java - 为什么这个看似等效的 SecurityManager 代码会导致虚假异常？

Question

此问题是 my previous question about unusual exceptions generated by a custom security manager. 的后续问题在高层次上，我有兴趣构建一个运行受信任代码和不受信任代码的应用程序。我最初的想法是构建一个自定义的 SecurityManager，它会禁止大多数操作运行。这导致了异常行为，即实例化不受信任对象的受信任反射代码在 16 次调用后失败。

我重写了代码，而不是使用自定义 SecurityManager 来处理这个问题，而是创建一个新的保护域，在其中运行不受信任的代码，然后从该不受信任的代码中删除权限。这个新代码显示在这里:

import java.io.FilePermission;
import java.lang.reflect.*;
import java.security.*;

public class Main {
    /* Track how many instances have been created so that we can see when the exception
     * is thrown.
     */
    private static int numInstances = 0;
    public Main() {
        System.out.println("Number created: " + ++numInstances);
    }

    /* Utility function that returns a Constructor object for main. */
    private static Constructor<Main> getCtor() {
        try {
            return Main.class.getConstructor();
        } catch (NoSuchMethodException e) {
            e.printStackTrace();
            System.exit(-1);
            return null; // Unreachable, needed to appease compiler.
        }
    }

    /* Utility function that creates an AccessControlContext that only has file
     * read permissions.
     */
    private static AccessControlContext getContext() {
        CodeSource c = new CodeSource(null, (java.security.cert.Certificate[])null);
        Permissions permissions = new Permissions();

        /* Grant specific permission to read files. This is necessary, since otherwise the
         * class loader can't read classes from disk.
         */
        permissions.add(new FilePermission("*", "read"));

        /* Construct an AccessControlContext from these permissions. */
        return new AccessControlContext(new ProtectionDomain[] {new ProtectionDomain(c, permissions)});
    }

    public static void main(String[] args) {
        /* Get a very restrictive AccessControlContext that does not allow for anything to run. */
        AccessControlContext noPermissions = getContext();

        /* Install a standard security manager to enable security. */
        System.setSecurityManager(new SecurityManager());

        /* Sit in an infinite loop using reflection to create Main objects.  This code is
         * run in a context where its only permissions are file reading.
         */
        AccessController.doPrivileged(new PrivilegedAction<Void>() {
            @Override
            public Void run() {
                /* Continuously create new Main objects. */
                Constructor<Main> ctor = getCtor();
                try {
                    while (true) {
                        ctor.newInstance();
                    }
                } catch (Exception e) {
                    e.printStackTrace();
                    return null;
                }
            }
        }, noPermissions);

    }
}

这段代码现在可以正常工作了——它可以毫不费力地构造各种 Main 对象。

我感到困惑的是以下内容。为了让 AccessController 发挥作用，我们需要打开安全管理器。我通过调用来做到这一点

/* Install a standard security manager to enable security. */
System.setSecurityManager(new SecurityManager());

现在，假设我将其从默认 SecurityManager 更改为此自定义SecurityManager:

/* Install a standard security manager to enable security. */
System.setSecurityManager(new SecurityManager() {
    @Override
    public void checkPermission(Permission p) {
         /* Log the permission. */
         System.out.println("Checking " + p);
         super.checkPermission(p);
    }
});

此 SecurityManager 与之前相同，除了它会记录检查权限时发生的情况，然后将请求转发到默认的 SecurityManager。

如果我进行此更改并运行程序，我现在会得到与以前相同的行为:

Checking ("java.io.FilePermission" "/home/keith/Documents/secret-eclipse-workspace/Security Manager Test/bin/Main$2.class" "read")
Checking ("java.io.FilePermission" "/home/keith/Documents/secret-eclipse-workspace/Security Manager Test/bin/Main$2.class" "read")
Checking ("java.io.FilePermission" "/home/keith/Documents/secret-eclipse-workspace/Security Manager Test/bin/Main$2.class" "read")
Number created: 1
Number created: 2
Number created: 3
Number created: 4
Number created: 5
Number created: 6
Number created: 7
Number created: 8
Number created: 9
Number created: 10
Number created: 11
Number created: 12
Number created: 13
Number created: 14
Number created: 15
Checking ("java.lang.RuntimePermission" "createClassLoader")
java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "createClassLoader")
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:372)
    at java.security.AccessController.checkPermission(AccessController.java:559)
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
    at Main$1.checkPermission(Main.java:51)
    at java.lang.SecurityManager.checkCreateClassLoader(SecurityManager.java:611)
    at java.lang.ClassLoader.checkCreateClassLoader(ClassLoader.java:274)
    at java.lang.ClassLoader.<init>(ClassLoader.java:316)
    at sun.reflect.DelegatingClassLoader.<init>(ClassDefiner.java:72)
    at sun.reflect.ClassDefiner$1.run(ClassDefiner.java:60)
    at sun.reflect.ClassDefiner$1.run(ClassDefiner.java:58)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.reflect.ClassDefiner.defineClass(ClassDefiner.java:57)
    at sun.reflect.MethodAccessorGenerator$1.run(MethodAccessorGenerator.java:399)
    at sun.reflect.MethodAccessorGenerator$1.run(MethodAccessorGenerator.java:396)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.reflect.MethodAccessorGenerator.generate(MethodAccessorGenerator.java:395)
    at sun.reflect.MethodAccessorGenerator.generateConstructor(MethodAccessorGenerator.java:94)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:48)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:526)
    at Main$2.run(Main.java:65)
    at Main$2.run(Main.java:1)
    at java.security.AccessController.doPrivileged(Native Method)
    at Main.main(Main.java:58)

为什么我在使用此自定义 SecurityManager 前后会出现不同的行为？我不明白为什么程序会在这些情况下产生不同的结果，因为在这两种情况下，默认的 SecurityManager 是实际进行所有安全检查的那个。

谢谢!

Answer 1

您的 SecurityManager 中的代码似乎不受信任。所以当它出现在堆栈检查时，安全检查将失败。

为什么代码 main 和 run 不会导致同样的问题？我们可以从堆栈跟踪中看到那些参与安全检查的堆栈元素。

at java.security.AccessControlContext.checkPermission(AccessControlContext.java:372)
at java.security.AccessController.checkPermission(AccessController.java:559)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
at Main$1.checkPermission(Main.java:51)
at java.lang.SecurityManager.checkCreateClassLoader(SecurityManager.java:611)
at java.lang.ClassLoader.checkCreateClassLoader(ClassLoader.java:274)
at java.lang.ClassLoader.<init>(ClassLoader.java:316)
at sun.reflect.DelegatingClassLoader.<init>(ClassDefiner.java:72)
at sun.reflect.ClassDefiner$1.run(ClassDefiner.java:60)
at sun.reflect.ClassDefiner$1.run(ClassDefiner.java:58)
at java.security.AccessController.doPrivileged(Native Method)
at sun.reflect.ClassDefiner.defineClass(ClassDefiner.java:57)

唯一的非系统框架是 Main$1.checkPermission(Main.java:51)。删除它，问题就消失了。