1 /*

     2  * Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 /*

    27  * This file is available under and governed by the GNU General Public

    28  * License version 2 only, as published by the Free Software Foundation.

    29  * However, the following notice accompanied the original version of this

    30  * file, and Oracle licenses the original version of this file under the BSD

    31  * license:

    32  */

    33 /*

    34    Copyright 2009-2013 Attila Szegedi

    35 

    36    Licensed under both the Apache License, Version 2.0 (the "Apache License")

    37    and the BSD License (the "BSD License"), with licensee being free to

    38    choose either of the two at their discretion.

    39 

    40    You may not use this file except in compliance with either the Apache

    41    License or the BSD License.

    42 

    43    If you choose to use this file in compliance with the Apache License, the

    44    following notice applies to you:

    45 

    46        You may obtain a copy of the Apache License at

    47 

    48            http://www.apache.org/licenses/LICENSE-2.0

    49 

    50        Unless required by applicable law or agreed to in writing, software

    51        distributed under the License is distributed on an "AS IS" BASIS,

    52        WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

    53        implied. See the License for the specific language governing

    54        permissions and limitations under the License.

    55 

    56    If you choose to use this file in compliance with the BSD License, the

    57    following notice applies to you:

    58 

    59        Redistribution and use in source and binary forms, with or without

    60        modification, are permitted provided that the following conditions are

    61        met:

    62        * Redistributions of source code must retain the above copyright

    63          notice, this list of conditions and the following disclaimer.

    64        * Redistributions in binary form must reproduce the above copyright

    65          notice, this list of conditions and the following disclaimer in the

    66          documentation and/or other materials provided with the distribution.

    67        * Neither the name of the copyright holder nor the names of

    68          contributors may be used to endorse or promote products derived from

    69          this software without specific prior written permission.

    70 

    71        THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS

    72        IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED

    73        TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

    74        PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL COPYRIGHT HOLDER

    75        BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

    76        CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

    77        SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR

    78        BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,

    79        WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR

    80        OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF

    81        ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

    82 */

    83 

    84 package jdk.internal.dynalink.beans;

    85 

    86 import static jdk.internal.org.objectweb.asm.Opcodes.ACC_PUBLIC;

    87 import static jdk.internal.org.objectweb.asm.Opcodes.ASM4;

    88 

    89 import java.io.IOException;

    90 import java.io.InputStream;

    91 import java.security.Permissions;

    92 import java.security.ProtectionDomain;

    93 import java.security.SecureClassLoader;

    94 import java.security.SecureRandom;

    95 import jdk.internal.org.objectweb.asm.ClassReader;

    96 import jdk.internal.org.objectweb.asm.ClassVisitor;

    97 import jdk.internal.org.objectweb.asm.ClassWriter;

    98 import jdk.internal.org.objectweb.asm.MethodVisitor;

    99 

   100 /**

   101  * A utility class that can load a class with specified name into an isolated zero-permissions protection domain. It can

   102  * be used to load classes that perform security-sensitive operations with no privileges at all, therefore ensuring such

   103  * operations will only succeed if they would require no permissions, as well as to make sure that if these operations

   104  * bind some part of the security execution context to their results, the bound security context is completely

   105  * unprivileged. Such measures serve as firebreaks against accidental privilege escalation.

   106  */

   107 final class SandboxClassLoader {

   108     private final String className;

   109     private final String randomizedClassName;

   110 

   111     private SandboxClassLoader(String className) {

   112         this.className = className;

   113         final String simpleClassName = className.substring(className.lastIndexOf('.') + 1);

   114         this.randomizedClassName = "randomPackage" + Long.toHexString(new SecureRandom().nextLong()) + "." + simpleClassName;

   115     }

   116 

   117     /**

   118      * Load the named class into a zero-permissions protection domain. Even if the class is already loaded into the

   119      * Dynalink's class loader, an independent class is created from the same bytecode, thus the returned class will

   120      * never be identical with the one that might already be loaded. The class to be loaded is supposed to be package

   121      * private and have no public constructors. This is not a functional requirement, but it is enforced to ensure that

   122      * the original class was made adequately inaccessible. The returned class will be public and its constructors will

   123      * be changed to public. The only permission given to the returned class will be

   124      * {@code accessClassInPackage.jdk.internal.dynalink.beans.sandbox}. That package should be used solely to define

   125      * SPI interfaces implemented by the loaded class.

   126      * @param className the fully qualified name of the class to load

   127      * @return the loaded class, renamed to a random package, made public, its constructors made public, and lacking any

   128      * permissions except access to the sandbox package.

   129      * @throws SecurityException if the calling code lacks the {@code createClassLoader} runtime permission. This

   130      * normally means that Dynalink itself is running as untrusted code, and whatever functionality was meant to be

   131      * isolated into an unprivileged class is likely okay to be used directly too.

   132      */

   133     static Class<?> loadClass(String className) throws SecurityException {

   134         return new SandboxClassLoader(className).loadClass();

   135     }

   136 

   137     private Class<?> loadClass() throws SecurityException {

   138         final ClassLoader loader = createClassLoader();

   139         try {

   140             final Class<?> clazz = Class.forName(randomizedClassName, true, loader);

   141             // Sanity check to ensure we didn't accidentally pick up the class from elsewhere

   142             if(clazz.getClassLoader() != loader) {

   143                 throw new AssertionError(randomizedClassName + " was loaded from a different class loader");

   144             }

   145             return clazz;

   146         } catch(ClassNotFoundException e) {

   147             throw new AssertionError(e);

   148         }

   149     }

   150 

   151     private ClassLoader createClassLoader() throws SecurityException {

   152         final String lclassName = this.randomizedClassName;

   153         // We deliberately override loadClass instead of findClass so that we don't give a chance to finding this

   154         // class already loaded anywhere else. We use this class' loader as the parent class loader as the loaded class

   155         // needs to be able to access implemented interfaces from the sandbox package.

   156         return new SecureClassLoader(getClass().getClassLoader()) {

   157             @Override

   158             protected Class<?> loadClass(String name, boolean resolve) throws ClassNotFoundException {

   159                 if(name.equals(lclassName)) {

   160                     final byte[] bytes = getClassBytes();

   161                     // Define the class with a protection domain that grants (almost) no permissions.

   162                     Class<?> clazz = defineClass(name, bytes, 0, bytes.length, createMinimalPermissionsDomain());

   163                     if(resolve) {

   164                         resolveClass(clazz);

   165                     }

   166                     return clazz;

   167                 }

   168 

   169                 final int i = name.lastIndexOf('.');

   170                 if (i != -1) {

   171                     final SecurityManager sm = System.getSecurityManager();

   172                     if (sm != null) {

   173                         sm.checkPackageAccess(name.substring(0, i));

   174                     }

   175                 }

   176                 return super.loadClass(name, resolve);

   177             }

   178         };

   179     }

   180 

   181     /**

   182      * Create a no-permissions protection domain. Except, it's not really a no-permissions protection domain, since we

   183      * need to give the protection domain the permission to access the sandbox package where the interop interfaces are

   184      * defined.

   185      * @return a new (almost) no-permission protection domain.

   186      */

   187     private static ProtectionDomain createMinimalPermissionsDomain() {

   188         final Permissions p = new Permissions();

   189         p.add(new RuntimePermission("accessClassInPackage.jdk.internal.dynalink.beans.sandbox"));

   190         return new ProtectionDomain(null, p);

   191     }

   192 

   193     private byte[] getClassBytes() {

   194         try(final InputStream in = getClass().getResourceAsStream("/" + className.replace('.', '/') + ".class")) {

   195             final ClassReader cr = new ClassReader(in);

   196             final ClassWriter cw = new ClassWriter(cr, 0);

   197             cr.accept(new ClassVisitor(ASM4, cw) {

   198                 @Override

   199                 public void visit(int version, int access, String name, String signature, String superName,

   200                         String[] interfaces) {

   201                     // Rename the class to its random name, and make it public (otherwise we won't be able to

   202                     // instantiate it). The privileged template class is package-private.

   203                     if((access & ACC_PUBLIC) != 0) {

   204                         throw new IllegalArgumentException("Class " + className + " must be package-private");

   205                     }

   206                     super.visit(version, access | ACC_PUBLIC, randomizedClassName.replace('.', '/'),

   207                             signature, superName, interfaces);

   208                 }

   209 

   210                 @Override

   211                 public MethodVisitor visitMethod(int access, String name, String desc, String signature,

   212                         String[] exceptions) {

   213                     // Make the constructor(s) public (otherwise we won't be able to instantiate the class). The

   214                     // privileged template's constructor(s) should not be public.

   215                     final boolean isCtor = "<init>".equals(name);

   216                     if(isCtor && ((access & ACC_PUBLIC) != 0)) {

   217                         throw new IllegalArgumentException("Class " + className + " must have no public constructors");

   218                     }

   219                     return super.visitMethod(isCtor ? (access | ACC_PUBLIC) : access, name, desc, signature,

   220                             exceptions);

   221                 }

   222             }, 0);

   223             return cw.toByteArray();

   224         } catch(IOException e) {

   225             throw new RuntimeException(e);

   226         }

   227     }

   228 }