编写java的安全管理器

中国人最喜欢访问的网站
只要注册ofo就送你10块钱，还等什么，快来注册吧

安全管理器SecurityManager核心方法checkPerssiom,而该方法又调用AccessController的checkPerssiom方法，访问控制器AccessController的栈检查机制会遍历整个PerssiomCollection来判断具体拥有什么权限,一旦发现栈中一个权限不允许会抛出异常，否则简单的返回。

编写java的安全管理器

定义一个类继承自`SecurityManger`并重写`checkRead`方法

package com.test.security.manager;
public class MySecurityManager extends SecurityManager {
    @Override
    public void checkRead(String fileFullPath) {
        // super.checkRead(fileFullPath);
        if (fileFullPath.endsWith("test")) {
            throw new SecurityException("你没有读取的本文件的权限");
        }
    }
}

测试

package com.test.security.manager;
import java.io.FileInputStream;
import java.io.IOException;
import org.junit.Test;
public class MySecurityManagerTest {
    @Test
    public void testCheckReadString() {
        System.setSecurityManager(new MySecurityManager());
        try {
            FileInputStream fis = new FileInputStream("test");
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

测试结果

java.lang.SecurityException: 你没有读取的本文件的权限
    at com.test.security.manager.MySecurityManager.checkRead(MySecurityManager.java:9)
    at java.io.FileInputStream.<init>(FileInputStream.java:127)
    at java.io.FileInputStream.<init>(FileInputStream.java:93)
    at com.test.security.manager.MySecurityManagerTest.testCheckReadString(MySecurityManagerTest.java:13)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
    at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
    at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
    at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
    at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
    at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
    at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
    at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
    at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
    at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
    at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
    at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:86)
    at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:459)
    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:678)
    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:382)
    at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:192)

System.setSecurityManager(new MySecurityManager());这是安装安全管理器的一种方法，也可以用-Djava.security.manager安装默认的安全管理器。

解读

进入FileInputStream的构造函数:

public FileInputStream(File file) throws FileNotFoundException {
    String name = (file != null ? file.getPath() : null);
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkRead(name);
    }
    if (name == null) {
        throw new NullPointerException();
    }
    if (file.isInvalid()) {
        throw new FileNotFoundException("Invalid file path");
    }
    fd = new FileDescriptor();
    fd.attach(this);
    path = name;
    open(name);
}

先会执行SecurityManager security = System.getSecurityManager();，然后再调用security的checkRead方法。

联想一下，在使用java的File时会new File("test").setWritable(Boolean.TRUE, Boolean.TRUE);，这可以指定创建文件的权限，这里就是使用了安全管理器来设置权限。

public boolean setWritable(boolean writable, boolean ownerOnly) {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkWrite(path);
    }
    if (isInvalid()) {
        return false;
    }
    return fs.setPermission(this, FileSystem.ACCESS_WRITE, writable, ownerOnly);
}

编写java的安全管理器

定义一个类继承自SecurityManger并重写checkRead方法

测试

测试结果

解读

定义一个类继承自`SecurityManger`并重写`checkRead`方法