FileDocCategorySizeDatePackage
MBeanServerAccessController.javaAPI DocJava SE 6 API19871Tue Jun 10 00:22:04 BST 2008com.sun.jmx.remote.security

MBeanServerAccessController

public abstract class MBeanServerAccessController extends Object implements MBeanServerForwarder

An object of this class implements the MBeanServer interface and, for each of its methods, calls an appropriate checking method and then forwards the request to a wrapped MBeanServer object. The checking method may throw a RuntimeException if the operation is not allowed; in this case the request is not forwarded to the wrapped object.

A typical use of this class is to insert it between a connector server such as the RMI connector and the MBeanServer with which the connector is associated. Requests from the connector client can then be filtered and those operations that are not allowed, or not allowed in a particular context, can be rejected by throwing a SecurityException in the corresponding check* method.

This is an abstract class, because in its implementation none of the checking methods does anything. To be useful, it must be subclassed and at least one of the checking methods overridden to do some checking. Some or all of the MBeanServer methods may also be overridden, for instance if the default checking behavior is inappropriate.

If there is no SecurityManager, then the access controller will refuse to create an MBean that is a ClassLoader, which includes MLets, or to execute the method addURL on an MBean that is an MLet. This prevents people from opening security holes unintentionally. Otherwise, it would not be obvious that granting write access grants the ability to download and execute arbitrary code in the target MBean server. Advanced users who do want the ability to use MLets are presumably advanced enough to handle policy files and security managers.

Fields Summary
private MBeanServer
mbs
Constructors Summary
Methods Summary
public voidaddNotificationListener(javax.management.ObjectName name, javax.management.NotificationListener listener, javax.management.NotificationFilter filter, java.lang.Object handback)
Call checkRead(), then forward this method to the wrapped object.

	checkRead();
	getMBeanServer().addNotificationListener(name, listener,
						 filter, handback);
public voidaddNotificationListener(javax.management.ObjectName name, javax.management.ObjectName listener, javax.management.NotificationFilter filter, java.lang.Object handback)
Call checkRead(), then forward this method to the wrapped object.

	checkRead();
	getMBeanServer().addNotificationListener(name, listener,
						 filter, handback);
private voidcheckClassLoader(java.lang.Object object)

	if (object instanceof ClassLoader)
	    throw new SecurityException("Access denied! Creating an " +
					"MBean that is a ClassLoader " +
					"is forbidden unless a security " +
					"manager is installed.");
private voidcheckMLetMethods(javax.management.ObjectName name, java.lang.String operation)

        // Check if security manager installed
        SecurityManager sm = System.getSecurityManager();
        if (sm != null) {
            return;
        }
        // Check for addURL and getMBeansFromURL methods
        if (!operation.equals("addURL") &&
                !operation.equals("getMBeansFromURL")) {
            return;
        }
        // Check if MBean is instance of MLet
        if (!getMBeanServer().isInstanceOf(name,
                "javax.management.loading.MLet")) {
            return;
        }
        // Throw security exception
        if (operation.equals("addURL")) { // addURL
            throw new SecurityException("Access denied! MLet method addURL " +
                    "cannot be invoked unless a security manager is installed.");
        } else { // getMBeansFromURL
            // Whether or not calling getMBeansFromURL is allowed is controlled
            // by the value of the "jmx.remote.x.mlet.allow.getMBeansFromURL"
            // system property. If the value of this property is true, calling
            // the MLet's getMBeansFromURL method is allowed. The default value
            // for this property is false.
            final String propName = "jmx.remote.x.mlet.allow.getMBeansFromURL";
            GetPropertyAction propAction = new GetPropertyAction(propName);
            String propValue = (String) AccessController.doPrivileged(propAction);
            boolean allowGetMBeansFromURL = "true".equalsIgnoreCase(propValue);
            if (!allowGetMBeansFromURL) {
                throw new SecurityException("Access denied! MLet method " +
                        "getMBeansFromURL cannot be invoked unless a " +
                        "security manager is installed or the system property " +
                        "-Djmx.remote.x.mlet.allow.getMBeansFromURL=true " +
                        "is specified.");
            }
        }
protected abstract voidcheckRead()
Check if the caller can do read operations. This method does nothing if so, otherwise throws SecurityException.

protected abstract voidcheckWrite()
Check if the caller can do write operations. This method does
nothing if so, otherwise throws SecurityException.
public javax.management.ObjectInstancecreateMBean(java.lang.String className, javax.management.ObjectName name, javax.management.ObjectName loaderName, java.lang.Object[] params, java.lang.String[] signature)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	SecurityManager sm = System.getSecurityManager();
	if (sm == null) {
	    Object object = getMBeanServer().instantiate(className,
							 loaderName,
							 params,
							 signature);
	    checkClassLoader(object);
	    return getMBeanServer().registerMBean(object, name);
	} else {
	    return getMBeanServer().createMBean(className, name, loaderName,
						params, signature);
	}
    
public javax.management.ObjectInstancecreateMBean(java.lang.String className, javax.management.ObjectName name)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	SecurityManager sm = System.getSecurityManager();
	if (sm == null) {
	    Object object = getMBeanServer().instantiate(className);
	    checkClassLoader(object);
	    return getMBeanServer().registerMBean(object, name);
	} else {
	    return getMBeanServer().createMBean(className, name);
	}
    
public javax.management.ObjectInstancecreateMBean(java.lang.String className, javax.management.ObjectName name, java.lang.Object[] params, java.lang.String[] signature)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	SecurityManager sm = System.getSecurityManager();
	if (sm == null) {
	    Object object = getMBeanServer().instantiate(className,
							 params,
							 signature);
	    checkClassLoader(object);
	    return getMBeanServer().registerMBean(object, name);
	} else {
	    return getMBeanServer().createMBean(className, name,
						params, signature);
	}
    
public javax.management.ObjectInstancecreateMBean(java.lang.String className, javax.management.ObjectName name, javax.management.ObjectName loaderName)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	SecurityManager sm = System.getSecurityManager();
	if (sm == null) {
	    Object object = getMBeanServer().instantiate(className,
							 loaderName);
	    checkClassLoader(object);
	    return getMBeanServer().registerMBean(object, name);
	} else {
	    return getMBeanServer().createMBean(className, name, loaderName);
	}
    
public java.io.ObjectInputStreamdeserialize(javax.management.ObjectName name, byte[] data)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().deserialize(name, data);
    
public java.io.ObjectInputStreamdeserialize(java.lang.String className, byte[] data)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().deserialize(className, data);
    
public java.io.ObjectInputStreamdeserialize(java.lang.String className, javax.management.ObjectName loaderName, byte[] data)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().deserialize(className, loaderName, data);
    
public java.lang.ObjectgetAttribute(javax.management.ObjectName name, java.lang.String attribute)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getAttribute(name, attribute);
    
public javax.management.AttributeListgetAttributes(javax.management.ObjectName name, java.lang.String[] attributes)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getAttributes(name, attributes);
    
public java.lang.ClassLoadergetClassLoader(javax.management.ObjectName loaderName)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getClassLoader(loaderName);
    
public java.lang.ClassLoadergetClassLoaderFor(javax.management.ObjectName mbeanName)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getClassLoaderFor(mbeanName);
    
public javax.management.loading.ClassLoaderRepositorygetClassLoaderRepository()
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getClassLoaderRepository();
    
public java.lang.StringgetDefaultDomain()
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getDefaultDomain();
    
public java.lang.String[]getDomains()
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getDomains();
    
public java.lang.IntegergetMBeanCount()
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getMBeanCount();
    
public javax.management.MBeanInfogetMBeanInfo(javax.management.ObjectName name)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getMBeanInfo(name);
    
public javax.management.MBeanServergetMBeanServer()
	return mbs;
    
public javax.management.ObjectInstancegetObjectInstance(javax.management.ObjectName name)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().getObjectInstance(name);
    
public java.lang.Objectinstantiate(java.lang.String className)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	return getMBeanServer().instantiate(className);
    
public java.lang.Objectinstantiate(java.lang.String className, java.lang.Object[] params, java.lang.String[] signature)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	return getMBeanServer().instantiate(className, params, signature);
    
public java.lang.Objectinstantiate(java.lang.String className, javax.management.ObjectName loaderName)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	return getMBeanServer().instantiate(className, loaderName);
    
public java.lang.Objectinstantiate(java.lang.String className, javax.management.ObjectName loaderName, java.lang.Object[] params, java.lang.String[] signature)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	return getMBeanServer().instantiate(className, loaderName,
					    params, signature);
    
public java.lang.Objectinvoke(javax.management.ObjectName name, java.lang.String operationName, java.lang.Object[] params, java.lang.String[] signature)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
        checkMLetMethods(name, operationName);
	return getMBeanServer().invoke(name, operationName, params, signature);
    
public booleanisInstanceOf(javax.management.ObjectName name, java.lang.String className)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().isInstanceOf(name, className);
    
public booleanisRegistered(javax.management.ObjectName name)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().isRegistered(name);
    
public java.util.SetqueryMBeans(javax.management.ObjectName name, javax.management.QueryExp query)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().queryMBeans(name, query);
    
public java.util.SetqueryNames(javax.management.ObjectName name, javax.management.QueryExp query)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	return getMBeanServer().queryNames(name, query);
    
public javax.management.ObjectInstanceregisterMBean(java.lang.Object object, javax.management.ObjectName name)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	return getMBeanServer().registerMBean(object, name);
    
public voidremoveNotificationListener(javax.management.ObjectName name, javax.management.NotificationListener listener)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	getMBeanServer().removeNotificationListener(name, listener);
    
public voidremoveNotificationListener(javax.management.ObjectName name, javax.management.NotificationListener listener, javax.management.NotificationFilter filter, java.lang.Object handback)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	getMBeanServer().removeNotificationListener(name, listener,
						    filter, handback);
    
public voidremoveNotificationListener(javax.management.ObjectName name, javax.management.ObjectName listener)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	getMBeanServer().removeNotificationListener(name, listener);
    
public voidremoveNotificationListener(javax.management.ObjectName name, javax.management.ObjectName listener, javax.management.NotificationFilter filter, java.lang.Object handback)
Call checkRead(), then forward this method to the
wrapped object.
	checkRead();
	getMBeanServer().removeNotificationListener(name, listener,
						    filter, handback);
    
public voidsetAttribute(javax.management.ObjectName name, javax.management.Attribute attribute)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	getMBeanServer().setAttribute(name, attribute);
    
public javax.management.AttributeListsetAttributes(javax.management.ObjectName name, javax.management.AttributeList attributes)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	return getMBeanServer().setAttributes(name, attributes);
    
public voidsetMBeanServer(javax.management.MBeanServer mbs)
	if (mbs == null)
	    throw new IllegalArgumentException("Null MBeanServer");
	if (this.mbs != null)
	    throw new IllegalArgumentException("MBeanServer object already " +
					       "initialized");
	this.mbs = mbs;
    
public voidunregisterMBean(javax.management.ObjectName name)
Call checkWrite(), then forward this method to the
wrapped object.
	checkWrite();
	getMBeanServer().unregisterMBean(name);