Is SecurityManager a complete security solution?

Question

Can I avoid using third-party code to create new threads, start new virtual machines, or leak data using the custom SecurityManager?

Answer 1

Creating a topic leads to a call securityManager.checkAccess(g)where g- ThreadGroup. This, in turn, requires SecurityConstants.MODIFY_THREADGROUP_PERMISSION.

The only way to create a new instance of the JVM is to start a new process. This will require SecurityConstraints.FILE_EXECUTE_ACTION.

So, if your SecurityManager throws an exception for both of these permissions, your first 2 cases will be covered.

, " ". ? , ..?

Answer 2

( ).

, SecurityManager ( , , ). , , ( , ..) - , SecurityManager.

, . , Java Sun 3-4 (Java 6u15 ) Java. 3-4 ( , , Oracle). , ~ 12 .

- , SecurityManager , . ( , Java, SecurityManager, .)

Answer 3

You can certainly do the first two things. However, I'm not sure what you mean by "data leakage."

Please note: you do not need a special SecurityManager, you only need a policy file.