error reading policy " +e);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   482
                            e.printStackTrace();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   483
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   484
                        // ignore that policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   485
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   486
                    n++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   487
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   488
                return Boolean.valueOf(loaded_policy);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   489
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   490
        });
90ce3da70b43 Initial load
duke
parents:
diff changeset
   491
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   492
        return loadedPolicy;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   493
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   494
90ce3da70b43 Initial load
duke
parents:
diff changeset
   495
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   496
     * Reads a policy configuration into the Policy object using a
90ce3da70b43 Initial load
duke
parents:
diff changeset
   497
     * Reader object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   498
     */
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   499
    private boolean init(URL policy, PolicyInfo newInfo, boolean defPolicy) {
38324
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   500
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   501
        // skip parsing policy file if it has been previously parsed and
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   502
        // has syntax errors
49864
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
   503
        if (badPolicyURLs.contains(policy)) {
38324
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   504
            if (debug != null) {
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   505
                debug.println("skipping bad policy file: " + policy);
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   506
            }
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   507
            return false;
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   508
        }
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   509
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   510
        try (InputStreamReader isr =
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   511
                 getInputStreamReader(PolicyUtil.getInputStream(policy))) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   512
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   513
            PolicyParser pp = new PolicyParser(expandProperties);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   514
            pp.read(isr);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   515
90ce3da70b43 Initial load
duke
parents:
diff changeset
   516
            KeyStore keyStore = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   517
            try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   518
                keyStore = PolicyUtil.getKeyStore
90ce3da70b43 Initial load
duke
parents:
diff changeset
   519
                                (policy,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   520
                                pp.getKeyStoreUrl(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   521
                                pp.getKeyStoreType(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   522
                                pp.getKeyStoreProvider(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   523
                                pp.getStorePassURL(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   524
                                debug);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   525
            } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   526
                // ignore, treat it like we have no keystore
90ce3da70b43 Initial load
duke
parents:
diff changeset
   527
                if (debug != null) {
48080
18a4438eb690 8185855: Debug exception stacks should be clearer
coffeys
parents: 47478
diff changeset
   528
                    debug.println("Debug info only. Ignoring exception.");
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   529
                    e.printStackTrace();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   530
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   531
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   532
90ce3da70b43 Initial load
duke
parents:
diff changeset
   533
            Enumeration<PolicyParser.GrantEntry> enum_ = pp.grantElements();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   534
            while (enum_.hasMoreElements()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   535
                PolicyParser.GrantEntry ge = enum_.nextElement();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   536
                addGrantEntry(ge, keyStore, newInfo);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   537
            }
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   538
            return true;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   539
        } catch (PolicyParser.ParsingException pe) {
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   540
            if (defPolicy) {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   541
                throw new InternalError("Failed to load default.policy", pe);
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   542
            }
38324
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   543
            // record bad policy file to avoid later reparsing it
49864
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
   544
            badPolicyURLs.add(policy);
48757
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
   545
            Object[] source = {policy, pe.getNonlocalizedMessage()};
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
   546
            System.err.println(LocalizedMessage.getNonlocalized
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   547
                (POLICY + ".error.parsing.policy.message", source));
38324
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   548
            if (debug != null) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   549
                pe.printStackTrace();
38324
1ecea77815a8 8150468: ClassCircularityError on error in security policy file
mullan
parents: 36511
diff changeset
   550
            }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   551
        } catch (Exception e) {
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   552
            if (defPolicy) {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   553
                throw new InternalError("Failed to load default.policy", e);
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   554
            }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   555
            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   556
                debug.println("error parsing "+policy);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   557
                debug.println(e.toString());
90ce3da70b43 Initial load
duke
parents:
diff changeset
   558
                e.printStackTrace();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   559
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   560
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   561
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   562
        return false;
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   563
    }
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   564
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   565
    private InputStreamReader getInputStreamReader(InputStream is)
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   566
                              throws IOException {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   567
        /*
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   568
         * Read in policy using UTF-8 by default.
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   569
         *
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   570
         * Check non-standard system property to see if the default encoding
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   571
         * should be used instead.
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   572
         */
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   573
        return (notUtf8)
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   574
            ? new InputStreamReader(is)
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   575
            : new InputStreamReader(is, "UTF-8");
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   576
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   577
90ce3da70b43 Initial load
duke
parents:
diff changeset
   578
    private void initStaticPolicy(final PolicyInfo newInfo) {
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   579
        if (debug != null) {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   580
            debug.println("Initializing with static permissions");
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   581
        }
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   582
        AccessController.doPrivileged(new PrivilegedAction<>() {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
   583
            @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   584
            public Void run() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   585
                PolicyEntry pe = new PolicyEntry(new CodeSource(null,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   586
                    (Certificate[]) null));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   587
                pe.add(SecurityConstants.LOCAL_LISTEN_PERMISSION);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   588
                pe.add(new PropertyPermission("java.version",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   589
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   590
                pe.add(new PropertyPermission("java.vendor",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   591
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   592
                pe.add(new PropertyPermission("java.vendor.url",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   593
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   594
                pe.add(new PropertyPermission("java.class.version",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   595
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   596
                pe.add(new PropertyPermission("os.name",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   597
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   598
                pe.add(new PropertyPermission("os.version",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   599
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   600
                pe.add(new PropertyPermission("os.arch",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   601
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   602
                pe.add(new PropertyPermission("file.separator",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   603
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   604
                pe.add(new PropertyPermission("path.separator",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   605
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   606
                pe.add(new PropertyPermission("line.separator",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   607
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   608
                pe.add(new PropertyPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   609
                                ("java.specification.version",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   610
                                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   611
                pe.add(new PropertyPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   612
                                ("java.specification.vendor",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   613
                                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   614
                pe.add(new PropertyPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   615
                                ("java.specification.name",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   616
                                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   617
                pe.add(new PropertyPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   618
                                ("java.vm.specification.version",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   619
                                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   620
                pe.add(new PropertyPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   621
                                ("java.vm.specification.vendor",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   622
                                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   623
                pe.add(new PropertyPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   624
                                ("java.vm.specification.name",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   625
                                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   626
                pe.add(new PropertyPermission("java.vm.version",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   627
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   628
                pe.add(new PropertyPermission("java.vm.vendor",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   629
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   630
                pe.add(new PropertyPermission("java.vm.name",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   631
                    SecurityConstants.PROPERTY_READ_ACTION));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   632
90ce3da70b43 Initial load
duke
parents:
diff changeset
   633
                // No need to sync because noone has access to newInfo yet
90ce3da70b43 Initial load
duke
parents:
diff changeset
   634
                newInfo.policyEntries.add(pe);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   635
90ce3da70b43 Initial load
duke
parents:
diff changeset
   636
                return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   637
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   638
        });
90ce3da70b43 Initial load
duke
parents:
diff changeset
   639
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   640
90ce3da70b43 Initial load
duke
parents:
diff changeset
   641
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   642
     * Given a GrantEntry, create a codeSource.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   643
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   644
     * @return null if signedBy alias is not recognized
90ce3da70b43 Initial load
duke
parents:
diff changeset
   645
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   646
    private CodeSource getCodeSource(PolicyParser.GrantEntry ge, KeyStore keyStore,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   647
        PolicyInfo newInfo) throws java.net.MalformedURLException
90ce3da70b43 Initial load
duke
parents:
diff changeset
   648
    {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   649
        Certificate[] certs = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   650
        if (ge.signedBy != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   651
            certs = getCertificates(keyStore, ge.signedBy, newInfo);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   652
            if (certs == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   653
                // we don't have a key for this alias,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   654
                // just return
90ce3da70b43 Initial load
duke
parents:
diff changeset
   655
                if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   656
                    debug.println("  -- No certs for alias '" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
   657
                                       ge.signedBy + "' - ignoring entry");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   658
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   659
                return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   660
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   661
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   662
90ce3da70b43 Initial load
duke
parents:
diff changeset
   663
        URL location;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   664
90ce3da70b43 Initial load
duke
parents:
diff changeset
   665
        if (ge.codeBase != null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   666
            location = new URL(ge.codeBase);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   667
        else
90ce3da70b43 Initial load
duke
parents:
diff changeset
   668
            location = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   669
90ce3da70b43 Initial load
duke
parents:
diff changeset
   670
        return (canonicalizeCodebase(new CodeSource(location, certs),false));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   671
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   672
90ce3da70b43 Initial load
duke
parents:
diff changeset
   673
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   674
     * Add one policy entry to the list.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   675
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   676
    private void addGrantEntry(PolicyParser.GrantEntry ge,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   677
                               KeyStore keyStore, PolicyInfo newInfo) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   678
90ce3da70b43 Initial load
duke
parents:
diff changeset
   679
        if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   680
            debug.println("Adding policy entry: ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   681
            debug.println("  signedBy " + ge.signedBy);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   682
            debug.println("  codeBase " + ge.codeBase);
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
   683
            if (ge.principals != null) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
   684
                for (PolicyParser.PrincipalEntry pppe : ge.principals) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
   685
                    debug.println("  " + pppe.toString());
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   686
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   687
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   688
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   689
90ce3da70b43 Initial load
duke
parents:
diff changeset
   690
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   691
            CodeSource codesource = getCodeSource(ge, keyStore, newInfo);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   692
            // skip if signedBy alias was unknown...
90ce3da70b43 Initial load
duke
parents:
diff changeset
   693
            if (codesource == null) return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   694
90ce3da70b43 Initial load
duke
parents:
diff changeset
   695
            // perform keystore alias principal replacement.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   696
            // for example, if alias resolves to X509 certificate,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   697
            // replace principal with:  <X500Principal class>  <SubjectDN>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   698
            // -- skip if alias is unknown
90ce3da70b43 Initial load
duke
parents:
diff changeset
   699
            if (replacePrincipals(ge.principals, keyStore) == false)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   700
                return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   701
            PolicyEntry entry = new PolicyEntry(codesource, ge.principals);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   702
            Enumeration<PolicyParser.PermissionEntry> enum_ =
90ce3da70b43 Initial load
duke
parents:
diff changeset
   703
                                                ge.permissionElements();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   704
            while (enum_.hasMoreElements()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   705
                PolicyParser.PermissionEntry pe = enum_.nextElement();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   706
90ce3da70b43 Initial load
duke
parents:
diff changeset
   707
                try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   708
                    // perform ${{ ... }} expansions within permission name
90ce3da70b43 Initial load
duke
parents:
diff changeset
   709
                    expandPermissionName(pe, keyStore);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   710
90ce3da70b43 Initial load
duke
parents:
diff changeset
   711
                    // XXX special case PrivateCredentialPermission-SELF
90ce3da70b43 Initial load
duke
parents:
diff changeset
   712
                    Permission perm;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   713
                    if (pe.permission.equals
90ce3da70b43 Initial load
duke
parents:
diff changeset
   714
                        ("javax.security.auth.PrivateCredentialPermission") &&
90ce3da70b43 Initial load
duke
parents:
diff changeset
   715
                        pe.name.endsWith(" self")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   716
                        pe.name = pe.name.substring(0, pe.name.indexOf("self"))
90ce3da70b43 Initial load
duke
parents:
diff changeset
   717
                                + SELF;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   718
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   719
                    // check for self
90ce3da70b43 Initial load
duke
parents:
diff changeset
   720
                    if (pe.name != null && pe.name.indexOf(SELF) != -1) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   721
                        // Create a "SelfPermission" , it could be an
90ce3da70b43 Initial load
duke
parents:
diff changeset
   722
                        // an unresolved permission which will be resolved
90ce3da70b43 Initial load
duke
parents:
diff changeset
   723
                        // when implies is called
90ce3da70b43 Initial load
duke
parents:
diff changeset
   724
                        // Add it to entry
31538
0981099a3e54 8130022: Use Java-style array declarations consistently
igerasim
parents: 30790
diff changeset
   725
                        Certificate[] certs;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   726
                        if (pe.signedBy != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   727
                            certs = getCertificates(keyStore,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   728
                                                    pe.signedBy,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   729
                                                    newInfo);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   730
                        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   731
                            certs = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   732
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   733
                        perm = new SelfPermission(pe.permission,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   734
                                                  pe.name,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   735
                                                  pe.action,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   736
                                                  certs);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   737
                    } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   738
                        perm = getInstance(pe.permission,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   739
                                           pe.name,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   740
                                           pe.action);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   741
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   742
                    entry.add(perm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   743
                    if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   744
                        debug.println("  "+perm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   745
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   746
                } catch (ClassNotFoundException cnfe) {
31538
0981099a3e54 8130022: Use Java-style array declarations consistently
igerasim
parents: 30790
diff changeset
   747
                    Certificate[] certs;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   748
                    if (pe.signedBy != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   749
                        certs = getCertificates(keyStore,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   750
                                                pe.signedBy,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   751
                                                newInfo);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   752
                    } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   753
                        certs = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   754
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   755
47478
438e0c9f2f17 8190382: fix small typographic errors in comments
smarks
parents: 47216
diff changeset
   756
                    // only add if we had no signer or we had
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   757
                    // a signer and found the keys for it.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   758
                    if (certs != null || pe.signedBy == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   759
                        Permission perm = new UnresolvedPermission(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   760
                                                  pe.permission,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   761
                                                  pe.name,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   762
                                                  pe.action,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   763
                                                  certs);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   764
                        entry.add(perm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   765
                        if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   766
                            debug.println("  "+perm);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   767
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   768
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   769
                } catch (java.lang.reflect.InvocationTargetException ite) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   770
                    Object[] source = {pe.permission,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   771
                                       ite.getTargetException().toString()};
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   772
                    System.err.println(
48757
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
   773
                        LocalizedMessage.getNonlocalized(
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   774
                            POLICY + ".error.adding.Permission.perm.message",
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   775
                            source));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   776
                } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   777
                    Object[] source = {pe.permission,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   778
                                       e.toString()};
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   779
                    System.err.println(
48757
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
   780
                        LocalizedMessage.getNonlocalized(
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   781
                            POLICY + ".error.adding.Permission.perm.message",
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   782
                            source));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   783
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   784
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   785
90ce3da70b43 Initial load
duke
parents:
diff changeset
   786
            // No need to sync because noone has access to newInfo yet
90ce3da70b43 Initial load
duke
parents:
diff changeset
   787
            newInfo.policyEntries.add(entry);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   788
        } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   789
            Object[] source = {e.toString()};
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   790
            System.err.println(
48757
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
   791
                LocalizedMessage.getNonlocalized(
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   792
                    POLICY + ".error.adding.Entry.message",
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
   793
                    source));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   794
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   795
        if (debug != null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   796
            debug.println();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   797
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   798
90ce3da70b43 Initial load
duke
parents:
diff changeset
   799
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   800
     * Returns a new Permission object of the given Type. The Permission is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   801
     * created by getting the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   802
     * Class object using the <code>Class.forName</code> method, and using
90ce3da70b43 Initial load
duke
parents:
diff changeset
   803
     * the reflection API to invoke the (String name, String actions)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   804
     * constructor on the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   805
     * object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   806
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   807
     * @param type the type of Permission being created.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   808
     * @param name the name of the Permission being created.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   809
     * @param actions the actions of the Permission being created.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   810
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   811
     * @exception  ClassNotFoundException  if the particular Permission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   812
     *             class could not be found.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   813
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   814
     * @exception  IllegalAccessException  if the class or initializer is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   815
     *               not accessible.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   816
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   817
     * @exception  InstantiationException  if getInstance tries to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   818
     *               instantiate an abstract class or an interface, or if the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   819
     *               instantiation fails for some other reason.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   820
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   821
     * @exception  NoSuchMethodException if the (String, String) constructor
90ce3da70b43 Initial load
duke
parents:
diff changeset
   822
     *               is not found.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   823
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   824
     * @exception  InvocationTargetException if the underlying Permission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   825
     *               constructor throws an exception.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   826
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   827
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   828
90ce3da70b43 Initial load
duke
parents:
diff changeset
   829
    private static final Permission getInstance(String type,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   830
                                    String name,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   831
                                    String actions)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   832
        throws ClassNotFoundException,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   833
               InstantiationException,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   834
               IllegalAccessException,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   835
               NoSuchMethodException,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   836
               InvocationTargetException
90ce3da70b43 Initial load
duke
parents:
diff changeset
   837
    {
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
   838
        Class<?> pc = Class.forName(type, false, null);
36511
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   839
        Permission answer = getKnownPermission(pc, name, actions);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   840
        if (answer != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   841
            return answer;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   842
        }
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
   843
        if (!Permission.class.isAssignableFrom(pc)) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
   844
            // not the right subtype
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
   845
            throw new ClassCastException(type + " is not a Permission");
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
   846
        }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   847
90ce3da70b43 Initial load
duke
parents:
diff changeset
   848
        if (name == null && actions == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   849
            try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   850
                Constructor<?> c = pc.getConstructor(PARAMS0);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   851
                return (Permission) c.newInstance(new Object[] {});
90ce3da70b43 Initial load
duke
parents:
diff changeset
   852
            } catch (NoSuchMethodException ne) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   853
                try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   854
                    Constructor<?> c = pc.getConstructor(PARAMS1);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   855
                    return (Permission) c.newInstance(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   856
                              new Object[] { name});
90ce3da70b43 Initial load
duke
parents:
diff changeset
   857
                } catch (NoSuchMethodException ne1 ) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   858
                    Constructor<?> c = pc.getConstructor(PARAMS2);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   859
                    return (Permission) c.newInstance(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   860
                        new Object[] { name, actions });
90ce3da70b43 Initial load
duke
parents:
diff changeset
   861
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   862
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   863
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   864
            if (name != null && actions == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   865
                try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   866
                    Constructor<?> c = pc.getConstructor(PARAMS1);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   867
                    return (Permission) c.newInstance(new Object[] { name});
90ce3da70b43 Initial load
duke
parents:
diff changeset
   868
                } catch (NoSuchMethodException ne) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   869
                    Constructor<?> c = pc.getConstructor(PARAMS2);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   870
                    return (Permission) c.newInstance(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   871
                          new Object[] { name, actions });
90ce3da70b43 Initial load
duke
parents:
diff changeset
   872
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   873
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   874
                Constructor<?> c = pc.getConstructor(PARAMS2);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   875
                return (Permission) c.newInstance(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   876
                      new Object[] { name, actions });
90ce3da70b43 Initial load
duke
parents:
diff changeset
   877
             }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   878
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   879
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   880
90ce3da70b43 Initial load
duke
parents:
diff changeset
   881
    /**
36511
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   882
     * Creates one of the well-known permissions in the java.base module
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   883
     * directly instead of via reflection. Keep list short to not penalize
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   884
     * permissions from other modules.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   885
     */
36511
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   886
    private static Permission getKnownPermission(Class<?> claz, String name,
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   887
                                                 String actions) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   888
        if (claz.equals(FilePermission.class)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   889
            return new FilePermission(name, actions);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   890
        } else if (claz.equals(SocketPermission.class)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   891
            return new SocketPermission(name, actions);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   892
        } else if (claz.equals(RuntimePermission.class)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   893
            return new RuntimePermission(name, actions);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   894
        } else if (claz.equals(PropertyPermission.class)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   895
            return new PropertyPermission(name, actions);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   896
        } else if (claz.equals(NetPermission.class)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   897
            return new NetPermission(name, actions);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   898
        } else if (claz.equals(AllPermission.class)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   899
            return SecurityConstants.ALL_PERMISSION;
36511
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   900
        } else if (claz.equals(SecurityPermission.class)) {
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   901
            return new SecurityPermission(name, actions);
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   902
        } else {
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   903
            return null;
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   904
        }
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   905
    }
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   906
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   907
    /**
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   908
     * Creates one of the well-known principals in the java.base module
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   909
     * directly instead of via reflection. Keep list short to not penalize
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   910
     * principals from other modules.
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   911
     */
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   912
    private static Principal getKnownPrincipal(Class<?> claz, String name) {
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   913
        if (claz.equals(X500Principal.class)) {
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
   914
            return new X500Principal(name);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   915
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   916
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   917
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   918
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   919
90ce3da70b43 Initial load
duke
parents:
diff changeset
   920
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   921
     * Fetch all certs associated with this alias.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   922
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   923
    private Certificate[] getCertificates
90ce3da70b43 Initial load
duke
parents:
diff changeset
   924
                (KeyStore keyStore, String aliases, PolicyInfo newInfo) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   925
90ce3da70b43 Initial load
duke
parents:
diff changeset
   926
        List<Certificate> vcerts = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   927
90ce3da70b43 Initial load
duke
parents:
diff changeset
   928
        StringTokenizer st = new StringTokenizer(aliases, ",");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   929
        int n = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   930
90ce3da70b43 Initial load
duke
parents:
diff changeset
   931
        while (st.hasMoreTokens()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   932
            String alias = st.nextToken().trim();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   933
            n++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   934
            Certificate cert = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   935
            // See if this alias's cert has already been cached
90ce3da70b43 Initial load
duke
parents:
diff changeset
   936
            synchronized (newInfo.aliasMapping) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   937
                cert = (Certificate)newInfo.aliasMapping.get(alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   938
90ce3da70b43 Initial load
duke
parents:
diff changeset
   939
                if (cert == null && keyStore != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   940
90ce3da70b43 Initial load
duke
parents:
diff changeset
   941
                    try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   942
                        cert = keyStore.getCertificate(alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   943
                    } catch (KeyStoreException kse) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   944
                        // never happens, because keystore has already been loaded
90ce3da70b43 Initial load
duke
parents:
diff changeset
   945
                        // when we call this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   946
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   947
                    if (cert != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   948
                        newInfo.aliasMapping.put(alias, cert);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   949
                        newInfo.aliasMapping.put(cert, alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   950
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   951
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   952
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   953
90ce3da70b43 Initial load
duke
parents:
diff changeset
   954
            if (cert != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   955
                if (vcerts == null)
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
   956
                    vcerts = new ArrayList<>();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   957
                vcerts.add(cert);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   958
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   959
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   960
90ce3da70b43 Initial load
duke
parents:
diff changeset
   961
        // make sure n == vcerts.size, since we are doing a logical *and*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   962
        if (vcerts != null && n == vcerts.size()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   963
            Certificate[] certs = new Certificate[vcerts.size()];
90ce3da70b43 Initial load
duke
parents:
diff changeset
   964
            vcerts.toArray(certs);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   965
            return certs;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   966
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   967
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   968
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   969
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   970
90ce3da70b43 Initial load
duke
parents:
diff changeset
   971
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   972
     * Refreshes the policy object by re-reading all the policy files.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   973
     */
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
   974
    @Override public void refresh() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   975
        init(url);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   976
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   977
90ce3da70b43 Initial load
duke
parents:
diff changeset
   978
    /**
28059
e576535359cc 8067377: My hobby: caning, then then canning, the the can-can
martin
parents: 27565
diff changeset
   979
     * Evaluates the global policy for the permissions granted to
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   980
     * the ProtectionDomain and tests whether the permission is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   981
     * granted.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   982
     *
30374
2abaf49910ea 8079478: some docs cleanup for sun.security
avstepan
parents: 28059
diff changeset
   983
     * @param pd the ProtectionDomain to test
2abaf49910ea 8079478: some docs cleanup for sun.security
avstepan
parents: 28059
diff changeset
   984
     * @param p the Permission object to be tested for implication.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   985
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   986
     * @return true if "permission" is a proper subset of a permission
90ce3da70b43 Initial load
duke
parents:
diff changeset
   987
     * granted to this ProtectionDomain.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   988
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   989
     * @see java.security.ProtectionDomain
90ce3da70b43 Initial load
duke
parents:
diff changeset
   990
     */
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
   991
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   992
    public boolean implies(ProtectionDomain pd, Permission p) {
49864
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
   993
        ProtectionDomainCache pdMap = policyInfo.getPdMapping();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   994
        PermissionCollection pc = pdMap.get(pd);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   995
90ce3da70b43 Initial load
duke
parents:
diff changeset
   996
        if (pc != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   997
            return pc.implies(p);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   998
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   999
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1000
        pc = getPermissions(pd);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1001
        if (pc == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1002
            return false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1003
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1004
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1005
        // cache mapping of protection domain to its PermissionCollection
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1006
        pdMap.put(pd, pc);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1007
        return pc.implies(p);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1008
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1009
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1010
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1011
     * Examines this <code>Policy</code> and returns the permissions granted
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1012
     * to the specified <code>ProtectionDomain</code>.  This includes
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1013
     * the permissions currently associated with the domain as well
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1014
     * as the policy permissions granted to the domain's
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1015
     * CodeSource, ClassLoader, and Principals.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1016
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1017
     * <p> Note that this <code>Policy</code> implementation has
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1018
     * special handling for PrivateCredentialPermissions.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1019
     * When this method encounters a <code>PrivateCredentialPermission</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1020
     * which specifies "self" as the <code>Principal</code> class and name,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1021
     * it does not add that <code>Permission</code> to the returned
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1022
     * <code>PermissionCollection</code>.  Instead, it builds
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1023
     * a new <code>PrivateCredentialPermission</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1024
     * for each <code>Principal</code> associated with the provided
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1025
     * <code>Subject</code>.  Each new <code>PrivateCredentialPermission</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1026
     * contains the same Credential class as specified in the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1027
     * originally granted permission, as well as the Class and name
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1028
     * for the respective <code>Principal</code>.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1029
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1030
     * @param domain the Permissions granted to this
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1031
     *          <code>ProtectionDomain</code> are returned.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1032
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1033
     * @return the Permissions granted to the provided
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1034
     *          <code>ProtectionDomain</code>.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1035
     */
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  1036
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1037
    public PermissionCollection getPermissions(ProtectionDomain domain) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1038
        Permissions perms = new Permissions();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1039
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1040
        if (domain == null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1041
           return perms;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1042
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1043
        // first get policy perms
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1044
        getPermissions(perms, domain);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1045
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1046
        // add static perms
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1047
        //      - adding static perms after policy perms is necessary
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1048
        //        to avoid a regression for 4301064
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1049
        PermissionCollection pc = domain.getPermissions();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1050
        if (pc != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1051
            synchronized (pc) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1052
                Enumeration<Permission> e = pc.elements();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1053
                while (e.hasMoreElements()) {
41377
271ee055cb31 8164705: Remove pathname canonicalization from FilePermission
weijun
parents: 39884
diff changeset
  1054
                    perms.add(FilePermCompat.newPermPlusAltPath(e.nextElement()));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1055
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1056
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1057
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1058
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1059
        return perms;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1060
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1061
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1062
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1063
     * Examines this Policy and creates a PermissionCollection object with
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1064
     * the set of permissions for the specified CodeSource.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1065
     *
30374
2abaf49910ea 8079478: some docs cleanup for sun.security
avstepan
parents: 28059
diff changeset
  1066
     * @param codesource the CodeSource associated with the caller.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1067
     * This encapsulates the original location of the code (where the code
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1068
     * came from) and the public key(s) of its signer.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1069
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1070
     * @return the set of permissions according to the policy.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1071
     */
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  1072
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1073
    public PermissionCollection getPermissions(CodeSource codesource) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1074
        return getPermissions(new Permissions(), codesource);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1075
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1076
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1077
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1078
     * Examines the global policy and returns the provided Permissions
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1079
     * object with additional permissions granted to the specified
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1080
     * ProtectionDomain.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1081
     *
41377
271ee055cb31 8164705: Remove pathname canonicalization from FilePermission
weijun
parents: 39884
diff changeset
  1082
     * @param perms the Permissions to populate
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1083
     * @param pd the ProtectionDomain associated with the caller.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1084
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1085
     * @return the set of Permissions according to the policy.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1086
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1087
    private PermissionCollection getPermissions(Permissions perms,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1088
                                        ProtectionDomain pd ) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1089
        if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1090
            debug.println("getPermissions:\n\t" + printPD(pd));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1091
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1092
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1093
        final CodeSource cs = pd.getCodeSource();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1094
        if (cs == null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1095
            return perms;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1096
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1097
        CodeSource canonCodeSource = AccessController.doPrivileged(
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
  1098
            new java.security.PrivilegedAction<>(){
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
  1099
                @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1100
                public CodeSource run() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1101
                    return canonicalizeCodebase(cs, true);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1102
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1103
            });
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1104
        return getPermissions(perms, canonCodeSource, pd.getPrincipals());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1105
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1106
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1107
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1108
     * Examines the global policy and returns the provided Permissions
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1109
     * object with additional permissions granted to the specified
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1110
     * CodeSource.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1111
     *
41377
271ee055cb31 8164705: Remove pathname canonicalization from FilePermission
weijun
parents: 39884
diff changeset
  1112
     * @param perms the permissions to populate
271ee055cb31 8164705: Remove pathname canonicalization from FilePermission
weijun
parents: 39884
diff changeset
  1113
     * @param cs the codesource associated with the caller.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1114
     * This encapsulates the original location of the code (where the code
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1115
     * came from) and the public key(s) of its signer.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1116
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1117
     * @return the set of permissions according to the policy.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1118
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1119
    private PermissionCollection getPermissions(Permissions perms,
11992
664aa0d389f9 7147830: NullPointerException in java.security.Policy.implies() when the ProtectionDomain has a null code sou
mullan
parents: 10336
diff changeset
  1120
                                                final CodeSource cs) {
664aa0d389f9 7147830: NullPointerException in java.security.Policy.implies() when the ProtectionDomain has a null code sou
mullan
parents: 10336
diff changeset
  1121
664aa0d389f9 7147830: NullPointerException in java.security.Policy.implies() when the ProtectionDomain has a null code sou
mullan
parents: 10336
diff changeset
  1122
        if (cs == null)
664aa0d389f9 7147830: NullPointerException in java.security.Policy.implies() when the ProtectionDomain has a null code sou
mullan
parents: 10336
diff changeset
  1123
            return perms;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1124
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1125
        CodeSource canonCodeSource = AccessController.doPrivileged(
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
  1126
            new PrivilegedAction<>(){
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
  1127
                @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1128
                public CodeSource run() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1129
                    return canonicalizeCodebase(cs, true);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1130
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1131
            });
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1132
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1133
        return getPermissions(perms, canonCodeSource, null);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1134
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1135
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1136
    private Permissions getPermissions(Permissions perms,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1137
                                       final CodeSource cs,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1138
                                       Principal[] principals) {
49864
1dcd0716a178 8192789: Avoid using AtomicReference in sun.security.provider.PolicyFile
igerasim
parents: 49588
diff changeset
  1139
        for (PolicyEntry entry : policyInfo.policyEntries) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1140
            addPermissions(perms, cs, principals, entry);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1141
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1142
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1143
        return perms;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1144
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1145
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1146
    private void addPermissions(Permissions perms,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1147
        final CodeSource cs,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1148
        Principal[] principals,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1149
        final PolicyEntry entry) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1150
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1151
        if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1152
            debug.println("evaluate codesources:\n" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1153
                "\tPolicy CodeSource: " + entry.getCodeSource() + "\n" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1154
                "\tActive CodeSource: " + cs);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1155
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1156
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1157
        // check to see if the CodeSource implies
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1158
        Boolean imp = AccessController.doPrivileged
39884
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
  1159
            (new PrivilegedAction<>() {
9a543219d0bb 8159752: Grant de-privileged module permissions by default with java.security.policy override option
mullan
parents: 38324
diff changeset
  1160
            @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1161
            public Boolean run() {
24685
215fa91e1b4c 8044461: Cleanup new Boolean and single character strings
rriggs
parents: 22041
diff changeset
  1162
                return entry.getCodeSource().implies(cs);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1163
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1164
        });
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1165
        if (!imp.booleanValue()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1166
            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1167
                debug.println("evaluation (codesource) failed");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1168
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1169
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1170
            // CodeSource does not imply - return and try next policy entry
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1171
            return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1172
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1173
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1174
        // check to see if the Principals imply
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1175
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1176
        List<PolicyParser.PrincipalEntry> entryPs = entry.getPrincipals();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1177
        if (debug != null) {
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1178
            List<PolicyParser.PrincipalEntry> accPs = new ArrayList<>();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1179
            if (principals != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1180
                for (int i = 0; i < principals.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1181
                    accPs.add(new PolicyParser.PrincipalEntry
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1182
                                        (principals[i].getClass().getName(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1183
                                        principals[i].getName()));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1184
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1185
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1186
            debug.println("evaluate principals:\n" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1187
                "\tPolicy Principals: " + entryPs + "\n" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1188
                "\tActive Principals: " + accPs);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1189
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1190
10336
0bb1999251f8 7064075: Security libraries don't build with javac -Xlint:all,-deprecation -Werror
jjg
parents: 9771
diff changeset
  1191
        if (entryPs == null || entryPs.isEmpty()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1192
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1193
            // policy entry has no principals -
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1194
            // add perms regardless of principals in current ACC
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1195
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1196
            addPerms(perms, principals, entry);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1197
            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1198
                debug.println("evaluation (codesource/principals) passed");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1199
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1200
            return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1201
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1202
        } else if (principals == null || principals.length == 0) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1203
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1204
            // current thread has no principals but this policy entry
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1205
            // has principals - perms are not added
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1206
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1207
            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1208
                debug.println("evaluation (principals) failed");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1209
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1210
            return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1211
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1212
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1213
        // current thread has principals and this policy entry
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1214
        // has principals.  see if policy entry principals match
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1215
        // principals in current ACC
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1216
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1217
        for (PolicyParser.PrincipalEntry pppe : entryPs) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1218
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1219
            // Check for wildcards
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1220
            if (pppe.isWildcardClass()) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1221
                // a wildcard class matches all principals in current ACC
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1222
                continue;
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1223
            }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1224
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1225
            if (pppe.isWildcardName()) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1226
                // a wildcard name matches any principal with the same class
16046
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1227
                if (wildcardPrincipalNameImplies(pppe.principalClass,
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1228
                                                 principals)) {
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1229
                    continue;
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1230
                }
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1231
                if (debug != null) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1232
                    debug.println("evaluation (principal name wildcard) failed");
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1233
                }
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1234
                // policy entry principal not in current ACC -
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1235
                // immediately return and go to next policy entry
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1236
                return;
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1237
            }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1238
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1239
            Set<Principal> pSet = new HashSet<>(Arrays.asList(principals));
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1240
            Subject subject = new Subject(true, pSet,
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1241
                                          Collections.EMPTY_SET,
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1242
                                          Collections.EMPTY_SET);
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1243
            try {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1244
                ClassLoader cl = Thread.currentThread().getContextClassLoader();
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1245
                Class<?> pClass = Class.forName(pppe.principalClass, false, cl);
36511
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1246
                Principal p = getKnownPrincipal(pClass, pppe.principalName);
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1247
                if (p == null) {
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1248
                    if (!Principal.class.isAssignableFrom(pClass)) {
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1249
                        // not the right subtype
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1250
                        throw new ClassCastException(pppe.principalClass +
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1251
                                                     " is not a Principal");
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1252
                    }
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1253
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1254
                    Constructor<?> c = pClass.getConstructor(PARAMS1);
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1255
                    p = (Principal)c.newInstance(new Object[] {
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1256
                                                 pppe.principalName });
9d0388c6b336 8142968: Module System implementation
alanb
parents: 32834
diff changeset
  1257
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1258
                }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1259
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1260
                if (debug != null) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1261
                    debug.println("found Principal " + p.getClass().getName());
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1262
                }
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1263
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1264
                // check if the Principal implies the current
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1265
                // thread's principals
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1266
                if (!p.implies(subject)) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1267
                    if (debug != null) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1268
                        debug.println("evaluation (principal implies) failed");
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1269
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1270
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1271
                    // policy principal does not imply the current Subject -
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1272
                    // immediately return and go to next policy entry
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1273
                    return;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1274
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1275
            } catch (Exception e) {
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1276
                // fall back to default principal comparison.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1277
                // see if policy entry principal is in current ACC
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1278
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1279
                if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1280
                    e.printStackTrace();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1281
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1282
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1283
                if (!pppe.implies(subject)) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1284
                    if (debug != null) {
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1285
                        debug.println("evaluation (default principal implies) failed");
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1286
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1287
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1288
                    // policy entry principal not in current ACC -
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1289
                    // immediately return and go to next policy entry
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1290
                    return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1291
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1292
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1293
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1294
            // either the principal information matched,
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1295
            // or the Principal.implies succeeded.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1296
            // continue loop and test the next policy principal
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1297
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1298
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1299
        // all policy entry principals were found in the current ACC -
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1300
        // grant the policy permissions
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1301
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1302
        if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1303
            debug.println("evaluation (codesource/principals) passed");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1304
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1305
        addPerms(perms, principals, entry);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1306
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1307
16046
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1308
    /**
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1309
     * Returns true if the array of principals contains at least one
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1310
     * principal of the specified class.
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1311
     */
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1312
    private static boolean wildcardPrincipalNameImplies(String principalClass,
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1313
                                                        Principal[] principals)
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1314
    {
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1315
        for (Principal p : principals) {
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1316
            if (principalClass.equals(p.getClass().getName())) {
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1317
                return true;
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1318
            }
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1319
        }
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1320
        return false;
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1321
    }
c65f0f54851c 8008908: Access denied when invoking Subject.doAsPrivileged()
mullan
parents: 15013
diff changeset
  1322
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1323
    private void addPerms(Permissions perms,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1324
                        Principal[] accPs,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1325
                        PolicyEntry entry) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1326
        for (int i = 0; i < entry.permissions.size(); i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1327
            Permission p = entry.permissions.get(i);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1328
            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1329
                debug.println("  granting " + p);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1330
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1331
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1332
            if (p instanceof SelfPermission) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1333
                // handle "SELF" permissions
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1334
                expandSelf((SelfPermission)p,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1335
                        entry.getPrincipals(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1336
                        accPs,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1337
                        perms);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1338
            } else {
41377
271ee055cb31 8164705: Remove pathname canonicalization from FilePermission
weijun
parents: 39884
diff changeset
  1339
                perms.add(FilePermCompat.newPermPlusAltPath(p));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1340
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1341
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1342
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1343
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1344
    /**
30374
2abaf49910ea 8079478: some docs cleanup for sun.security
avstepan
parents: 28059
diff changeset
  1345
     * @param sp the SelfPermission that needs to be expanded.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1346
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1347
     * @param entryPs list of principals for the Policy entry.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1348
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1349
     * @param pdp Principal array from the current ProtectionDomain.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1350
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1351
     * @param perms the PermissionCollection where the individual
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1352
     *                  Permissions will be added after expansion.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1353
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1354
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1355
    private void expandSelf(SelfPermission sp,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1356
                            List<PolicyParser.PrincipalEntry> entryPs,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1357
                            Principal[] pdp,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1358
                            Permissions perms) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1359
10336
0bb1999251f8 7064075: Security libraries don't build with javac -Xlint:all,-deprecation -Werror
jjg
parents: 9771
diff changeset
  1360
        if (entryPs == null || entryPs.isEmpty()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1361
            // No principals in the grant to substitute
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1362
            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1363
                debug.println("Ignoring permission "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1364
                                + sp.getSelfType()
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1365
                                + " with target name ("
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1366
                                + sp.getSelfName() + ").  "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1367
                                + "No Principal(s) specified "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1368
                                + "in the grant clause.  "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1369
                                + "SELF-based target names are "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1370
                                + "only valid in the context "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1371
                                + "of a Principal-based grant entry."
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1372
                             );
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1373
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1374
            return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1375
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1376
        int startIndex = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1377
        int v;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1378
        StringBuilder sb = new StringBuilder();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1379
        while ((v = sp.getSelfName().indexOf(SELF, startIndex)) != -1) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1380
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1381
            // add non-SELF string
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1382
            sb.append(sp.getSelfName().substring(startIndex, v));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1383
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1384
            // expand SELF
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1385
            Iterator<PolicyParser.PrincipalEntry> pli = entryPs.iterator();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1386
            while (pli.hasNext()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1387
                PolicyParser.PrincipalEntry pppe = pli.next();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1388
                String[][] principalInfo = getPrincipalInfo(pppe,pdp);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1389
                for (int i = 0; i < principalInfo.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1390
                    if (i != 0) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1391
                        sb.append(", ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1392
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1393
                    sb.append(principalInfo[i][0] + " " +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1394
                        "\"" + principalInfo[i][1] + "\"");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1395
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1396
                if (pli.hasNext()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1397
                    sb.append(", ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1398
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1399
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1400
            startIndex = v + SELF.length();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1401
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1402
        // add remaining string (might be the entire string)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1403
        sb.append(sp.getSelfName().substring(startIndex));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1404
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1405
        if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1406
            debug.println("  expanded:\n\t" + sp.getSelfName()
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1407
                        + "\n  into:\n\t" + sb.toString());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1408
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1409
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1410
            // first try to instantiate the permission
41377
271ee055cb31 8164705: Remove pathname canonicalization from FilePermission
weijun
parents: 39884
diff changeset
  1411
            perms.add(FilePermCompat.newPermPlusAltPath(getInstance(sp.getSelfType(),
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1412
                                  sb.toString(),
41377
271ee055cb31 8164705: Remove pathname canonicalization from FilePermission
weijun
parents: 39884
diff changeset
  1413
                                  sp.getSelfActions())));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1414
        } catch (ClassNotFoundException cnfe) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1415
            // ok, the permission is not in the bootclasspath.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1416
            // before we add an UnresolvedPermission, check to see
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1417
            // whether this perm already belongs to the collection.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1418
            // if so, use that perm's ClassLoader to create a new
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1419
            // one.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1420
            Class<?> pc = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1421
            synchronized (perms) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1422
                Enumeration<Permission> e = perms.elements();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1423
                while (e.hasMoreElements()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1424
                    Permission pElement = e.nextElement();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1425
                    if (pElement.getClass().getName().equals(sp.getSelfType())) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1426
                        pc = pElement.getClass();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1427
                        break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1428
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1429
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1430
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1431
            if (pc == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1432
                // create an UnresolvedPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1433
                perms.add(new UnresolvedPermission(sp.getSelfType(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1434
                                                        sb.toString(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1435
                                                        sp.getSelfActions(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1436
                                                        sp.getCerts()));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1437
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1438
                try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1439
                    // we found an instantiated permission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1440
                    // use its class loader to instantiate a new permission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1441
                    Constructor<?> c;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1442
                    // name parameter can not be null
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1443
                    if (sp.getSelfActions() == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1444
                        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1445
                            c = pc.getConstructor(PARAMS1);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1446
                            perms.add((Permission)c.newInstance
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1447
                                 (new Object[] {sb.toString()}));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1448
                        } catch (NoSuchMethodException ne) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1449
                            c = pc.getConstructor(PARAMS2);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1450
                            perms.add((Permission)c.newInstance
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1451
                                 (new Object[] {sb.toString(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1452
                                                sp.getSelfActions() }));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1453
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1454
                    } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1455
                        c = pc.getConstructor(PARAMS2);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1456
                        perms.add((Permission)c.newInstance
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1457
                           (new Object[] {sb.toString(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1458
                                          sp.getSelfActions()}));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1459
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1460
                } catch (Exception nme) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1461
                    if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1462
                        debug.println("self entry expansion " +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1463
                        " instantiation failed: "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1464
                        +  nme.toString());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1465
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1466
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1467
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1468
        } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1469
            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1470
                debug.println(e.toString());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1471
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1472
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1473
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1474
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1475
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1476
     * return the principal class/name pair in the 2D array.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1477
     * array[x][y]:     x corresponds to the array length.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1478
     *                  if (y == 0), it's the principal class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1479
     *                  if (y == 1), it's the principal name.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1480
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1481
    private String[][] getPrincipalInfo
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1482
        (PolicyParser.PrincipalEntry pe, Principal[] pdp) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1483
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1484
        // there are 3 possibilities:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1485
        // 1) the entry's Principal class and name are not wildcarded
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1486
        // 2) the entry's Principal name is wildcarded only
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1487
        // 3) the entry's Principal class and name are wildcarded
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1488
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1489
        if (!pe.isWildcardClass() && !pe.isWildcardName()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1490
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1491
            // build an info array for the principal
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1492
            // from the Policy entry
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1493
            String[][] info = new String[1][2];
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1494
            info[0][0] = pe.principalClass;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1495
            info[0][1] = pe.principalName;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1496
            return info;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1497
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1498
        } else if (!pe.isWildcardClass() && pe.isWildcardName()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1499
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1500
            // build an info array for every principal
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1501
            // in the current domain which has a principal class
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1502
            // that is equal to policy entry principal class name
7973
dffe8439eb20 7005608: diamond conversion of JCA and crypto providers
smarks
parents: 7179
diff changeset
  1503
            List<Principal> plist = new ArrayList<>();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1504
            for (int i = 0; i < pdp.length; i++) {
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1505
                if (pe.principalClass.equals(pdp[i].getClass().getName()))
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1506
                    plist.add(pdp[i]);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1507
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1508
            String[][] info = new String[plist.size()][2];
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1509
            int i = 0;
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1510
            for (Principal p : plist) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1511
                info[i][0] = p.getClass().getName();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1512
                info[i][1] = p.getName();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1513
                i++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1514
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1515
            return info;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1516
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1517
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1518
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1519
            // build an info array for every
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1520
            // one of the current Domain's principals
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1521
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1522
            String[][] info = new String[pdp.length][2];
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1523
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1524
            for (int i = 0; i < pdp.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1525
                info[i][0] = pdp[i].getClass().getName();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1526
                info[i][1] = pdp[i].getName();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1527
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1528
            return info;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1529
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1530
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1531
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1532
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1533
     * Returns the signer certificates from the list of certificates
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1534
     * associated with the given code source.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1535
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1536
     * The signer certificates are those certificates that were used
30790
f81f9725a1c6 8065233: Remove Policy provider code that synchronizes on identityPolicyEntries List
mullan
parents: 30374
diff changeset
  1537
     * to verify signed code originating from the codesource location.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1538
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1539
     * This method assumes that in the given code source, each signer
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1540
     * certificate is followed by its supporting certificate chain
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1541
     * (which may be empty), and that the signer certificate and its
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1542
     * supporting certificate chain are ordered bottom-to-top
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1543
     * (i.e., with the signer certificate first and the (root) certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1544
     * authority last).
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1545
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1546
    protected Certificate[] getSignerCertificates(CodeSource cs) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1547
        Certificate[] certs = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1548
        if ((certs = cs.getCertificates()) == null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1549
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1550
        for (int i=0; i<certs.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1551
            if (!(certs[i] instanceof X509Certificate))
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1552
                return cs.getCertificates();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1553
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1554
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1555
        // Do we have to do anything?
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1556
        int i = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1557
        int count = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1558
        while (i < certs.length) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1559
            count++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1560
            while (((i+1) < certs.length)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1561
                   && ((X509Certificate)certs[i]).getIssuerDN().equals(
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1562
                           ((X509Certificate)certs[i+1]).getSubjectDN())) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1563
                i++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1564
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1565
            i++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1566
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1567
        if (count == certs.length)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1568
            // Done
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1569
            return certs;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1570
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1571
        List<Certificate> userCertList = new ArrayList<>();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1572
        i = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1573
        while (i < certs.length) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1574
            userCertList.add(certs[i]);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1575
            while (((i+1) < certs.length)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1576
                   && ((X509Certificate)certs[i]).getIssuerDN().equals(
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1577
                           ((X509Certificate)certs[i+1]).getSubjectDN())) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1578
                i++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1579
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1580
            i++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1581
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1582
        Certificate[] userCerts = new Certificate[userCertList.size()];
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1583
        userCertList.toArray(userCerts);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1584
        return userCerts;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1585
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1586
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1587
    private CodeSource canonicalizeCodebase(CodeSource cs,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1588
                                            boolean extractSignerCerts) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1589
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1590
        String path = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1591
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1592
        CodeSource canonCs = cs;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1593
        URL u = cs.getLocation();
9771
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1594
        if (u != null) {
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1595
            if (u.getProtocol().equals("jar")) {
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1596
                // unwrap url embedded inside jar url
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1597
                String spec = u.getFile();
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1598
                int separator = spec.indexOf("!/");
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1599
                if (separator != -1) {
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1600
                    try {
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1601
                        u = new URL(spec.substring(0, separator));
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1602
                    } catch (MalformedURLException e) {
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1603
                        // Fail silently. In this case, url stays what
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1604
                        // it was above
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1605
                    }
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1606
                }
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1607
            }
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1608
            if (u.getProtocol().equals("file")) {
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1609
                boolean isLocalFile = false;
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1610
                String host = u.getHost();
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1611
                isLocalFile = (host == null || host.equals("") ||
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1612
                    host.equals("~") || host.equalsIgnoreCase("localhost"));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1613
9771
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1614
                if (isLocalFile) {
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1615
                    path = u.getFile().replace('/', File.separatorChar);
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1616
                    path = ParseUtil.decode(path);
0e8006984450 7044443: Permissions resolved incorrectly for jar protocol (Patch from bugs.openjdk.java.net)
mullan
parents: 9035
diff changeset
  1617
                }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1618
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1619
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1620
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1621
        if (path != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1622
            try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1623
                URL csUrl = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1624
                path = canonPath(path);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1625
                csUrl = ParseUtil.fileToEncodedURL(new File(path));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1626
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1627
                if (extractSignerCerts) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1628
                    canonCs = new CodeSource(csUrl,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1629
                                             getSignerCertificates(cs));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1630
                } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1631
                    canonCs = new CodeSource(csUrl,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1632
                                             cs.getCertificates());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1633
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1634
            } catch (IOException ioe) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1635
                // leave codesource as it is, unless we have to extract its
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1636
                // signer certificates
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1637
                if (extractSignerCerts) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1638
                    canonCs = new CodeSource(cs.getLocation(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1639
                                             getSignerCertificates(cs));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1640
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1641
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1642
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1643
            if (extractSignerCerts) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1644
                canonCs = new CodeSource(cs.getLocation(),
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1645
                                         getSignerCertificates(cs));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1646
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1647
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1648
        return canonCs;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1649
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1650
4053
c2f8e57ba2f8 6891707: Eliminate the java.io.FilePermission dependency on PolicyFile
mchung
parents: 3956
diff changeset
  1651
    // Wrapper to return a canonical path that avoids calling getCanonicalPath()
c2f8e57ba2f8 6891707: Eliminate the java.io.FilePermission dependency on PolicyFile
mchung
parents: 3956
diff changeset
  1652
    // with paths that are intended to match all entries in the directory
c2f8e57ba2f8 6891707: Eliminate the java.io.FilePermission dependency on PolicyFile
mchung
parents: 3956
diff changeset
  1653
    private static String canonPath(String path) throws IOException {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1654
        if (path.endsWith("*")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1655
            path = path.substring(0, path.length()-1) + "-";
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1656
            path = new File(path).getCanonicalPath();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1657
            return path.substring(0, path.length()-1) + "*";
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1658
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1659
            return new File(path).getCanonicalPath();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1660
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1661
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1662
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1663
    private String printPD(ProtectionDomain pd) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1664
        Principal[] principals = pd.getPrincipals();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1665
        String pals = "<no principals>";
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1666
        if (principals != null && principals.length > 0) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1667
            StringBuilder palBuf = new StringBuilder("(principals ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1668
            for (int i = 0; i < principals.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1669
                palBuf.append(principals[i].getClass().getName() +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1670
                              " \"" + principals[i].getName() +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1671
                              "\"");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1672
                if (i < principals.length-1)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1673
                    palBuf.append(", ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1674
                else
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1675
                    palBuf.append(")");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1676
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1677
            pals = palBuf.toString();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1678
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1679
        return "PD CodeSource: "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1680
                + pd.getCodeSource()
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1681
                +"\n\t" + "PD ClassLoader: "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1682
                + pd.getClassLoader()
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1683
                +"\n\t" + "PD Principals: "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1684
                + pals;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1685
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1686
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1687
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1688
     * return true if no replacement was performed,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1689
     * or if replacement succeeded.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1690
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1691
    private boolean replacePrincipals(
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1692
        List<PolicyParser.PrincipalEntry> principals, KeyStore keystore) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1693
10336
0bb1999251f8 7064075: Security libraries don't build with javac -Xlint:all,-deprecation -Werror
jjg
parents: 9771
diff changeset
  1694
        if (principals == null || principals.isEmpty() || keystore == null)
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1695
            return true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1696
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1697
        for (PolicyParser.PrincipalEntry pppe : principals) {
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  1698
            if (pppe.isReplaceName()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1699
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1700
                // perform replacement
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1701
                // (only X509 replacement is possible now)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1702
                String name;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1703
                if ((name = getDN(pppe.principalName, keystore)) == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1704
                    return false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1705
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1706
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1707
                if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1708
                    debug.println("  Replacing \"" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1709
                        pppe.principalName +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1710
                        "\" with " +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1711
                        X500PRINCIPAL + "/\"" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1712
                        name +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1713
                        "\"");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1714
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1715
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1716
                pppe.principalClass = X500PRINCIPAL;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1717
                pppe.principalName = name;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1718
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1719
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1720
        // return true if no replacement was performed,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1721
        // or if replacement succeeded
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1722
        return true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1723
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1724
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1725
    private void expandPermissionName(PolicyParser.PermissionEntry pe,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1726
                                        KeyStore keystore) throws Exception {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1727
        // short cut the common case
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1728
        if (pe.name == null || pe.name.indexOf("${{", 0) == -1) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1729
            return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1730
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1731
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1732
        int startIndex = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1733
        int b, e;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1734
        StringBuilder sb = new StringBuilder();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1735
        while ((b = pe.name.indexOf("${{", startIndex)) != -1) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1736
            e = pe.name.indexOf("}}", b);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1737
            if (e < 1) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1738
                break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1739
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1740
            sb.append(pe.name.substring(startIndex, b));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1741
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1742
            // get the value in ${{...}}
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1743
            String value = pe.name.substring(b+3, e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1744
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1745
            // parse up to the first ':'
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1746
            int colonIndex;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1747
            String prefix = value;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1748
            String suffix;
24685
215fa91e1b4c 8044461: Cleanup new Boolean and single character strings
rriggs
parents: 22041
diff changeset
  1749
            if ((colonIndex = value.indexOf(':')) != -1) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1750
                prefix = value.substring(0, colonIndex);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1751
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1752
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1753
            // handle different prefix possibilities
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1754
            if (prefix.equalsIgnoreCase("self")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1755
                // do nothing - handled later
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1756
                sb.append(pe.name.substring(b, e+2));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1757
                startIndex = e+2;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1758
                continue;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1759
            } else if (prefix.equalsIgnoreCase("alias")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1760
                // get the suffix and perform keystore alias replacement
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1761
                if (colonIndex == -1) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1762
                    Object[] source = {pe.name};
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
  1763
                    throw new Exception(
48757
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
  1764
                        LocalizedMessage.getNonlocalized(
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
  1765
                            "alias.name.not.provided.pe.name.",
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
  1766
                            source));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1767
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1768
                suffix = value.substring(colonIndex+1);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1769
                if ((suffix = getDN(suffix, keystore)) == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1770
                    Object[] source = {value.substring(colonIndex+1)};
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
  1771
                    throw new Exception(
48757
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
  1772
                        LocalizedMessage.getNonlocalized(
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
  1773
                            "unable.to.perform.substitution.on.alias.suffix",
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
  1774
                            source));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1775
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1776
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1777
                sb.append(X500PRINCIPAL + " \"" + suffix + "\"");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1778
                startIndex = e+2;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1779
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1780
                Object[] source = {prefix};
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
  1781
                throw new Exception(
48757
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
  1782
                    LocalizedMessage.getNonlocalized(
43297
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
  1783
                        "substitution.value.prefix.unsupported",
05ad35b943d0 8168075: Custom system class loader + security manager + malformed policy file = recursive initialization
apetcher
parents: 41377
diff changeset
  1784
                        source));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1785
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1786
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1787
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1788
        // copy the rest of the value
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1789
        sb.append(pe.name.substring(startIndex));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1790
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1791
        // replace the name with expanded value
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1792
        if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1793
            debug.println("  Permission name expanded from:\n\t" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1794
                        pe.name + "\nto\n\t" + sb.toString());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1795
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1796
        pe.name = sb.toString();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1797
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1798
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1799
    private String getDN(String alias, KeyStore keystore) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1800
        Certificate cert = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1801
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1802
            cert = keystore.getCertificate(alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1803
        } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1804
            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1805
                debug.println("  Error retrieving certificate for '" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1806
                                alias +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1807
                                "': " +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1808
                                e.toString());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1809
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1810
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1811
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1812
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1813
        if (cert == null || !(cert instanceof X509Certificate)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1814
            if (debug != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1815
                debug.println("  -- No certificate for '" +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1816
                                alias +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1817
                                "' - ignoring entry");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1818
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1819
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1820
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1821
            X509Certificate x509Cert = (X509Certificate)cert;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1822
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1823
            // 4702543:  X500 names with an EmailAddress
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1824
            // were encoded incorrectly.  create new
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1825
            // X500Principal name with correct encoding
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1826
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1827
            X500Principal p = new X500Principal
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1828
                (x509Cert.getSubjectX500Principal().toString());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1829
            return p.getName();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1830
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1831
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1832
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1833
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1834
     * Each entry in the policy configuration file is represented by a
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1835
     * PolicyEntry object.  <p>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1836
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1837
     * A PolicyEntry is a (CodeSource,Permission) pair.  The
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1838
     * CodeSource contains the (URL, PublicKey) that together identify
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1839
     * where the Java bytecodes come from and who (if anyone) signed
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1840
     * them.  The URL could refer to localhost.  The URL could also be
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1841
     * null, meaning that this policy entry is given to all comers, as
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1842
     * long as they match the signer field.  The signer could be null,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1843
     * meaning the code is not signed. <p>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1844
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1845
     * The Permission contains the (Type, Name, Action) triplet. <p>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1846
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1847
     * For now, the Policy object retrieves the public key from the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1848
     * X.509 certificate on disk that corresponds to the signedBy
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1849
     * alias specified in the Policy config file.  For reasons of
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1850
     * efficiency, the Policy object keeps a hashtable of certs already
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1851
     * read in.  This could be replaced by a secure internal key
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1852
     * store.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1853
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1854
     * <p>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1855
     * For example, the entry
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1856
     * <pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1857
     *          permission java.io.File "/tmp", "read,write",
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1858
     *          signedBy "Duke";
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1859
     * </pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1860
     * is represented internally
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1861
     * <pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1862
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1863
     * FilePermission f = new FilePermission("/tmp", "read,write");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1864
     * PublicKey p = publickeys.get("Duke");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1865
     * URL u = InetAddress.getLocalHost();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1866
     * CodeBase c = new CodeBase( p, u );
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1867
     * pe = new PolicyEntry(f, c);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1868
     * </pre>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1869
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1870
     * @author Marianne Mueller
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1871
     * @author Roland Schemers
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1872
     * @see java.security.CodeSource
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1873
     * @see java.security.Policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1874
     * @see java.security.Permissions
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1875
     * @see java.security.ProtectionDomain
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1876
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1877
    private static class PolicyEntry {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1878
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1879
        private final CodeSource codesource;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1880
        final List<Permission> permissions;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1881
        private final List<PolicyParser.PrincipalEntry> principals;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1882
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1883
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1884
         * Given a Permission and a CodeSource, create a policy entry.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1885
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1886
         * XXX Decide if/how to add validity fields and "purpose" fields to
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1887
         * XXX policy entries
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1888
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1889
         * @param cs the CodeSource, which encapsulates the URL and the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1890
         *        public key
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1891
         *        attributes from the policy config file. Validity checks
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1892
         *        are performed on the public key before PolicyEntry is
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1893
         *        called.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1894
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1895
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1896
        PolicyEntry(CodeSource cs, List<PolicyParser.PrincipalEntry> principals)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1897
        {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1898
            this.codesource = cs;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1899
            this.permissions = new ArrayList<Permission>();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1900
            this.principals = principals; // can be null
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1901
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1902
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1903
        PolicyEntry(CodeSource cs)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1904
        {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1905
            this(cs, null);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1906
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1907
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1908
        List<PolicyParser.PrincipalEntry> getPrincipals() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1909
            return principals; // can be null
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1910
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1911
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1912
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1913
         * add a Permission object to this entry.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1914
         * No need to sync add op because perms are added to entry only
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1915
         * while entry is being initialized
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1916
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1917
        void add(Permission p) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1918
            permissions.add(p);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1919
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1920
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1921
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1922
         * Return the CodeSource for this policy entry
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1923
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1924
        CodeSource getCodeSource() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1925
            return codesource;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1926
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1927
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  1928
        @Override public String toString(){
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1929
            StringBuilder sb = new StringBuilder();
7179
4afb81e50183 6987827: security/util/Resources.java needs improvement
weijun
parents: 5506
diff changeset
  1930
            sb.append(ResourcesMgr.getString("LPARAM"));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1931
            sb.append(getCodeSource());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1932
            sb.append("\n");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1933
            for (int j = 0; j < permissions.size(); j++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1934
                Permission p = permissions.get(j);
7179
4afb81e50183 6987827: security/util/Resources.java needs improvement
weijun
parents: 5506
diff changeset
  1935
                sb.append(ResourcesMgr.getString("SPACE"));
4afb81e50183 6987827: security/util/Resources.java needs improvement
weijun
parents: 5506
diff changeset
  1936
                sb.append(ResourcesMgr.getString("SPACE"));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1937
                sb.append(p);
7179
4afb81e50183 6987827: security/util/Resources.java needs improvement
weijun
parents: 5506
diff changeset
  1938
                sb.append(ResourcesMgr.getString("NEWLINE"));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1939
            }
7179
4afb81e50183 6987827: security/util/Resources.java needs improvement
weijun
parents: 5506
diff changeset
  1940
            sb.append(ResourcesMgr.getString("RPARAM"));
4afb81e50183 6987827: security/util/Resources.java needs improvement
weijun
parents: 5506
diff changeset
  1941
            sb.append(ResourcesMgr.getString("NEWLINE"));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1942
            return sb.toString();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1943
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1944
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1945
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1946
    private static class SelfPermission extends Permission {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1947
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1948
        private static final long serialVersionUID = -8315562579967246806L;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1949
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1950
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1951
         * The class name of the Permission class that will be
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1952
         * created when this self permission is expanded .
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1953
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1954
         * @serial
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1955
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1956
        private String type;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1957
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1958
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1959
         * The permission name.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1960
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1961
         * @serial
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1962
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1963
        private String name;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1964
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1965
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1966
         * The actions of the permission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1967
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1968
         * @serial
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1969
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1970
        private String actions;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1971
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1972
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1973
         * The certs of the permission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1974
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1975
         * @serial
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1976
         */
31538
0981099a3e54 8130022: Use Java-style array declarations consistently
igerasim
parents: 30790
diff changeset
  1977
        private Certificate[] certs;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1978
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1979
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1980
         * Creates a new SelfPermission containing the permission
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1981
         * information needed later to expand the self
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1982
         * @param type the class name of the Permission class that will be
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1983
         * created when this permission is expanded and if necessary resolved.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1984
         * @param name the name of the permission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1985
         * @param actions the actions of the permission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1986
         * @param certs the certificates the permission's class was signed with.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1987
         * This is a list of certificate chains, where each chain is composed of
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1988
         * a signer certificate and optionally its supporting certificate chain.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1989
         * Each chain is ordered bottom-to-top (i.e., with the signer
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1990
         * certificate first and the (root) certificate authority last).
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1991
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1992
        public SelfPermission(String type, String name, String actions,
31538
0981099a3e54 8130022: Use Java-style array declarations consistently
igerasim
parents: 30790
diff changeset
  1993
                              Certificate[] certs)
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1994
        {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1995
            super(type);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1996
            if (type == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1997
                throw new NullPointerException
48757
8cc67294ec56 8194251: Deadlock between UsageTracker and System.getProperty() when using a malformed security policy
apetcher
parents: 48080
diff changeset
  1998
                    (LocalizedMessage.getNonlocalized("type.can.t.be.null"));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1999
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2000
            this.type = type;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2001
            this.name = name;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2002
            this.actions = actions;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2003
            if (certs != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2004
                // Extract the signer certs from the list of certificates.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2005
                for (int i=0; i<certs.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2006
                    if (!(certs[i] instanceof X509Certificate)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2007
                        // there is no concept of signer certs, so we store the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2008
                        // entire cert array
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2009
                        this.certs = certs.clone();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2010
                        break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2011
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2012
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2013
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2014
                if (this.certs == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2015
                    // Go through the list of certs and see if all the certs are
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2016
                    // signer certs.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2017
                    int i = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2018
                    int count = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2019
                    while (i < certs.length) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2020
                        count++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2021
                        while (((i+1) < certs.length) &&
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2022
                            ((X509Certificate)certs[i]).getIssuerDN().equals(
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2023
                            ((X509Certificate)certs[i+1]).getSubjectDN())) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2024
                            i++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2025
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2026
                        i++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2027
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2028
                    if (count == certs.length) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2029
                        // All the certs are signer certs, so we store the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2030
                        // entire array
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2031
                        this.certs = certs.clone();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2032
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2033
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2034
                    if (this.certs == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2035
                        // extract the signer certs
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  2036
                        List<Certificate> signerCerts = new ArrayList<>();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2037
                        i = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2038
                        while (i < certs.length) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2039
                            signerCerts.add(certs[i]);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2040
                            while (((i+1) < certs.length) &&
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2041
                                ((X509Certificate)certs[i]).getIssuerDN().equals(
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2042
                                ((X509Certificate)certs[i+1]).getSubjectDN())) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2043
                                i++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2044
                            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2045
                            i++;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2046
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2047
                        this.certs = new Certificate[signerCerts.size()];
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2048
                        signerCerts.toArray(this.certs);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2049
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2050
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2051
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2052
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2053
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2054
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2055
         * This method always returns false for SelfPermission permissions.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2056
         * That is, an SelfPermission never considered to
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2057
         * imply another permission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2058
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2059
         * @param p the permission to check against.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2060
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2061
         * @return false.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2062
         */
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  2063
        @Override public boolean implies(Permission p) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2064
            return false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2065
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2066
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2067
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2068
         * Checks two SelfPermission objects for equality.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2069
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2070
         * Checks that <i>obj</i> is an SelfPermission, and has
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2071
         * the same type (class) name, permission name, actions, and
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2072
         * certificates as this object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2073
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2074
         * @param obj the object we are testing for equality with this object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2075
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2076
         * @return true if obj is an SelfPermission, and has the same
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2077
         * type (class) name, permission name, actions, and
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2078
         * certificates as this object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2079
         */
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  2080
        @Override public boolean equals(Object obj) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2081
            if (obj == this)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2082
                return true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2083
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2084
            if (! (obj instanceof SelfPermission))
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2085
                return false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2086
            SelfPermission that = (SelfPermission) obj;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2087
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2088
            if (!(this.type.equals(that.type) &&
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2089
                this.name.equals(that.name) &&
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2090
                this.actions.equals(that.actions)))
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2091
                return false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2092
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2093
            if (this.certs.length != that.certs.length)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2094
                return false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2095
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2096
            int i,j;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2097
            boolean match;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2098
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2099
            for (i = 0; i < this.certs.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2100
                match = false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2101
                for (j = 0; j < that.certs.length; j++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2102
                    if (this.certs[i].equals(that.certs[j])) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2103
                        match = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2104
                        break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2105
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2106
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2107
                if (!match) return false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2108
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2109
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2110
            for (i = 0; i < that.certs.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2111
                match = false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2112
                for (j = 0; j < this.certs.length; j++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2113
                    if (that.certs[i].equals(this.certs[j])) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2114
                        match = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2115
                        break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2116
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2117
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2118
                if (!match) return false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2119
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2120
            return true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2121
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2122
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2123
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2124
         * Returns the hash code value for this object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2125
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2126
         * @return a hash code value for this object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2127
         */
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  2128
        @Override public int hashCode() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2129
            int hash = type.hashCode();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2130
            if (name != null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2131
                hash ^= name.hashCode();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2132
            if (actions != null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2133
                hash ^= actions.hashCode();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2134
            return hash;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2135
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2136
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2137
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2138
         * Returns the canonical string representation of the actions,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2139
         * which currently is the empty string "", since there are no actions
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2140
         * for an SelfPermission. That is, the actions for the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2141
         * permission that will be created when this SelfPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2142
         * is resolved may be non-null, but an SelfPermission
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2143
         * itself is never considered to have any actions.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2144
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2145
         * @return the empty string "".
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2146
         */
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  2147
        @Override public String getActions() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2148
            return "";
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2149
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2150
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2151
        public String getSelfType() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2152
            return type;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2153
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2154
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2155
        public String getSelfName() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2156
            return name;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2157
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2158
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2159
        public String getSelfActions() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2160
            return actions;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2161
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2162
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2163
        public Certificate[] getCerts() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2164
            return certs;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2165
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2166
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2167
        /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2168
         * Returns a string describing this SelfPermission.  The convention
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2169
         * is to specify the class name, the permission name, and the actions,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2170
         * in the following format: '(unresolved "ClassName" "name" "actions")'.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2171
         *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2172
         * @return information about this SelfPermission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2173
         */
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  2174
        @Override public String toString() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2175
            return "(SelfPermission " + type + " " + name + " " + actions + ")";
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2176
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2177
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2178
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2179
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2180
     * holds policy information that we need to synch on
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2181
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2182
    private static class PolicyInfo {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2183
        private static final boolean verbose = false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2184
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2185
        // Stores grant entries in the policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2186
        final List<PolicyEntry> policyEntries;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2187
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2188
        // Maps aliases to certs
10336
0bb1999251f8 7064075: Security libraries don't build with javac -Xlint:all,-deprecation -Werror
jjg
parents: 9771
diff changeset
  2189
        final Map<Object, Object> aliasMapping;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2190
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2191
        // Maps ProtectionDomain to PermissionCollection
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  2192
        private final ProtectionDomainCache[] pdMapping;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2193
        private java.util.Random random;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2194
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2195
        PolicyInfo(int numCaches) {
15013
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  2196
            policyEntries = new ArrayList<>();
4a17ca431caf 7019834: Eliminate dependency from PolicyFile to com.sun.security.auth.PrincipalComparator
mullan
parents: 14342
diff changeset
  2197
            aliasMapping = Collections.synchronizedMap(new HashMap<>(11));
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2198
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  2199
            pdMapping = new ProtectionDomainCache[numCaches];
49588
ae568aefc5aa 8152821: Merge jdk.internal.misc.JavaSecurityAccess and jdk.internal.misc.JavaSecurityProtectionDomainAccess shared secrets
redestad
parents: 49285
diff changeset
  2200
            JavaSecurityAccess jspda
ae568aefc5aa 8152821: Merge jdk.internal.misc.JavaSecurityAccess and jdk.internal.misc.JavaSecurityProtectionDomainAccess shared secrets
redestad
parents: 49285
diff changeset
  2201
                = SharedSecrets.getJavaSecurityAccess();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2202
            for (int i = 0; i < numCaches; i++) {
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  2203
                pdMapping[i] = jspda.getProtectionDomainCache();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2204
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2205
            if (numCaches > 1) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2206
                random = new java.util.Random();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2207
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2208
        }
5183
7825d97c4cf2 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
mullan
parents: 4053
diff changeset
  2209
        ProtectionDomainCache getPdMapping() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2210
            if (pdMapping.length == 1) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2211
                return pdMapping[0];
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2212
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2213
                int i = java.lang.Math.abs(random.nextInt() % pdMapping.length);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2214
                return pdMapping[i];
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2215
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2216
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2217
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2218
}