RFR: 8229773: Resolve permissions for code source URLs lazily

Alan Bateman Alan.Bateman at oracle.com
Fri Aug 16 07:04:47 UTC 2019


On 15/08/2019 23:20, Peter Firmstone wrote:
> :
>
> The following code is included in the constructor of our 
> SecurityManager implementation, I suspect we may need to add some 
> classes to this list, perhaps this is something that needs documenting?
The checkPermission method of custom security manager can run arbitrary 
code so recursive initialization, stack overflow, bootstrap method 
errors, ... are always hazards. I don't know what documentation you have 
in mind but I don't think there is a definite list of classes that need 
to be loaded/initialized before the custom security manager is set 
because it will come down to the code that it executes in its 
checkPermission method.

-Alan.





More information about the security-dev mailing list