Namespace mapping with classloading

Question

It is proposed that a secure sandbox for applications could be made with mapping loaded classes into secure classes. For example, when a person is using java.io.File, the classloader returns org.my.File, which extends java.io.File. Using this technique, we may have security profiles for different users. For example, some users may use net-package and some may not. The classloader (with help of profiles) will decide what to load for each user.
I have implemented a classloader that initially loads org.my.File-class, and when a loaded application (loaded through this ClassLoader) tries to load java.io.File, the classloader simply returns the previously loaded org.my.File-class.
This results in java.lang.NoClassDefFoundError: java/io/File. Other loading methods that I have tried have ended in ClassCircularityExceptions and Hotspot VM crashes. I am currently using Windows 2000 Pro; Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.1_03-b02) and Java HotSpot(TM) Client VM (build 1.4.1_03-b02, mixed mode).
Any ideas why this doesn't work? Is it possible to make work? Does someone know an alternative method how to achieve desired behaviour?
Thanks,
Teemu.
public class AClassLoader extends ClassLoader {
  private URL[] urls;
  private Class fileclass;
  public AClassLoader(URL[] list_of_urls ) {
    urls = list_of_urls;
    try {
      fileclass = findSystemClass("org.my.File");
      resolveClass(axelfile);
    catch (Exception e) {System.out.println(e);}
  public Class loadClass(String name, boolean resolve) throws ClassNotFoundException {
    if (name.indexOf("java.io.File")!=-1) { return classfile; }
    Class class_to_load = null;
    // check if already loaded
    class_to_load = findLoadedClass(name);
    // class was found, return it
    if (class_to_load!=null) {  return class_to_load;  }
    // this is reached only if class was not found
    try {
      URL url = null;
      ByteArrayOutputStream baos = new ByteArrayOutputStream();
      for (int i=0;i<urls.length;i++) {
        // if class is found, do not enter try
        if (class_to_load==null) {
          String filename = name;
          filename = filename.replace('.','/');
          url = urls;
filename = url.toString()+filename+".class";
url = new URL(filename);
try {
InputStream is = url.openStream();
// collect bytes to vector
     int b = -1;
     while ( (b = is.read()) != -1 ) {
     baos.write(b);
     is.close();
     // create bytearray
     byte[] byte_array = baos.toByteArray();
     // try to define bytearray as a class
     class_to_load = defineClass(name, byte_array, 0, byte_array.length);
catch (FileNotFoundException u) {          }
catch (Exception u2) {     }
} // if
catch (Exception e) { System.out.println(e); }
if (class_to_load==null) {
try {
class_to_load = findSystemClass(name);
return class_to_load;
catch (NoClassDefFoundError e) { }
if (class_to_load==null) { throw new ClassNotFoundException("Class "+name+" was not found from given urls or system."); }
// try to resolve class, if needed
if ((class_to_load!=null)&&(resolve)) {
resolveClass(class_to_load);
return class_to_load;

Answer 1

The code I sent in first message is not entirely correct. I clipped it out from my original code and changed variables, but I accidentally left some errors in it...
I have done some tests and I found few errors from my code and some interesting and annoying facts from java class loading behaviour.
It seems now like the system classes, like java.io.File are not added to found classes list after they are loaded with findSystemClass.
If I try to define system class from bytes with defineClass(), it results: "java.lang.SecurityException: Prohibited package name: java.io". After that I have to load that class with findSystemClass().
So, when I am returning org.my.File instead of java.io.File, I get java.lang.NoClassDefFoundError: java/io/File. I believe this results because java.io.File can not be found with findLoadedClass() (java.io.File is not added in to the "known classes" list ?!)
Can someone give me hints how to load own class instead of a system class? How the system class can be loaded so that it can be found with findLoadedClass()? Or am I doing this completely wrong?