Initial feedback from Apache Ant users on recent security manager warning messages

Alan Bateman Alan.Bateman at oracle.com
Wed Jun 30 06:40:47 UTC 2021


On 30/06/2021 05:51, Jaikiran Pai wrote:
>
> In the case we are dealing with, the class is always 
> "org.apache.tools.ant.types.Permissions". It will always be loaded by 
> one single classloader (so classloaded just once). However, multiple 
> different instances of this class will get created during the lifetime 
> of the build and each such instance of 
> org.apache.tools.ant.types.Permissions can/will invoke this 
> setSecurityManager method.
If I read this correctly, the caller of setSecurityManager is code in 
org.apache.tools.ant.types.Permission. There may be many instances of 
Permissions but from the perspective of setSecurityManager then it's all 
the same caller Class<?>.

-Alan



More information about the security-dev mailing list