<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>A comment from Ron highlites our issue:</p>
<p>
<blockquote type="cite">the JDK contains only things that either
only the JDK can technically do</blockquote>
<br>
</p>
<p>We have a need to distinguish between different sources of code,
as well as user principles, and as well as Services. Our
services are loaded by separate ClassLoaders and are to some
extent sandboxed as Ron's example suggests.<br>
</p>
<p>And we have a need to control access based on these entities.</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">We have always strived to be
cross platform and tested on other JVM's such as J9.</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">It's just very hard to see any
solutions without AccessController and AccessControlContext.</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">We don't need SecurityManager
(although we still need a Policy provider, because
ProtectionDomain calls it, but we don't need a policy
implementation, just the provider, feel free to remove Java's
PolicyFile implementation), if we added a provider interface to
Guard.check and changed all permission checks to call their
superclass method Guard.check.</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">That authorization layer provider
could be called Authority and it can have one single method:</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">Authority::confirm(Permission p)
throws SecurityException;</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">We need the power of
AccessController's stack walk, StackWalker doesn't work with
compiled code, only bytecode.</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">AccessController and
AccessControlContext allow backward compatiblity for JAAS. JAAS
whether we like it or not, is the default authorisation layer
framework.</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM"><a class="moz-txt-link-freetext" href="http://word-bits.flurg.com/jaas-is-terrible-and-there-is-no-escape-from-it/">http://word-bits.flurg.com/jaas-is-terrible-and-there-is-no-escape-from-it/</a></p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">We could create a new property
that bypasses the AccessController's stack walk for those who
don't need to control CodeSource access. (Just create a
ProtectionDomain containing a Subject). <br>
</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">Benefits:</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">With SecurityManager gone, people
will no longer assume it has sole responsible for Security and
OpenJDK devs won't carry a significant burden for it's
maintenance. Any security issues will be the responsibility of
third party implementations, like mine.<br>
</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">The JDK won't provide an
implementation, just the framework.<br>
</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">Those of us using the Principle
of Least Privilege can continue to do so and we can participate in
OpenJDK to maintain Permission checks where we need them and
preserve context where appropriate.<br>
</p>
<p class="_1qeIAgB0cPwnLhDF9XSiJM">JAAS will continue to remain
functional and it's performance will increase significantly (it
performs very well with my Policy implementation, even with stack
walks).<br>
</p>
<pre class="moz-signature" cols="72">--
Regards,
Peter Firmstone
Zeus Project Services Pty Ltd.</pre>
</body>
</html>