Java Security Manager in Multi-threaded application

I am writing a multi-threaded application listening (TCP and UDP) to several ports. To help implement certain security features (eg. refusing connections from certain ip address), I'm using the java.lang.SecurityManager (by subclassing it). I am having a few problems and queries and am hoping someone here can help me.
1. As all the threads are calling the checkAccept(host, port) method. Is there a way to know which thread is currently accessing the security manager? For example if host A were to make 2 connections to the application, one to thread 1 (say listening to port 5001) and the other to to thread 2 (say listening to port 5002). I intend to refuse the connection to thread 2 but there is not way of differentiating the 2 connections since they are from the same host and there isnt any way of knowing their port number.
2. Are calls to the Security Manager thread safe?
I have been having this problem for a long time, would appreciate if someone can help point me to the right direction. cheers.

1. As all the threads are calling the
checkAccept(host, port) method. Is there a way to
know which thread is currently accessing the security
manager?Just use Thread.currentThread(). As specified in the Javadoc for e.g. SecurityManager.checkAccept().
2. Are calls to the Security Manager thread safe? No.

Similar Messages

Question using Java API in a multi threaded application for MDX queries

Currently I’m building a web application that makes a lot of MDX calls using the Essbase Java API. Each time we run an MDX call we basically run the following code:
IEssbase ess = IEssbase.Home.create(IEssbase.JAPI_VERSION);
IEssDomain dom = ess.signOn(userName, password, false, null, "embedded");
IEssCubeView cv = cv=dom.openCubeView("view", hostName, appName, cubeName);
IEssOpMdxQuery op = cv.createIEssOpMdxQuery();
op.setQuery(false,mdx,false,IEssOpMdxQuery.EEssMemberIdentifierType.NAME);
cv.performOperation(op);
IEssMdDataSet mddata = cv.getMdDataSet();
cv.close();
My questions is, is this the correct way to use the API in multi threaded environment where many users may be hitting the application at the same time? For every request do I need to create a separate IEssbase object and sign on to an IEssDomain? Or can I use a single IEssbase and IEssDomain object for the entire application? If not should I call the IEssDomain.signOff() method after each user’s request has completed? Which of the above objects are thread safe? I’m using Essabae 9.3.1. Any insight would be really appreciated.
Thanks
David

Thanks for the input friend,
I should have mentioned that in my application all
connections to Essbase use the same user name and
password so the filtering isn’t a concern. This is my
first Java application using Essbase has a data
source, I’m used to connecting to various SQL
databases and I always use a connection pool, how is
connection pooling handled in the Essbase java API?I'm not sure what happened to it since I never used it, but there used to be something called the High Availability Services or something that was essentially a connection pool for Essbase JAPI connections, but it required an extra license.
Since you don't care about identity (everyone has full access to everything), you can create your own connection pool, but you'll have to manage your multithreading yourself. Its been this way since the beginning. The C API isn't/wasn't thread-safe either (we tried).

Multi-Thread application and common data

I try to make a multi-Thread application. All the Threads will update some common data.
How could I access the variable �VALUE� with the Thread in the following code:
public class Demo {
private static long VALUE;
public Demo(long SvId) {
VALUE = 0;
public static class makeThread extends Thread {
public void run() {
VALUE++;
public static long getVALUE() {
return VALUE;
The goal is to get the �VALUE� updated by the Thread with �getVALUE()�
Thanks for your reply
Benoit

That code is so wrong in so many ways......
I know you're just experimenting here, learning what can and can't be done with Threads, but bad habits start early, and get harder to kick as time goes on. I am going to give a little explanation here about what's wrong, and what's right.. If you're going to do anything serious though, please, read some books, and don't pick up bad habits.
Alright, The "answer" code. You don't use Thread.sleep() to wait for Threads to finish. That's just silly, use the join() method. It blocks until the threads execution is done. So if you have a whole bunch of threads in an array, and you want to start them up, and then do something once they finish. Do this.
for(int k=0; k<threads.length; k++) {
threads[k].start();
for(int k=0; k<threads.length; k++) {
threads[k].join();
System.out.println("All Threads Done");Now that's the simple problem. No tears there.
On to the java memory model. Here where the eye water starts flowing. The program you have written is not guarenteed to do what you expect it to do, that is, increment VALUE some amount of time and then print it out. The program is not "Thread Safe".
Problem 1) - Atomic Operations and Synchronization
Incrementing a 'long' is not an atomic operation via the JVM spec, icrementing an int is, so if you change the type of VALUE to an int you don't have to worry about corruption here. If a long is required, or any method with more then one operation that must complete without another thread entering. Then you must learn how to use the synchronized keyword.
Problem 2) - Visiblity
To get at this problem you have to understand low level computing terms. The variable VALUE will NOT be written out to main memory every time you increment it. It will be stored in the CPUs cache. If you have more then one CPU, and different CPUs get those threads you are starting up, one CPU won't know what the other is doing. You get memory overwrites, and nothing you expect. If you solve problem 1 by using a synchronized block, you also solve problem 2, because updating a variable under a lock will cause full visiblity of the change. However, there is another keyword in java.. "volatile".. A field modified with this keyword will always have it's changes visible.
This is a very short explaination, barely scratching the surface. I won't even go into performance issues here. If you want to know more. Here's the resources.
Doug Lea's book
http://java.sun.com/docs/books/cp/
Doug Lea's Site
http://g.cs.oswego.edu
-Spinoza

Clarification of the handle/body idiom in multi threaded applications

Hello
As some DBXML classes use the handle-body idiom (handle/body idiom in some docs), could someone please clarify the consequences of that in a multi threaded application like a web container?
For 100% Java people, like me, this is known in the Java world as 'programming towards interfaces', or as the Bridge pattern; which is seen as good practice.
Let's take an example. The class XmlQueryContext is not thread safe, but it has a copy constructor. Imagine that your web application has one XmlQueryContext, that we never use in a query, but that we prepare only to be copied in new threads. Is it thus safe to instantiate various new XmlQueryContexts using that copy constructor in various new threads and use them simultaneously?
Thank you
Koen
PS What I am really asking here is if somebody could please translate the following to Java parlé:
A copy constructor is provided for this class. The class is implemented using a handle-body idiom. When a handle is copied both handles maintain a reference to the same body.

As a Java user you do not have to worry about how the C++ copy constructors behave. In the Java API if a copy constructor exists for the object, then the copy constructor will copy all of the original object's data into a new object (XmlContainer is the one exception to this rule, generally one should not use that copy constructor at all). So in short, what you plan to do will work.
Lauren Foutz

Trouble with java security manager

I have set up a security manager for my webapp running on Tomcat. The application enables the user to write his own scripts using Javascript, that's why I need to set up a security manager.
Using Rhino as script interpreter, it is possible to use the standard java security mechanisms, e.g. using the security manager to handle the scripts' rights.
I've added the following lines to my policy file:
// give server all rights
grant codeBase "file:webapp/WEB-INF/-" {
     permission java.security.AllPermission;
//rights granted to scripts
grant codeBase "file:restrictedClient" {
     permission java.io.FilePermission "webapp/WEB-INF/lib/js.jar", "read";
I've assigned the scripts to the "restrictedClient" code base. However, the script execution fails as the script does not have the permission to access or define classes of any package (even standard java packages like java.lang or java.math).
In java.security, I have found the following comment:
# List of comma-separated packages that start with or equal this string
# will cause a security exception to be thrown when
# passed to checkPackageDefinition unless the
# corresponding RuntimePermission ("defineClassInPackage."+package) has
# been granted.
# by default, no packages are restricted for definition, and none of
# the class loaders supplied with the JDK call checkPackageDefinition.
#package.definition=
I now wonder, why the checkPackageDefinition is checked though there's no entry for any package to be checked.
Extending the policy file like
grant codeBase "file:restrictedClient" {
     permission java.lang.RuntimePermission "accessClassInPackage.webapp/WEB-INF/classes/org/mozilla/javascript";
     permission java.io.FilePermission "webapp/WEB-INF/lib/js.jar", "read";
     permission java.lang.RuntimePermission "defineClassInPackage.java.io";
     permission java.lang.RuntimePermission "defineClassInPackage.java.util";
     permission java.lang.RuntimePermission "defineClassInPackage.java.net";
     permission java.lang.RuntimePermission "defineClassInPackage.java.sql";
     permission java.lang.RuntimePermission "defineClassInPackage.java.lang";
     permission java.lang.RuntimePermission "defineClassInPackage.java.math";
     permission java.lang.RuntimePermission "de.methodpark.pkit.facade.impl";
works, but an unpleasant feeling remains :-).
Rhino creates an own classloader for script execution. Could that be the source of the strange behaviour?
Any help would be appreciated!
Regards,
Matthias

David,
I was glad to see your post regarding WLS 9.2 and the troubles with enabling Java Security Manager.
Were you able to learn any more on things like - why doesn't the admin console work when the security manager is enabled with the default policy file. Also, why is it so difficult to add permissions for your own applications and get them to actually work.
I'd be curious to see if you were able to get it to work or if you have any insights or resources that can help with this as we are really struggling to get a restrictive policy file that works.
Thanks,
D

WebLogic Admin Console won't work with java security manager enabled.

By just enabling the security manager on the command line with -Djava.security.manager and using the default weblogic.policy in the server/lib directory, the admin console will not work. I just see a blank page when I try to access the admin console with permission errors all over on the server console.
In looking at the admin console's weblogic.xml it should have access to everything since it contains:
grant {
permission java.security.AllPermission;
Are there known issues with this? If I add this permission to the weblogic.policy file everything works fine but then I might as well not turn on the security manager.
Thanks,
Dave

David,
I was glad to see your post regarding WLS 9.2 and the troubles with enabling Java Security Manager.
Were you able to learn any more on things like - why doesn't the admin console work when the security manager is enabled with the default policy file. Also, why is it so difficult to add permissions for your own applications and get them to actually work.
I'd be curious to see if you were able to get it to work or if you have any insights or resources that can help with this as we are really struggling to get a restrictive policy file that works.
Thanks,
D

Immutable Objects in multi threaded application - how does it works?

Hi
I have this code will work in multithreaded application.
I know that immutable object is thread safe because its state cannot be changed. And if we have volatile reference, if is changed with e.g.
MyImmutableObject state = MyImmutableObject.newInstance(oldState, newArgs); i.e. if a thread wants to update the state it must create new immutable object initializing it with the old state and some new state arguments) and this will be visible to all other threads.
But the question is, if a thread2 starts long operation with the state, in the middle of which thread1 updates the state with new instance, what will happen? Thread2 will use reference to the old object state i.e. it will use inconsistent state? Or thread2 will see the change made by thread1 because the reference to state is volatile, and in this case thread1 can use in the first part of its long operation the old state and in the second part the new state, which is incorrect?
Therad1:                                                  Thead2:
State state = cache.get();     //t1
Result result1 = DoSomethingWithState(state);     //t1
                           State state = cache.get(); //t2
   ->longOperation1(state); //t1
                           Result result2 = DoSomethingWithState(state); //t2
                               ->longOperation1(state); //t2
   ->longOperation2(state);//t1
cache.update(result1);    //t1
                               ->longOperation2(state);//t2
                           cache.update(result2);//t2
Result DoSomethingWithState(State state) {
   longOperation1(state);
   //Imaging Thread1 finish here and update state, when Thread2 is going to execute next method
   longOperation2(state);
return result;
class cache {
private volatile State state = State.newInstance(null, null);
cache.update(result) {
   this.state = State.newInstance(result.getState, result.getNewFactors);
get(){
return state;
}

Please don't cross post
http://stackoverflow.com/questions/6803487/immutable-objects-in-multi-threaded-application-how-does-it-work

Multi-threaded application crashing the VM

Hi,
I have a multi-threaded (about 120 threads) application which crashes without after running for a while.
I get this in the windows event viewer
Faulting application java.exe, version 0.0.0.0, faulting module kernel32.dll, version 5.2.3790.0, fault address 0x000017b1.
Anyone knows why this would happen?
- vineet

Hi Alexis,
Thanks for the response to my post!!
Which version of the JVM?C:\>java -version
java version "1.4.2_05"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2_05-b04)
Java HotSpot(TM) Client VM (build 1.4.2_05-b04, mixed mode)
Are you using the -server option?I was not using this option earlier but even on using this the jvm crashes after running for sometime.
I am using these jvm options now -
java -server -Xss128K -Xms256M -Xmx512M
- vineet

Multi-thread application recompile object with make but runs with old value

Hi. I am working on a simulation in Java, and there is some behavior going on that I cannot understand. Granted, I'm a mechanical engineer, not a CS student (a fact that is probably made obvious by the code I'm posting below). The simulation comprises three parts: a controller, a robot, and a 3-d sensor. Here's the code for the "Simulation" application.
class Simulation {
    void go() {
     ThreeDSensor sensorRunner = new ThreeDSensor();
     VSController controllerRunner = new VSController();
     KukaKR15SL robotRunner = new KukaKR15SL();
     Thread sensorThread = new Thread(sensorRunner);
     Thread controllerThread = new Thread(controllerRunner);
     Thread robotThread = new Thread(robotRunner);
     sensorThread.start();
     try {
         Thread.sleep(1000); // Give sensorThread time to start in order to catch first triggers
     } catch(InterruptedException ex) {
         ex.printStackTrace();
     controllerThread.start();
     try {
         Thread.sleep(1000); // Give controllerThread time to open the socket for communication with robotThread
     } catch(InterruptedException ex) {
         ex.printStackTrace();
     robotThread.start();
    public static void main(String[] args) {
     Simulation sim = new Simulation();
     sim.go();
}I guess the big reason I'm using multi-threading is that once this simulation is working I want to be able to just run VSController alone and have it interface with a robot controller and a PC performing image processing. So with multiple threads I'm sending TCP and UDP messages around just like the final system will.
I have made an object for my VSController that just stores values used by the simulation. That way I could have them all in one place instead of hunting through methods to change them. One example is "double noiseThreshold". Quickly, here is the code for "ControllerSettings.java".
class ControllerSettings {
    final double cameraXOffset = 0; // If > 0 then the origin of the camera CS is not on the center line of the lens
    final double cameraYOffset = 0; // If > 0 then the origin of the camera CS is not on the center line of the lens
    final double cameraZOffset = 700; // The distance that must be kept between the camera and the target
    // Error magnitude less than this is disregarded (in centimeters if roundingData else in millimeters)
    final double noiseThreshold = 60;
    final boolean estimatingEndPoints = false; // If the controller is using two images per cycle then true
    final boolean roundingData = false;
    final boolean using3DData = true; // How double[] sent from Matlab image processing is used
     * If the robot controller uses the output of this controller to command
     * motions in cartesian space then true. This is used in two places: 1) initial guess of Jacobian,
     * and 2) "commandType" element sent to robot controller.
    final boolean useRobotControllerModel = false;
    final double thetaBumpValueForEstimationOfJacobian = .1; // Distance each joint is jogged in estimation process
    final double bumpDistance = 50; // Distance robot moves each time (magnitude of translation in mm)
    final double limitAngular = .5; // Max amout robot joint will be commanded to rotate (in degrees)
}And here is some pertinent code from "VSController.java".
class VSController implements Runnable{
    ControllerSettings cSettings; // Stores all the preferences used by the controller
    NGN controller; // This is the controller algorithm.
    int dof; // The degrees of freedom of the robot being controlled
    KukaSendData ksd; // This provides communication to the robot.
    protected DatagramSocket socketForVisionSystem = null;
    ImageFeaturesData ifd; // This parses and stores data from the image system.
    double[] errorVector; // This is what's acted on by the algorithm
    PrintWriter errorTrackerOut = null; // For analysis of error vector
    public void run() {
     VSController vsc = new VSController();
     vsc.go();
    public void go() {
     initWriters();
     cSettings = new ControllerSettings();
    public boolean isNoise() {
     boolean ret = false;
     double magnitude = 0;
     for (int i = 0; i < errorVector.length; i++) {
         magnitude += errorVector[i] * errorVector;
     magnitude = Math.sqrt(magnitude);
     if (magnitude <= cSettings.noiseThreshold) {
     System.out.println("VSController: magnitude (of errorVector) = " + magnitude +
               ", threshold = " + cSettings.noiseThreshold); // Debug
Now here's my issue: I change the value for "noiseThreshold" in "ControllerSettings.java" then run make from terminal (makefile code posted below) and rerun "Simulation". However, despite my changes to "ControllerSettings.java" the value for "noiseThreshold" is not changed, as evidenced by the output on the terminal screen:VSController: magnitude (of errorVector) = 6.085046125925263, threshold = 10.0 See, that value of 10.0 is what I used to have for noiseThreshold. I do not know why this value does not update even though I save the java file and execute make in between executions of Simulation. I would love it if someone could explain this problem to me.
Here's the contents of makefile.
JFLAGS = -cp ../Jama\-1\.0\.2.jar:../utils/:/usr/share/java/vecmath\-1\.5\.2.jar:.
JC = javac
.SUFFIXES: .java .class
.java.class:
     $(JC) $(JFLAGS) $*.java
CLASSES = \
     ControllerSettings.java \
     ImageFeaturesData.java \
     KukaKR15SL.java \
     ../utils/KukaSendData.java \
     NGN.java \
     Puma560.java \
     Robot.java \
     RobotSettings.java \
     Simulation.java \
     SimulationSettings.java \
     SixRRobot.java \
     Targets.java \
     TargetsSettings.java \
     ThreeDData.java \
     ThreeDSensor.java \
     VSController.java
default: classes
classes: $(CLASSES:.java=.class)
clean:
     $(RM) *.classEdited by: raequin on Apr 5, 2010 1:43 PM

I saw this explanation about what's causing my problem.
"When the Java compiler sees a reference to a final static primitive or String, it inserts the actual value of that constant into the class that uses it. If you then change the constant value in the defining class but don't recompile the using class, it will continue to use the old value."
I verified that the value updates if I also change something in VSController.java, forcing it to recompile. I think I will solve this problem by just making the variables in ControllerSettings no longer final (and then recompile VSController to make sure it takes effect!). Is there another solution? I saw intern(), but that seems to only apply to Strings.
Thanks.

Java.security.manager ?

My understanding about Java SecurityManager is when you want to use it,
it have to be installed. It can be installed through
using -Djava.security.manager
option with java command or calling setSecurityManager() in the application.
I'm sure that WLS startup script marketed with WLS5.1
used -Djava.security.manager
option, however, WLS6.1 and WLS7.0's script don't use the option. Do they
install a SecurityManager through setSecurityManager() method?
I'm just curious to know why they are different between WLS5.1 and
WLS6.1/7.0.
Thanks in advance,
Koji Sekiguchi

6.1 and 7.0 do not install a SecurityManager programattically. It was
decided that most people do not make use of the added security provided
by the security manager and that it has a significant performance hit on
the VM (I think we found 6-7% degradation but it was a long time ago so
I may be way off) so that it did not make sense to run with it by
default. Instead we tell people to turn it on who need it. It seems
better because all of the security conscious people know to look for it
and all of the security unaware folk don't know enough to turn it off so
they are stuck with the degradation.
The SecurityManager is really most helpful if you are installing
untrusted applications on your app server (something most users don't
do). It does next-to-nothing to prevent remote attacks.
Neil Smithline
Koji Sekiguchi wrote:
My understanding about Java SecurityManager is when you want to use it,
it have to be installed. It can be installed through
using -Djava.security.manager
option with java command or calling setSecurityManager() in the application.
I'm sure that WLS startup script marketed with WLS5.1
used -Djava.security.manager
option, however, WLS6.1 and WLS7.0's script don't use the option. Do they
install a SecurityManager through setSecurityManager() method?
I'm just curious to know why they are different between WLS5.1 and
WLS6.1/7.0.
Thanks in advance,
Koji Sekiguchi

Cannot start OC4J instance after specifying default java.security.manager

Hi All,
I am using OracleiAS 10.1.3.4 and trying to make use of the new User and Role APIs introduced in 10.1.3.1.
While trying to get an object of IdentityStore using the following code, I got this error -
java.security.PrivilegedActionException: oracle.security.idm.ConfigurationException: java.security.AccessControlException: access denied (oracle.security.jazn.JAZNPermission getOC4JIntegrationData)
oidFactory = (IdentityStoreFactory) AccessController.doPrivileged(
new PrivilegedExceptionAction()
public Object run() throws IMException
IdentityStoreFactoryBuilder builder =
new IdentityStoreFactoryBuilder();
return builder.getIdentityStoreFactory();
I then tried specifying the default security manager in start JAVA options for my oc4j instance - Djava.security.manager. I also verified that my java policy file is present under $ORACLE_HOME/j2ee/oc4j_soa/config/java2.policy. But the issue is - once I put this default secirity manager in startup options in opmn.xml, the oc4j instance does not get started, it gives following error -
08/12/30 02:58:22 Start process
Dec 30, 2008 2:58:24 AM com.evermind.server.XMLDataSourcesConfig parseRootNode
INFO: Legacy datasource detected...attempting to convert to new syntax.
08/12/30 02:58:29 WARNING: Application.setConfig Application: default is in failed state as initialization failed.
java.lang.ExceptionInInitializerError
08/12/30 02:58:29 Error initializing server: Application: default is in failed state as initialization failed
08/12/30 02:58:32 Fatal error: server exiting
Any idea ? Any pointers please ?
Thanks,
Ankit

Ankit,
Check your syntax for the datasource. If you migrated from file-based to OID, then you should look at this link:
http://download.oracle.com/docs/cd/E12524_01/relnotes.1013/e12523/oc4j.htmThere is a known issue when migrating from file-based to OIM\OID. Navigate to:
12.2 JAZNMigration Tool Does Not Migrate ADFPrincipal Type Correctly
-Michael

Java Security Error while Launching the Application through JNLP

Hi!,
I have a problem in launching my Application through JNLP. It is giving the Error dialog as "Unable to lauch application" with the dialog title as "Java Security Error".
I don't know why this problem is coming but when I have reset my profile on my system & then I tried to launch the same application & I got success.
Can anyone suggest me what was the problem?
Pradeep Gupta

hi,
usually it is the web dynpro launch system that is causing the issue, OR there is a misconfiguration in the backend like the tasks are set up with com.sap/esslea in the backend and the xml file is referencing sap.com <SWITCH>/esslea and the dynpro is showing this as not deployed.
Regards
Sharanya Rajagopal

How to get Java source in applet stack trace to debug Java security manager

How can I get line numbers for Java source in stack traces for my applet? I'm having a problem with my code-signing certificate. On one of my applets, I consistently get a NullPointerException inside the security dialog code in the JDK. As a result, either the "trust this applet" dialog never appears, or even though it appears, it defaults to untrusted because of the exception, so I can't access any local files (and that's a bit of a problem for an applet whose sole purpose is to upload files to our server). I unzipped src.zip in my JDK directory and set the debug flag for my Ant <javac> task as well as set debuglevel to "lines." Anything else? Here's the trace that I'm getting so far. See that after the NullPointerException it assumes that the user has denied permission. If I could read this Java source maybe I could figure out why it hates my code-signing certificate (jarsigner, BTW, never complains when I verify my jar).
security: Blacklist file not found or revocation check is disabled
security: Accessing keys and certificate in Mozilla user profile: null
security: Loading Root CA certificates from D:\Program Files (x86)\Java\jre6\lib\security\cacerts
security: Loaded Root CA certificates from D:\Program Files (x86)\Java\jre6\lib\security\cacerts
security: Loading Deployment certificates from C:\Users\Rich\AppData\LocalLow\Sun\Java\Deployment\security\trusted.certs
security: Loaded Deployment certificates from C:\Users\Rich\AppData\LocalLow\Sun\Java\Deployment\security\trusted.certs
security: Loading certificates from Deployment session certificate store
security: Loaded certificates from Deployment session certificate store
security: Validate the certificate chain using CertPath API
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: Start to check whether root CA is replaced
security: The root CA has been replaced
security: No timestamping info available
security: Found jurisdiction list file
security: Start checking trusted extension for this certificate
security: Start comparing to jurisdiction list with this certificate
security: The CRL support is disabled
security: The OCSP support is disabled
security: This OCSP End Entity validation is disabled
security: Checking if certificate is in Deployment denied certificate store
security: Checking if certificate is in Deployment permanent certificate store
security: Checking if certificate is in Deployment session certificate store
java.lang.NullPointerException
     at com.sun.deploy.ui.UIFactory.showSecurityDialog(Unknown Source)
     at com.sun.deploy.security.TrustDeciderDialog.showDialog(Unknown Source)
     at com.sun.deploy.security.X509Util.showSecurityDialog(Unknown Source)
     at com.sun.deploy.security.TrustDecider.isAllPermissionGranted(Unknown Source)
     at sun.plugin2.applet.Plugin2ClassLoader.isTrustedByTrustDecider(Unknown Source)
     at sun.plugin2.applet.Plugin2ClassLoader.getTrustedCodeSources(Unknown Source)
     at com.sun.deploy.security.CPCallbackHandler$ParentCallback.strategy(Unknown Source)
     at com.sun.deploy.security.CPCallbackHandler$ParentCallback.openClassPathElement(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath$JarLoader.getJarFile(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath$JarLoader.access$700(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath$JarLoader$1.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at com.sun.deploy.security.DeployURLClassPath$JarLoader.ensureOpen(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath$JarLoader.<init>(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath$3.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
     at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source)
     at sun.plugin2.applet.Plugin2ClassLoader$2.run(Unknown Source)
     at java.security.AccessController.doPrivileged(Native Method)
     at sun.plugin2.applet.Plugin2ClassLoader.findClassHelper(Unknown Source)
     at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)
     at java.lang.ClassLoader.loadClass(Unknown Source)
     at sun.plugin2.applet.Plugin2ClassLoader.loadCode(Unknown Source)
     at sun.plugin2.applet.Plugin2Manager.createApplet(Unknown Source)
     at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
     at java.lang.Thread.run(Unknown Source)
security: User has denied the priviledges to the code
security: Adding certificate in Deployment denied certificate store
security: Added certificate in Deployment denied certificate store
security: Loading certificates from Deployment session certificate store
security: Loaded certificates from Deployment session certificate store
security: Validate the certificate chain using CertPath API
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: Start to check whether root CA is replaced
security: The root CA has been replaced
security: No timestamping info available
security: Found jurisdiction list file
security: Start checking trusted extension for this certificate
security: Start comparing to jurisdiction list with this certificate
security: The CRL support is disabled
security: The OCSP support is disabled
security: This OCSP End Entity validation is disabled
security: Checking if certificate is in Deployment denied certificate store
security: Checking if certificate is in Deployment denied certificate store

Rats, now that I look at the stack trace and compare to what's in the JDK srce.zip, it appears that most of this code is not part of the JDK source. I don't see any com/sun/deploy, etc.

Java.security.AccessControlException in a RMI application

Hello,
I have the following error, while I'm launching my RMI application :
access denied (java.net.SocketPermission 127.0.0.1:1099 connect,resolve)
java.security.AccessControlException: access denied (java.net.SocketPermission 127.0.0.1:1099 connect,resolve)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:272)
at java.security.AccessController.checkPermission(AccessController.java:399)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:545)
at java.lang.SecurityManager.checkConnect(SecurityManager.java:1044)
at java.net.Socket.<init>(Socket.java:262)
I was trying the following instruction :
if (System.getSecurityManager() == null)
System.setSecurityManager(new RMISecurityManager());
try{
Recepteur obj = new Recepteur();
Naming.rebind("//localhost/Recepteur", obj);
However, I have written in the java.policy file :
grant codeBase "http://127.0.0.1:1099/-" {
permission java.security.AllPermission;
Does anyone know how to solve this problem ?
Thx

Help him please or he would be obliged to give me the dukes...

Global-Cache-Manager for Multi-Environment Applications

Hi,
Within our server implementation we provide a "multi-project" environment. Each project is fully isolated from the rest of the server e.g. in terms of file-system usage, backup and other ressources. As one might expect the way to go is using a single VM with multiple BDB environments.
Obviously each JE-Environment uses its own cache. Within a our environment with dynamic numbers of active projects this causes a problem because the optimal cache configuration within a given memory frame depends on the JE-Environments in use BUT there is no way to define a global JE cache for ALL JE-Environments.
Our "plan of attack" is to implement a Global-Cache-Manager to dynamicly configure the cache sizes of all active BDB environments depending on the given global cache size.
Like Federico proposed the starting point for determining the optimal cache setting at load time will be a modification to the DbCacheSize utility so that the return value can be picked up easily, rather than printed to stdout. After that the EnvironmentMutableConfig.setCacheSize will be used to set the cache size. If there is enough Cache-RAM available we could even set a larger cache but I do not know if that really makes sense.
If Cache-Memory is getting tight loading another BDB environment means decreasing cache sizes for the already loaded environments. This is also done via EnvironmentMutableConfig.setCacheSize. Are there any timing conditions one should obey before assuming the memory is really available? To determine if there are any BDB environments that do not use their cache one could query each cache utilization using EnvironmentStats.getCacheDataBytes() and getCacheTotalBytes().
Are there any comments to this plan? Is there perhaps a better solution or even an implementation?
Do you think a global cache manager is something worth back-donating?
Related Postings: Multiple envs in one process?
Stefan Walgenbach

Here is the updated DbCacheSize.java to allow calling it with an API.
Charles Lamb
* See the file LICENSE for redistribution information.
* Copyright (c) 2005-2006
*      Oracle Corporation. All rights reserved.
* $Id: DbCacheSize.java,v 1.8 2006/09/12 19:16:59 cwl Exp $
package com.sleepycat.je.util;
import java.io.File;
import java.io.PrintStream;
import java.math.BigInteger;
import java.text.NumberFormat;
import java.util.Random;
import com.sleepycat.je.Database;
import com.sleepycat.je.DatabaseConfig;
import com.sleepycat.je.DatabaseEntry;
import com.sleepycat.je.DatabaseException;
import com.sleepycat.je.Environment;
import com.sleepycat.je.EnvironmentConfig;
import com.sleepycat.je.EnvironmentStats;
import com.sleepycat.je.OperationStatus;
import com.sleepycat.je.dbi.MemoryBudget;
import com.sleepycat.je.utilint.CmdUtil;
* Estimating JE in-memory sizes as a function of key and data size is not
* straightforward for two reasons. There is some fixed overhead for each btree
* internal node, so tree fanout and degree of node sparseness impacts memory
* consumption. In addition, JE compresses some of the internal nodes where
* possible, but compression depends on on-disk layouts.
* DbCacheSize is an aid for estimating cache sizes. To get an estimate of the
* in-memory footprint for a given database, specify the number of records and
* record characteristics and DbCacheSize will return a minimum and maximum
* estimate of the cache size required for holding the database in memory.
* If the user specifies the record's data size, the utility will return both
* values for holding just the internal nodes of the btree, and for holding the
* entire database in cache.
* Note that "cache size" is a percentage more than "btree size", to cover
* general environment resources like log buffers. Each invocation of the
* utility returns an estimate for a single database in an environment. For an
* environment with multiple databases, run the utility for each database, add
* up the btree sizes, and then add 10 percent.
* Note that the utility does not yet cover duplicate records and the API is
* subject to change release to release.
* The only required parameters are the number of records and key size.
* Data size, non-tree cache overhead, btree fanout, and other parameters
* can also be provided. For example:
* $ java DbCacheSize -records 554719 -key 16 -data 100
* Inputs: records=554719 keySize=16 dataSize=100 nodeMax=128 density=80%
* overhead=10%
*    Cache Size      Btree Size Description
*    30,547,440      27,492,696 Minimum, internal nodes only
*    41,460,720      37,314,648 Maximum, internal nodes only
*   114,371,644     102,934,480 Minimum, internal nodes and leaf nodes
*   125,284,924     112,756,432 Maximum, internal nodes and leaf nodes
* Btree levels: 3
* This says that the minimum cache size to hold only the internal nodes of the
* btree in cache is approximately 30MB. The maximum size to hold the entire
* database in cache, both internal nodes and datarecords, is 125Mb.
public class DbCacheSize {
    private static final NumberFormat INT_FORMAT =
        NumberFormat.getIntegerInstance();
    private static final String HEADER =
        "    Cache Size      Btree Size Description\n" +
    //   12345678901234 12345678901234
    //                 12
    private static final int COLUMN_WIDTH = 14;
    private static final int COLUMN_SEPARATOR = 2;
    private long records;
    private int keySize;
    private int dataSize;
    private int nodeMax;
    private int density;
    private long overhead;
    private long minInBtreeSize;
    private long maxInBtreeSize;
    private long minInCacheSize;
    private long maxInCacheSize;
    private long maxInBtreeSizeWithData;
    private long maxInCacheSizeWithData;
    private long minInBtreeSizeWithData;
    private long minInCacheSizeWithData;
    private int nLevels = 1;
    public DbCacheSize (long records,
               int keySize,
               int dataSize,
               int nodeMax,
               int density,
               long overhead) {
     this.records = records;
     this.keySize = keySize;
     this.dataSize = dataSize;
     this.nodeMax = nodeMax;
     this.density = density;
     this.overhead = overhead;
    public long getMinCacheSizeInternalNodesOnly() {
     return minInCacheSize;
    public long getMaxCacheSizeInternalNodesOnly() {
     return maxInCacheSize;
    public long getMinBtreeSizeInternalNodesOnly() {
     return minInBtreeSize;
    public long getMaxBtreeSizeInternalNodesOnly() {
     return maxInBtreeSize;
    public long getMinCacheSizeWithData() {
     return minInCacheSizeWithData;
    public long getMaxCacheSizeWithData() {
     return maxInCacheSizeWithData;
    public long getMinBtreeSizeWithData() {
     return minInBtreeSizeWithData;
    public long getMaxBtreeSizeWithData() {
     return maxInBtreeSizeWithData;
    public int getNLevels() {
     return nLevels;
    public static void main(String[] args) {
        try {
            long records = 0;
            int keySize = 0;
            int dataSize = 0;
            int nodeMax = 128;
            int density = 80;
            long overhead = 0;
            File measureDir = null;
            boolean measureRandom = false;
            for (int i = 0; i < args.length; i += 1) {
                String name = args;
String val = null;
if (i < args.length - 1 && !args[i + 1].startsWith("-")) {
i += 1;
val = args[i];
if (name.equals("-records")) {
if (val == null) {
usage("No value after -records");
try {
records = Long.parseLong(val);
} catch (NumberFormatException e) {
usage(val + " is not a number");
if (records <= 0) {
usage(val + " is not a positive integer");
} else if (name.equals("-key")) {
if (val == null) {
usage("No value after -key");
try {
keySize = Integer.parseInt(val);
} catch (NumberFormatException e) {
usage(val + " is not a number");
if (keySize <= 0) {
usage(val + " is not a positive integer");
} else if (name.equals("-data")) {
if (val == null) {
usage("No value after -data");
try {
dataSize = Integer.parseInt(val);
} catch (NumberFormatException e) {
usage(val + " is not a number");
if (dataSize <= 0) {
usage(val + " is not a positive integer");
} else if (name.equals("-nodemax")) {
if (val == null) {
usage("No value after -nodemax");
try {
nodeMax = Integer.parseInt(val);
} catch (NumberFormatException e) {
usage(val + " is not a number");
if (nodeMax <= 0) {
usage(val + " is not a positive integer");
} else if (name.equals("-density")) {
if (val == null) {
usage("No value after -density");
try {
density = Integer.parseInt(val);
} catch (NumberFormatException e) {
usage(val + " is not a number");
if (density < 1 || density > 100) {
usage(val + " is not betwen 1 and 100");
} else if (name.equals("-overhead")) {
if (val == null) {
usage("No value after -overhead");
try {
overhead = Long.parseLong(val);
} catch (NumberFormatException e) {
usage(val + " is not a number");
if (overhead < 0) {
usage(val + " is not a non-negative integer");
} else if (name.equals("-measure")) {
if (val == null) {
usage("No value after -measure");
measureDir = new File(val);
} else if (name.equals("-measurerandom")) {
measureRandom = true;
} else {
usage("Unknown arg: " + name);
if (records == 0) {
usage("-records not specified");
if (keySize == 0) {
usage("-key not specified");
     DbCacheSize dbCacheSize = new DbCacheSize
          (records, keySize, dataSize, nodeMax, density, overhead);
     dbCacheSize.caclulateCacheSizes();
     dbCacheSize.printCacheSizes(System.out);
if (measureDir != null) {
measure(System.out, measureDir, records, keySize, dataSize,
nodeMax, measureRandom);
} catch (Throwable e) {
e.printStackTrace(System.out);
private static void usage(String msg) {
if (msg != null) {
System.out.println(msg);
System.out.println
("usage:" +
"\njava " + CmdUtil.getJavaCommand(DbCacheSize.class) +
"\n -records <count>" +
"\n # Total records (key/data pairs); required" +
"\n -key <bytes> " +
"\n # Average key bytes per record; required" +
"\n [-data <bytes>]" +
"\n # Average data bytes per record; if omitted no leaf" +
"\n # node sizes are included in the output" +
"\n [-nodemax <entries>]" +
"\n # Number of entries per Btree node; default: 128" +
"\n [-density <percentage>]" +
"\n # Percentage of node entries occupied; default: 80" +
"\n [-overhead <bytes>]" +
"\n # Overhead of non-Btree objects (log buffers, locks," +
"\n # etc); default: 10% of total cache size" +
"\n [-measure <environmentHomeDirectory>]" +
"\n # An empty directory used to write a database to find" +
"\n # the actual cache size; default: do not measure" +
"\n [-measurerandom" +
"\n # With -measure insert randomly generated keys;" +
"\n # default: insert sequential keys");
System.exit(2);
private void caclulateCacheSizes() {
int nodeAvg = (nodeMax * density) / 100;
long nBinEntries = (records * nodeMax) / nodeAvg;
long nBinNodes = (nBinEntries + nodeMax - 1) / nodeMax;
long nInNodes = 0;
     long lnSize = 0;
for (long n = nBinNodes; n > 0; n /= nodeMax) {
nInNodes += n;
nLevels += 1;
minInBtreeSize = nInNodes *
     calcInSize(nodeMax, nodeAvg, keySize, true);
maxInBtreeSize = nInNodes *
     calcInSize(nodeMax, nodeAvg, keySize, false);
     minInCacheSize = calculateOverhead(minInBtreeSize, overhead);
     maxInCacheSize = calculateOverhead(maxInBtreeSize, overhead);
if (dataSize > 0) {
lnSize = records * calcLnSize(dataSize);
     maxInBtreeSizeWithData = maxInBtreeSize + lnSize;
     maxInCacheSizeWithData = calculateOverhead(maxInBtreeSizeWithData,
                              overhead);
     minInBtreeSizeWithData = minInBtreeSize + lnSize;
     minInCacheSizeWithData = calculateOverhead(minInBtreeSizeWithData,
                              overhead);
private void printCacheSizes(PrintStream out) {
out.println("Inputs:" +
" records=" + records +
" keySize=" + keySize +
" dataSize=" + dataSize +
" nodeMax=" + nodeMax +
" density=" + density + '%' +
" overhead=" + ((overhead > 0) ? overhead : 10) + "%");
out.println();
out.println(HEADER);
out.println(line(minInBtreeSize, minInCacheSize,
               "Minimum, internal nodes only"));
out.println(line(maxInBtreeSize, maxInCacheSize,
               "Maximum, internal nodes only"));
if (dataSize > 0) {
out.println(line(minInBtreeSizeWithData,
               minInCacheSizeWithData,
               "Minimum, internal nodes and leaf nodes"));
out.println(line(maxInBtreeSizeWithData,
               maxInCacheSizeWithData,
"Maximum, internal nodes and leaf nodes"));
} else {
out.println("\nTo get leaf node sizing specify -data");
out.println("\nBtree levels: " + nLevels);
private int calcInSize(int nodeMax,
               int nodeAvg,
               int keySize,
               boolean lsnCompression) {
/* Fixed overhead */
int size = MemoryBudget.IN_FIXED_OVERHEAD;
/* Byte state array plus keys and nodes arrays */
size += MemoryBudget.byteArraySize(nodeMax) +
(nodeMax * (2 * MemoryBudget.ARRAY_ITEM_OVERHEAD));
/* LSN array */
     if (lsnCompression) {
     size += MemoryBudget.byteArraySize(nodeMax * 2);
     } else {
     size += MemoryBudget.BYTE_ARRAY_OVERHEAD +
(nodeMax * MemoryBudget.LONG_OVERHEAD);
/* Keys for populated entries plus the identifier key */
size += (nodeAvg + 1) * MemoryBudget.byteArraySize(keySize);
return size;
private int calcLnSize(int dataSize) {
return MemoryBudget.LN_OVERHEAD +
MemoryBudget.byteArraySize(dataSize);
private long calculateOverhead(long btreeSize, long overhead) {
long cacheSize;
if (overhead == 0) {
cacheSize = (100 * btreeSize) / 90;
} else {
cacheSize = btreeSize + overhead;
     return cacheSize;
private String line(long btreeSize,
               long cacheSize,
               String comment) {
StringBuffer buf = new StringBuffer(100);
column(buf, INT_FORMAT.format(cacheSize));
column(buf, INT_FORMAT.format(btreeSize));
column(buf, comment);
return buf.toString();
private void column(StringBuffer buf, String str) {
int start = buf.length();
while (buf.length() - start + str.length() < COLUMN_WIDTH) {
buf.append(' ');
buf.append(str);
for (int i = 0; i < COLUMN_SEPARATOR; i += 1) {
buf.append(' ');
private static void measure(PrintStream out,
File dir,
long records,
int keySize,
int dataSize,
int nodeMax,
boolean randomKeys)
throws DatabaseException {
String[] fileNames = dir.list();
if (fileNames != null && fileNames.length > 0) {
usage("Directory is not empty: " + dir);
Environment env = openEnvironment(dir, true);
Database db = openDatabase(env, nodeMax, true);
try {
out.println("\nMeasuring with cache size: " +
INT_FORMAT.format(env.getConfig().getCacheSize()));
insertRecords(out, env, db, records, keySize, dataSize, randomKeys);
printStats(out, env,
"Stats for internal and leaf nodes (after insert)");
db.close();
env.close();
env = openEnvironment(dir, false);
db = openDatabase(env, nodeMax, false);
out.println("\nPreloading with cache size: " +
INT_FORMAT.format(env.getConfig().getCacheSize()));
preloadRecords(out, db);
printStats(out, env,
"Stats for internal nodes only (after preload)");
} finally {
try {
db.close();
env.close();
} catch (Exception e) {
out.println("During close: " + e);
private static Environment openEnvironment(File dir, boolean allowCreate)
throws DatabaseException {
EnvironmentConfig envConfig = new EnvironmentConfig();
envConfig.setAllowCreate(allowCreate);
envConfig.setCachePercent(90);
return new Environment(dir, envConfig);
private static Database openDatabase(Environment env, int nodeMax,
boolean allowCreate)
throws DatabaseException {
DatabaseConfig dbConfig = new DatabaseConfig();
dbConfig.setAllowCreate(allowCreate);
dbConfig.setNodeMaxEntries(nodeMax);
return env.openDatabase(null, "foo", dbConfig);
private static void insertRecords(PrintStream out,
Environment env,
Database db,
long records,
int keySize,
int dataSize,
boolean randomKeys)
throws DatabaseException {
DatabaseEntry key = new DatabaseEntry();
DatabaseEntry data = new DatabaseEntry(new byte[dataSize]);
BigInteger bigInt = BigInteger.ZERO;
Random rnd = new Random(123);
for (int i = 0; i < records; i += 1) {
if (randomKeys) {
byte[] a = new byte[keySize];
rnd.nextBytes(a);
key.setData(a);
} else {
bigInt = bigInt.add(BigInteger.ONE);
byte[] a = bigInt.toByteArray();
if (a.length < keySize) {
byte[] a2 = new byte[keySize];
System.arraycopy(a, 0, a2, a2.length - a.length, a.length);
a = a2;
} else if (a.length > keySize) {
out.println("*** Key doesn't fit value=" + bigInt +
" byte length=" + a.length);
return;
key.setData(a);
OperationStatus status = db.putNoOverwrite(null, key, data);
if (status == OperationStatus.KEYEXIST && randomKeys) {
i -= 1;
out.println("Random key already exists -- retrying");
continue;
if (status != OperationStatus.SUCCESS) {
out.println("*** " + status);
return;
if (i % 10000 == 0) {
EnvironmentStats stats = env.getStats(null);
if (stats.getNNodesScanned() > 0) {
out.println("*** Ran out of cache memory at record " + i +
" -- try increasing the Java heap size ***");
return;
out.print(".");
out.flush();
private static void preloadRecords(final PrintStream out,
final Database db)
throws DatabaseException {
Thread thread = new Thread() {
public void run() {
while (true) {
try {
out.print(".");
out.flush();
Thread.sleep(5 * 1000);
} catch (InterruptedException e) {
break;
thread.start();
db.preload(0);
thread.interrupt();
try {
thread.join();
} catch (InterruptedException e) {
e.printStackTrace(out);
private static void printStats(PrintStream out,
Environment env,
String msg)
throws DatabaseException {
out.println();
out.println(msg + ':');
EnvironmentStats stats = env.getStats(null);
out.println("CacheSize=" +
INT_FORMAT.format(stats.getCacheTotalBytes()) +
" BtreeSize=" +
INT_FORMAT.format(stats.getCacheDataBytes()));
if (stats.getNNodesScanned() > 0) {
out.println("*** All records did not fit in the cache ***");

Java Security Manager in Multi-threaded application

Similar Messages

Maybe you are looking for