Load class with restricted previledges

Hi all,

I would like to load a ".class" file using a code similar to:

Class c = Class.forName("org.somepackage.TestClass");

TestClass tc = (TestClass) c.newInstance();

tc.run();

1) I would like the instance of the TestClass to have restricted priveldges, less than the calling code. How can it be done?

2) Once the privedges for the instance is set, will it always have the same permissions until otherwise changed. Also, i would like the calling code to continue to have the normal permission as before.

Please help.

Thanks in advance.

[591 byte] By [anandaraja84a] at [2007-10-3 0:32:49]
# 1
Subclass java.security.SecureClassLoader. You'll have to override and use its loadClass() method rather than just Class.forName() but otherwise it plus an appopriate policy file will do what you want.
ejpa at 2007-7-14 17:26:17 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 2
Can you provide me link to sample source code or paste the source code here?
anandaraja84a at 2007-7-14 17:26:17 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 3
Why? Can't you find it yourself?
ejpa at 2007-7-14 17:26:17 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 4
Sir,Am a novice in Java Security. I am unable to find a proper lead. All of these policies, security manager etc confuse me.If you could help me i would be thankful.
anandaraja84a at 2007-7-14 17:26:17 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 5
Well in my humble opinion a novice in Java shouldn't be doing this kind of work actually and he should be professional enough to point this out to his employers. This piece of work has serious security implications which need to be appreciated at the design and coding stage.
ejpa at 2007-7-14 17:26:17 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 6

> Well in my humble opinion a novice in Java shouldn't

> be doing this kind of work actually and he should be

> professional enough to point this out to his

> employers. This piece of work has serious security

> implications which need to be appreciated at the

> design and coding stage.

That's funny. I couldn't find anything in the original post that said this was for an employer. How do you know s/he's doing anything more than trying to get a basic understanding Java's security system?

I don't usually respond to posts like this, but I found it ironic that you were making recommendations on how to act like a "professional".

Ryan

vacodea at 2007-7-14 17:26:17 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 7
You're right, I am guessing, but it's not the sort of thing that comes up as homework and my concern was really for the integrity of the resulting system if it's being built by a novice.Even a novice should be able to learn how to use the Javadoc ;-)
ejpa at 2007-7-14 17:26:17 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 8
plz dont answer in this forum
satyabrataa at 2007-7-14 17:26:17 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 9
Eh?
ejpa at 2007-7-14 17:26:17 > top of Java-index,Security,Other Security APIs, Tools, and Issues...