The access controllerwhen the new policy installed

Chapter 5. The Access Controller 89

}

}

}	// If the code was loaded from a file, return a collection // that implies all permissions. Otherwise, return an // empty collection (one that implies no permissions). public PermissionCollection getPermissions(CodeSource cs) { if (cs.getLocation().getProtocol( ).equals("file")) return new SimplePermissions(true); return new SimplePermissions(false); }

This class implements a simple policy: if the class in question was loaded from the filesystem, then all operations are allowed. Otherwise, all operations are denied. Note that this implementation requires us to define a permission collection to return from the getPermissions( ) method. That's typically where all the work goes; in our case, we have either a simple collection with an all permission element or one with no elements. The implies( ) method in this case doesn't rely upon those elements, though it typically would.

public static void setPolicy(Policy p)
Install the given policy object, replacing whatever policy object was previously installed.

Getting and setting the policy object requires going through the checkProperty( ) method of the security manager. By default, this succeeds only if you already have been granted a security permission with the name of getPolicy or setPolicy (as appropriate).

So you can change sun.security.provider.PolicyFile to
javasec.samples.ch05.MyPolicy, and that will be the default policy. But the MyPolicy class must reside in the boot classpath of the virtual machine. That means that in order to use this technique, you must either add MyPolicy.class to the rt.jar file, or you must run the virtual machine with the appropriate argument to specify the boot classpath. This argument is nonstandard and is subject to change, but in 1.3 to load the MyPolicy class from /files/policy you'd use this command fragment:

piccolo% java −Xbootclasspath:/files/policy ...other args...

When associated with a class, a protection domain means that the given class was loaded from the site specified in the code source, was signed by the public keys specified in the code source, and should have permission to perform the set of operations represented in the permission collection object. Each class in the virtual machine may belong to one and only one protection domain, which is set by the class loader when the class is defined.

However, not all class loaders have a specific protection domain associated with them: the class loader that loads the core Java API does not specify a protection domain. We can think of these core classes as belonging to the system protection domain.