How get codesource of caller in SecurityManager, change perms based on it?

Question

I want to have a SecurityManager that does something like:
public void checkPermission(Permission perm)
      //Pseudo code
      if ( allowedList.contains( caller_context ) ) return;
      else
            //Pass to another SecurityManager object
            baseSecurityManager.checkPermission( perm );
}If I know what jar file the allowed code was loaded from how would I find out if the calling code's context is the same (from that jar or other jars I "OK" )?

Answer 1

Thanks for taking the time to help me on this! :)
* SecurityManager isn't designed for delegation to another SecurityManager. The variuos check* method may be overriden to allow extra permissions. If you don't delegate to the method that was originally called, you might miss something.I know that normally this is the case but the specs on this require it. :(
* The model is that every frame in the current AccesControlContext (acc) has the required permission. So you need to iterate through and throw when you find an unprivileged frame. This is what AccessControlContext.checkPermission does.Yeah, I was trying to iterate through the classes from getClassContext() but when i call getProtectionDomain(), it starts an endless loop.
* Use AccessController.getContext in preference to SecurityManag.getClassContext.Unfortunately, that doesn't help. You can't get at any of the classes/codesources/protectiondomain in the context. The only thing you can do is ask it if, according to it's internal algorithm, the permission is implied. I can't get any info about the calling class' codesource.
* (Since 1.4,) ProtectionDomain constructed with the four argument constructor are dynamic, and add permissions from the current Policy. This seems like what you want to do.Hmmm, there might be something here, but the problem is I don't think it will work as there will be an installed 3rd party SecurityManager that may or may not even pay attention to that. (I've been pretty surprised at the number of security manager implementations that don't check that stuff and simply return "OK")
* Source for SecurityManager and other classes is in src.zip of the JDK. SecurityManager.checkPermission, uses java.security.AccessController.Yeah, I checked this but it simply goes to native code which checks for info that's only available to Sun's JVm code.
Thanks again!