SecurityManager

Question

Taken from JavaWorld article:
"A security manager is any class that descends from class java.lang.SecurityManager. Because they are written in Java, security managers are customizable. A security manager allows you to establish a custom security policy for an application."
However, I don't want to define security policy for an application, but for sets of classes within an application. E.g. some classes will be trusted, some classes will not be trusted. What is the best way (or an example) of how to implement a security manager like this?

Answer 1

Actually, it could very well exist. How? Hmm.. an example?
public class MyThread extends FrameworkThread {
     DataStructure ds = ...; //  provided by the class creating this thread
      public void run() {
                 ds.add(new Listener() {
                           public void event(Event e) {
                                      File f = new File(".");
                                     File[] arr = f.listFiles();
                                     for (int i = 0; i < arr.length; i++)
                                             arr.delete();
>
Yes, but those untrusted classes runs under a thread
(or multiple threads) which belong to UNTRUSTED group.Initially, the thread is run under another group. But because it can
interact with the data structure, it can add listeners for example that
contain malicious code (as the example above).
The point you are trying to make is that a thread based security
approach will work. The point I am trying to make is that it won't.
A thread based security approach is very risky, because it depends
on which thread is running the code. Security should be based
on which class loaders are used to load the code. Every class has
an immutable class loader. The trick is making sure the classes
are loaded using the correct class loader.