[NANO-140] J2SE Permissions to be applied to Containers/classloaders

Paul Hammant made changes - 12/Jun/05 11:56 AM

Field	Original Value	New Value
Description	container() { sandbox() { socketPermission("*",80) serverSocketPermission("localhost",8080) container() { component() } } } or somesuch.	container() { sandbox() { socketPermission("", 80) serverSocketPermission("localhost", 8080) filePermission("", "read") filePermission("foo/bar/", "read, write, execute, delete") container() { component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } } or somesuch.

Paul Hammant made changes - 12/Jun/05 12:15 PM

Description

container() {
  sandbox() {
    socketPermission("*", 80)
    serverSocketPermission("localhost", 8080)
    filePermission("*", "read")
    filePermission("foo/bar/", "read, write, execute, delete")
    container() {
      component(key:A, class:"AImpl")
      component(key:B, class:"BImpl")
    }
  }
}

or somesuch.

container() {
  sandbox() {
    socketPermission("*", 80)
    serverSocketPermission("localhost", 8080)
    filePermission("*", "read")
    filePermission("foo/bar/", "read, write, execute, delete")
    container() {
      component(key:A, class:"AImpl")
      component(key:B, class:"BImpl")
    }
  }
}

or

container() {
  container() {
    sandbox() {
      socketPermission("*", 80)
      serverSocketPermission("localhost", 8080)
      filePermission("*", "read")
      filePermission("foo/bar/", "read, write, execute, delete")
    }
    component(key:A, class:"AImpl")
    component(key:B, class:"BImpl")
  }
}

or

container() {
  container() {
    sandbox() {
      socketPermission("*", 80)
      serverSocketPermission("localhost", 8080)
      filePermission("*", "read")
      filePermission("foo/bar/", "read, write, execute, delete")
      component(key:A, class:"AImpl")
      component(key:B, class:"BImpl")
   }
}
}

or somesuch.

Paul Hammant made changes - 12/Jun/05 12:24 PM

Description

container() {
  sandbox() {
    socketPermission("*", 80)
    serverSocketPermission("localhost", 8080)
    filePermission("*", "read")
    filePermission("foo/bar/", "read, write, execute, delete")
    container() {
      component(key:A, class:"AImpl")
      component(key:B, class:"BImpl")
    }
  }
}

or

container() {
  container() {
    sandbox() {
      socketPermission("*", 80)
      serverSocketPermission("localhost", 8080)
      filePermission("*", "read")
      filePermission("foo/bar/", "read, write, execute, delete")
    }
    component(key:A, class:"AImpl")
    component(key:B, class:"BImpl")
  }
}

or

container() {
  container() {
    sandbox() {
      socketPermission("*", 80)
      serverSocketPermission("localhost", 8080)
      filePermission("*", "read")
      filePermission("foo/bar/", "read, write, execute, delete")
      component(key:A, class:"AImpl")
      component(key:B, class:"BImpl")
   }
}
}

or somesuch.

container() {
  sandbox() {
    socketPermission("*", 80)
    serverSocketPermission("localhost", 8080)
    filePermission("*", "read")
    filePermission("foo/bar/", "read, write, execute, delete")
    container() {
      classpathelement(path:"foo.jar")
      component(key:A, class:"AImpl")
      component(key:B, class:"BImpl")
    }
  }
}

or

container() {
  container() {
    classpathelement(path:"foo.jar")
    sandbox() {
      socketPermission("*", 80)
      serverSocketPermission("localhost", 8080)
      filePermission("*", "read")
      filePermission("foo/bar/", "read, write, execute, delete")
    }
    component(key:A, class:"AImpl")
    component(key:B, class:"BImpl")
  }
}

or

container() {
  container() {
    classpathelement(path:"foo.jar")
    sandbox() {
      socketPermission("*", 80)
      serverSocketPermission("localhost", 8080)
      filePermission("*", "read")
      filePermission("foo/bar/", "read, write, execute, delete")
      component(key:A, class:"AImpl")
      component(key:B, class:"BImpl")
   }
}
}

or

container() {
  container() {
    classpath() {
      classpathelement(path:"foo.jar")
      socketPermission("*", 80)
      serverSocketPermission("localhost", 8080)
      filePermission("*", "read")
      filePermission("foo/bar/", "read, write, execute, delete")
    }
    component(key:A, class:"AImpl")
    component(key:B, class:"BImpl")
   }
}
}

or somesuch.

Hide

Permalink

Paul Hammant added a comment - 02/Jul/05 10:27 AM

OK, this is only going to work on classloaders mounted outside the classes visible to the classloader that NanoContrainer/Groovy is running in. we already have a classloader() {} build term. Perhaps some variations :

sandBoxedClassLoader() - no rights
workDirClassLoader(workdir)
serverClassLoader(bindto, port)

they are all modifiablestarting points of course....

container() {
sandBoxedClassLoader() {
classpathelement(path:"foo.jar")
permissions

{ socketPermission("google.com", 80) serverSocketPermission("localhost", 8080) filePermission("foo/bar/", "read, write, execute, delete") add(PropertyPermission("os.name","read")) }

component(key:A, class:"AImpl")
component(key:B, class:"BImpl")
}
}
}

Show

Paul Hammant added a comment - 02/Jul/05 10:27 AM OK, this is only going to work on classloaders mounted outside the classes visible to the classloader that NanoContrainer/Groovy is running in. we already have a classloader() {} build term. Perhaps some variations : sandBoxedClassLoader() - no rights workDirClassLoader(workdir) serverClassLoader(bindto, port) they are all modifiablestarting points of course.... container() { sandBoxedClassLoader() { classpathelement(path:"foo.jar") permissions { socketPermission("google.com", 80) serverSocketPermission("localhost", 8080) filePermission("foo/bar/", "read, write, execute, delete") add(PropertyPermission("os.name","read")) } component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } }

Hide

Permalink

Mauro Talevi added a comment - 04/Jul/05 4:22 AM

+1 on last proposal/comment.
Minor variations on naming conventions - would prefer:
sandboxClassloader()
localClassloader(path)
remoteClassloader(bindto, port)
(note capitalisation too)

Show

Mauro Talevi added a comment - 04/Jul/05 4:22 AM +1 on last proposal/comment. Minor variations on naming conventions - would prefer: sandboxClassloader() localClassloader(path) remoteClassloader(bindto, port) (note capitalisation too)

Hide

Permalink

Jörg Schaible added a comment - 04/Jul/05 4:32 AM

CamelCase already done py Paul:
http://article.gmane.org/gmane.comp.java.picocontainer.cvs/1952

Show

Jörg Schaible added a comment - 04/Jul/05 4:32 AM CamelCase already done py Paul: http://article.gmane.org/gmane.comp.java.picocontainer.cvs/1952

Hide

Permalink

Paul Hammant added a comment - 12/Jul/05 11:41 PM

Changed mind again :-

container() {
sandBox() {
classpathelement(path:"foo.jar")
grants

{ grant(SocketPermission("google.com", 80)) grant(ServerSocketPermission("localhost", 8080)) grant(FilePermission("foo/bar/", "read, write, execute, delete")) grant(PropertyPermission("os.name","read")) }

component(key:A, class:"AImpl")
component(key:B, class:"BImpl")
}
}
}

sandBox() takes away all right afforded to the parent classloader.

without sandBox() grants are additive to those that the parent classloader had recieved.

more thinking needed i think -

grants()

{ revoke(PropertyPermission("os.name","read")) compon.... }

could be difficult to do...

Paul

Show

Paul Hammant added a comment - 12/Jul/05 11:41 PM Changed mind again :- container() { sandBox() { classpathelement(path:"foo.jar") grants { grant(SocketPermission("google.com", 80)) grant(ServerSocketPermission("localhost", 8080)) grant(FilePermission("foo/bar/", "read, write, execute, delete")) grant(PropertyPermission("os.name","read")) } component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } } sandBox() takes away all right afforded to the parent classloader. without sandBox() grants are additive to those that the parent classloader had recieved. more thinking needed i think - grants() { revoke(PropertyPermission("os.name","read")) compon.... } could be difficult to do... Paul

Hide

Permalink

Jörg Schaible added a comment - 13/Jul/05 1:44 AM

I would keep "permissions" instead of "grants". Then "grant" and "revoke" makes more sense. Although IIRC "revoke" is really not easily to do.

Show

Jörg Schaible added a comment - 13/Jul/05 1:44 AM I would keep "permissions" instead of "grants". Then "grant" and "revoke" makes more sense. Although IIRC "revoke" is really not easily to do.

Hide

Permalink

Paul Hammant added a comment - 14/Sep/05 6:30 AM

Permissions in Nano, and Groovy and XML Builders. Other script langs can use directly.

Show

Paul Hammant added a comment - 14/Sep/05 6:30 AM Permissions in Nano, and Groovy and XML Builders. Other script langs can use directly.

Paul Hammant made changes - 14/Sep/05 6:30 AM

Assignee		Paul Hammant [ paul ]
Resolution		Fixed [ 1 ]
Status	Open [ 1 ]	Closed [ 6 ]

Hide

Permalink

Mauro Talevi added a comment - 14/Sep/05 6:31 AM

re-opened to set fix version

Show

Mauro Talevi added a comment - 14/Sep/05 6:31 AM re-opened to set fix version

Mauro Talevi made changes - 14/Sep/05 6:31 AM

Status	Closed [ 6 ]	Reopened [ 4 ]
Resolution	Fixed [ 1 ]
Assignee	Paul Hammant [ paul ]	Mauro Talevi [ maurotalevi ]

Hide

Permalink

Mauro Talevi added a comment - 14/Sep/05 6:31 AM

set fix version

Show

Mauro Talevi added a comment - 14/Sep/05 6:31 AM set fix version

Mauro Talevi made changes - 14/Sep/05 6:31 AM

Environment
Fix Version/s		1.0 [ 10148 ]
Description	container() { sandbox() { socketPermission("", 80) serverSocketPermission("localhost", 8080) filePermission("", "read") filePermission("foo/bar/", "read, write, execute, delete") container() { classpathelement(path:"foo.jar") component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } } or container() { container() { classpathelement(path:"foo.jar") sandbox() { socketPermission("", 80) serverSocketPermission("localhost", 8080) filePermission("", "read") filePermission("foo/bar/", "read, write, execute, delete") } component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } or container() { container() { classpathelement(path:"foo.jar") sandbox() { socketPermission("", 80) serverSocketPermission("localhost", 8080) filePermission("", "read") filePermission("foo/bar/", "read, write, execute, delete") component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } } or container() { container() { classpath() { classpathelement(path:"foo.jar") socketPermission("", 80) serverSocketPermission("localhost", 8080) filePermission("", "read") filePermission("foo/bar/", "read, write, execute, delete") } component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } } or somesuch.	container() { sandbox() { socketPermission("", 80) serverSocketPermission("localhost", 8080) filePermission("", "read") filePermission("foo/bar/", "read, write, execute, delete") container() { classpathelement(path:"foo.jar") component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } } or container() { container() { classpathelement(path:"foo.jar") sandbox() { socketPermission("", 80) serverSocketPermission("localhost", 8080) filePermission("", "read") filePermission("foo/bar/", "read, write, execute, delete") } component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } or container() { container() { classpathelement(path:"foo.jar") sandbox() { socketPermission("", 80) serverSocketPermission("localhost", 8080) filePermission("", "read") filePermission("foo/bar/", "read, write, execute, delete") component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } } or container() { container() { classpath() { classpathelement(path:"foo.jar") socketPermission("", 80) serverSocketPermission("localhost", 8080) filePermission("", "read") filePermission("foo/bar/", "read, write, execute, delete") } component(key:A, class:"AImpl") component(key:B, class:"BImpl") } } } or somesuch.

Mauro Talevi made changes - 14/Sep/05 6:32 AM

Resolution		Fixed [ 1 ]
Status	Reopened [ 4 ]	Closed [ 6 ]

J2SE Permissions to be applied to Containers/classloaders

Details

Description

Activity

People

Dates