// This example is from _Java Examples in a Nutshell_. (http://www.oreilly.com)
// Copyright (c) 1997 by David Flanagan
// This example is provided WITHOUT ANY WARRANTY either expressed or implied.
// You may study, use, modify, and distribute it for non-commercial purposes.
// For any commercial use, see http://www.davidflanagan.com/javaexamples
import java.net.*;
import java.io.*;
import Server.*;
/**
* This class is a program that uses the Server class defined in Chapter 9.
* Server would load arbitrary "Service" classes to provide services.
* This class is an alternative program to start up a Server in a similar
* way. The difference is that this one uses a SecurityManager and a
* ClassLoader to prevent the Service classes from doing anything damaging
* or malicious on the local system. This allows us to safely run Service
* classes that come from untrusted sources.
**/
public class SafeServer {
public static void main(String[] args) {
try {
// Install the Security manager
System.setSecurityManager(new ServiceSecurityManager());
// Create the ClassLoader that we'll use to load Service classes.
// The classes should be stored in (or beneath) the directory specified
// as the first command-line argument
LocalClassLoader loader = new LocalClassLoader(args[0]);
// Create a Server object that does no logging and
// has a limit of five concurrent connections at once.
Server server = new Server(null, 5);
// Parse the argument list, which should contain Service name/port pairs.
// For each pair, load the named Service using the class loader, then
// instantiate it with newInstance(), then tell the server to start
// running it.
int i = 1;
while(i < args.length) {
Class serviceClass = loader.loadClass(args[i++]); // dynamic load
Service service = (Service)serviceClass.newInstance(); // instantiate
int port = Integer.parseInt(args[i++]); // get port
server.addService(service, port); // run service
}
}
catch (Exception e) { // Display a message if anything goes wrong
System.err.println(e);
System.err.println("Usage: java SafeServer " +
"<servicedir> <servicename> <port>\n" +
"\t\t[<servicename> <port> ... ]");
System.exit(1);
}
}
/**
* This is a fairly uptight security manager subclass. Classes loaded by
* a ClassLoader are highly restricted in what they are allowed to do.
* This is okay, because our Service classes have a very narrowly defined
* task: to read from one stream and send output to another.
*
* A SecurityManager consists of various methods that the system calls to
* check whether certain sensitive operations should be allowed. These
* methods can throw a SecurityException to prevent the operation from
* happening. With this SecurityManager, we want to prevent untrusted
* code that was loaded by a class loader from performing those sensitive
* operations. So we use inherited SecurityManager methods to check
* whether the call is being made by an untrusted class. If it is, we
* throw an exception. Otherwise, we simply return, allowing the
* operation to proceed normally.
**/
public static class ServiceSecurityManager extends SecurityManager {
/**
* This is the basic method that tests whether there is a class loaded
* by a ClassLoader anywhere on the stack. If so, it means that that
* untrusted code is trying to perform some kind of sensitive operation.
* We prevent it from performing that operation by throwing an exception.
* trusted() is called by most of the check...() methods below.
**/
protected void trusted() {
if (inClassLoader()) throw new SecurityException();
}
/**
* This is a variant on the trusted() method above. There are a couple
* of methods that loaded code should not be able to call directly, but
* which system methods invoked by the loaded code still need to be
* able to call. So for these, we only throw an exception if a
* loaded class is the third thing on the call stack. I.e. right above
* this method and the check...() method that invoked it
**/
protected void trustedOrIndirect() {
if (classLoaderDepth() == 3) throw new SecurityException();
}
/**
* Here's another variant. It denies access if a loaded class attempts
* the operation directly or through one level of indirection. It is used
* to prevent loaded code from calling Runtime.load(), or
* System.loadLibrary() (which calls Runtime.load()).
**/
protected void trustedOrIndirect2() {
int depth = classLoaderDepth();
if ((depth == 3) || (depth == 4)) throw new SecurityException();
}
/**
* These are all the specific checks that a security manager can
* perform. They all just call one of the methods above and throw a
* SecurityException if the operation is not allowed. This
* SecurityManager subclass is perhaps a little too restrictive. For
* example, it doesn't allow loaded code to read *any* system properties,
* even though some of them are quite harmless.
**/
public void checkCreateClassLoader() { trustedOrIndirect(); }
public void checkAccess(Thread g) { trusted(); }
public void checkAccess(ThreadGroup g) { trusted(); }
public void checkExit(int status) { trusted(); }
public void checkExec(String cmd) { trusted(); }
public void checkLink(String lib) { trustedOrIndirect2(); }
public void checkRead(FileDescriptor fd) { trusted(); }
public void checkRead(String file) { trusted(); }
public void checkRead(String file, Object context) { trusted(); }
public void checkWrite(FileDescriptor fd) { trusted(); }
public void checkWrite(String file) { trusted(); }
public void checkDelete(String file) { trusted(); }
public void checkConnect(String host, int port) { trusted(); }
public void checkConnect(String host,int port,Object context) {trusted();}
public void checkListen(int port) { trusted(); }
public void checkAccept(String host, int port) { trusted(); }
public void checkMulticast(InetAddress maddr) { trusted(); }
public void checkMulticast(InetAddress maddr, byte ttl) { trusted(); }
public void checkPropertiesAccess() { trustedOrIndirect(); }
public void checkPropertyAccess(String key) { trustedOrIndirect(); }
public void checkPrintJobAccess() { trusted(); }
public void checkSystemClipboardAccess() { trusted(); }
public void checkAwtEventQueueAccess() { trusted(); }
public void checkSetFactory() { trusted(); }
public void checkMemberAccess(Class clazz, int which) { trusted(); }
public void checkSecurityAccess(String provider) { trusted(); }
/** Loaded code can only load classes from java.* packages */
public void checkPackageAccess(String pkg) {
if (inClassLoader() && !pkg.startsWith("java."))
throw new SecurityException();
}
/** Loaded code can't define classes in java.* or sun.* packages */
public void checkPackageDefinition(String pkg) {
if (inClassLoader() && (pkg.startsWith("java.")||pkg.startsWith("sun.")))
throw new SecurityException();
}
/**
* This is the one SecurityManager method that is different from the
* others. It indicates whether a top-level window should display an
* "untrusted" warning. The window is always allowed to be created, so
* this method is not normally meant to throw an exception. It should
* return true if the window does not need to display the warning, and
* false if it does. In this example, however, our text-based Service
* classes should never need to create windows, so we will actually
* throw an exception to prevent any windows from being opened.
**/
public boolean checkTopLevelWindow(Object window) {
trusted();
return true;
}
}
/**
* In order to impose tight security restrictions on untrusted classes but
* not on trusted system classes, we have to be able to distinguish between
* those types of classes. This is done by keeping track of how the classes
* are loaded into the system. By definition, any class that the interpreter
* loads directly from the CLASSPATH is trusted. This means that we can't
* load untrusted code in that way--we can't load it with Class.forName().
* Instead, we create a ClassLoader subclass to load the untrusted code.
* This one loads classes from a specified directory (which should not
* be part of the CLASSPATH).
**/
public static class LocalClassLoader extends ClassLoader {
/** This is the directory from which the classes will be loaded */
String directory;
/** The constructor. Just initialize the directory */
public LocalClassLoader(String dir) { directory = dir; }
/** A convenience method that calls the 2-argument form of this method */
public Class loadClass(String name) throws ClassNotFoundException {
return loadClass(name, true);
}
/**
* This is one abstract method of ClassLoader that all subclasses must
* define. Its job is to load an array of bytes from somewhere and to
* pass them to defineClass(). If the resolve argument is true, it must
* also call resolveClass(), which will do things like verify the presence
* of the superclass. Because of this second step, this method may be
* called to load superclasses that are system classes, and it must take
* this into account.
**/
public Class loadClass(String classname, boolean resolve)
throws ClassNotFoundException {
try {
// Our ClassLoader superclass has a built-in cache of classes it has
// already loaded. So, first check the cache.
Class c = findLoadedClass(classname);
// After this method loads a class, it will be called again to
// load the superclasses. Since these may be system classes, we've
// got to be able to load those too. So try to load the class as
// a system class (i.e. from the CLASSPATH) and ignore any errors
if (c == null) {
try { c = findSystemClass(classname); }
catch (Exception e) {}
}
// If the class wasn't found by either of the above attempts, then
// try to load it from a file in (or beneath) the directory
// specified when this ClassLoader object was created. Form the
// filename by replacing all dots in the class name with
// (platform-independent) file separators and by adding the
// ".class" extension.
if (c == null) {
// Figure out the filename
String filename = classname.replace('.',File.separatorChar)+".class";
// Create a File object. Interpret the filename relative to the
// directory specified for this ClassLoader.
File f = new File(directory, filename);
// Get the length of the class file, allocate an array of bytes for
// it, and read it in all at once.
int length = (int) f.length();
byte[] classbytes = new byte[length];
DataInputStream in = new DataInputStream(new FileInputStream(f));
in.readFully(classbytes);
in.close();
// Now call an inherited method to convert those bytes into a Class
c = defineClass(classname, classbytes, 0, length);
}
// If the resolve argument is true, call the inherited resolveClass
// method.
if (resolve) resolveClass(c);
// And we're done. Return the Class object we've loaded.
return c;
}
// If anything goes wrong, throw a ClassNotFoundException error
catch (Exception e) { throw new ClassNotFoundException(e.toString()); }
}
}
/**
* This is a demonstration service. It attempts to do things that the
* ServiceSecurityManager doesn't allow, and sends the results of
* its attempts to the client.
**/
public static class ProhibitedService implements Service {
public void serve(InputStream i, OutputStream o) throws IOException {
PrintWriter out = new PrintWriter(new OutputStreamWriter(o));
out.print("Attempting to read a file...");
try { new FileInputStream("testfile"); }
catch (Exception e) { out.println("Failed: " + e); }
out.print("Attempting to write a file...");
try { new FileOutputStream("testfile"); }
catch (Exception e) { out.println("Failed: " + e); }
out.print("Attempting to read system property...");
try { System.getProperty("java.version"); }
catch (Exception e) { out.println("Failed: " + e); }
out.print("Attempting to load a library...");
try { Runtime.getRuntime().load("testlib"); }
catch (Exception e) { out.println("Failed: " + e); }
out.close();
i.close();
}
}
}
|
