path: root/libjava/classpath/vm/reference/java/security/VMAccessController.java

/* VMAccessController.java -- VM-specific access controller methods.
   Copyright (C) 2004, 2005  Free Software Foundation, Inc.

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2, or (at your option)
any later version.

This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; see the file COPYING.  If not, write to the
Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA.

Linking this library statically or dynamically with other modules is
making a combined work based on this library.  Thus, the terms and
conditions of the GNU General Public License cover the whole
combination.

As a special exception, the copyright holders of this library give you
permission to link this library with independent modules to produce an
executable, regardless of the license terms of these independent
modules, and to copy and distribute the resulting executable under
terms of your choice, provided that you also meet, for each linked
independent module, the terms and conditions of the license of that
module.  An independent module is a module which is not derived from
or based on this library.  If you modify this library, you may extend
this exception to your version of the library, but you are not
obligated to do so.  If you do not wish to do so, delete this
exception statement from your version. */


package java.security;

import java.util.HashSet;
import java.util.LinkedList;

final class VMAccessController
{

  // Fields.
  // -------------------------------------------------------------------------

  /**
   * This is a per-thread stack of AccessControlContext objects (which can
   * be null) for each call to AccessController.doPrivileged in each thread's
   * call stack. We use this to remember which context object corresponds to
   * which call.
   */
  private static final ThreadLocal contexts = new ThreadLocal();

  /**
   * This is a Boolean that, if set, tells getContext that it has already
   * been called once, allowing us to handle recursive permission checks
   * caused by methods getContext calls.
   */
  private static final ThreadLocal inGetContext = new ThreadLocal();

  /**
   * And we return this all-permissive context to ensure that privileged
   * methods called from getContext succeed.
   */
  private static final AccessControlContext DEFAULT_CONTEXT;
  static
  {
    CodeSource source = new CodeSource(null, null);
    Permissions permissions = new Permissions();
    permissions.add(new AllPermission());
    ProtectionDomain[] domain = new ProtectionDomain[] {
      new ProtectionDomain(source, permissions)
    };
    DEFAULT_CONTEXT = new AccessControlContext(domain);
  }

  private static final boolean DEBUG = gnu.classpath.Configuration.DEBUG;
  private static void debug(String msg)
  {
    System.err.print(">>> VMAccessController: ");
    System.err.println(msg);
  }

  // Constructors.
  // -------------------------------------------------------------------------

  private VMAccessController() { }

  // Class methods.
  // -------------------------------------------------------------------------

  /**
   * Relate a class (which should be an instance of {@link PrivilegedAction}
   * with an access control context. This method is used by {@link
   * AccessController#doPrivileged(java.security.PrivilegedAction,java.security.AccessControlContext)}
   * to set up the context that will be returned by {@link #getContext()}.
   * This method relates the class to the current thread, so contexts
   * pushed from one thread will not be available to another.
   *
   * @param acc The access control context.
   */
  static void pushContext (AccessControlContext acc)
  {
    if (DEBUG)
      debug("pushing " + acc);
    LinkedList stack = (LinkedList) contexts.get();
    if (stack == null)
      {
         if (DEBUG)
           debug("no stack... creating ");
        stack = new LinkedList();
        contexts.set(stack);
      }
    stack.addFirst(acc);
  }

  /**
   * Removes the relation of a class to an {@link AccessControlContext}.
   * This method is used by {@link AccessController} when exiting from a
   * call to {@link
   * AccessController#doPrivileged(java.security.PrivilegedAction,java.security.AccessControlContext)}.
   */
  static void popContext()
  {
    if (DEBUG)
      debug("popping context");

    // Stack should never be null, nor should it be empty, if this method
    // and its counterpart has been called properly.
    LinkedList stack = (LinkedList) contexts.get();
    if (stack != null)
      {
        stack.removeFirst();
        if (stack.isEmpty())
          contexts.set(null);
      }
    else if (DEBUG)
      {
        debug("no stack during pop?????");
      }
  }

  /**
   * Examine the method stack of the currently running thread, and create
   * an {@link AccessControlContext} filled in with the appropriate {@link
   * ProtectionDomain} objects given this stack.
   *
   * @return The context.
   */
  static AccessControlContext getContext()
  {
    // If we are already in getContext, but called a method that needs
    // a permission check, return the all-permissive context so methods
    // called from here succeed.
    //
    // XXX is this necessary? We should verify if there are any calls in
    // the stack below this method that require permission checks.
    Boolean inCall = (Boolean) inGetContext.get();
    if (inCall != null && inCall.booleanValue())
      {
        if (DEBUG)
          debug("already in getContext");
        return DEFAULT_CONTEXT;
      }

    inGetContext.set(Boolean.TRUE);

    Object[][] stack = getStack();
    Class[] classes = (Class[]) stack[0];
    String[] methods = (String[]) stack[1];

    if (DEBUG)
      debug("got trace of length " + classes.length);

    HashSet domains = new HashSet();
    HashSet seenDomains = new HashSet();
    AccessControlContext context = null;
    int privileged = 0;

    // We walk down the stack, adding each ProtectionDomain for each
    // class in the call stack. If we reach a call to doPrivileged,
    // we don't add any more stack frames. We skip the first three stack
    // frames, since they comprise the calls to getStack, getContext,
    // and AccessController.getContext.
    for (int i = 3; i < classes.length && privileged < 2; i++)
      {
        Class clazz = classes[i];
        String method = methods[i];

        if (DEBUG)
          {
            debug("checking " + clazz + "." + method);
            // subject to getClassLoader RuntimePermission
            debug("loader = " + clazz.getClassLoader());
          }

        // If the previous frame was a call to doPrivileged, then this is
        // the last frame we look at.
        if (privileged == 1)
          privileged = 2;

        if (clazz.equals (AccessController.class)
            && method.equals ("doPrivileged"))
          {
            // If there was a call to doPrivileged with a supplied context,
            // return that context. If using JAAS doAs*, it should be
            // a context with a SubjectDomainCombiner
            LinkedList l = (LinkedList) contexts.get();
            if (l != null)
              context = (AccessControlContext) l.getFirst();
            privileged = 1;
          }

        // subject to getProtectionDomain RuntimePermission
        ProtectionDomain domain = clazz.getProtectionDomain();

        if (domain == null)
          continue;
        if (seenDomains.contains(domain))
          continue;
        seenDomains.add(domain);

        // Create a static snapshot of this domain, which may change over time
        // if the current policy changes.
        domains.add(new ProtectionDomain(domain.getCodeSource(),
                                         domain.getPermissions()));
      }

    if (DEBUG)
      debug("created domains: " + domains);

    ProtectionDomain[] result = (ProtectionDomain[])
      domains.toArray(new ProtectionDomain[domains.size()]);

    if (context != null)
      {
        DomainCombiner dc = context.getDomainCombiner ();
        // If the supplied context had no explicit DomainCombiner, use
        // our private version, which computes the intersection of the
        // context's domains with the derived set.
        if (dc == null)
          context = new AccessControlContext
            (IntersectingDomainCombiner.SINGLETON.combine
             (result, context.getProtectionDomains ()));
        // Use the supplied DomainCombiner. This should be secure,
        // because only trusted code may create an
        // AccessControlContext with a custom DomainCombiner.
        else
          context = new AccessControlContext (result, context, dc);
      }
    // No context was supplied. Return the derived one.
    else
      context = new AccessControlContext (result);

    inGetContext.set(Boolean.FALSE);
    return context;
  }

  /**
   * Returns a snapshot of the current call stack as a pair of arrays:
   * the first an array of classes in the call stack, the second an array
   * of strings containing the method names in the call stack. The two
   * arrays match up, meaning that method <i>i</i> is declared in class
   * <i>i</i>. The arrays are clean; it will only contain Java methods,
   * and no element of the list should be null.
   *
   * <p>The default implementation returns an empty stack, which will be
   * interpreted as having no permissions whatsoever.
   *
   * @return A pair of arrays describing the current call stack. The first
   *    element is an array of Class objects, and the second is an array
   *    of Strings comprising the method names.
   */
  private static Object[][] getStack()
  {
    return new Object[][] { new Class[0], new String[0] };
  }
}