Re: SecurityManager

On Thu, Dec 18, 2008 at 11:49 PM, Surendra Lingareddy
<[email protected]> wrote:
> We have a controlled environment where the server and clients most
> likely will be in the same network. Our packaging is done where the stub
> files are provided to the client so that no one the downloading business
> needs to happen. In this case, is a SecurityManager necessary at all?
> Also, to provide security, we are use SSL factories to make the
> connection between a client and a server.

I agree with Gregg that you *should* consider sandboxing your
environment unless you are behind a firewall and that no users exist
behind the same firewall, only your own trusted app. Once, the users
are in place, you have no clue what might happen, and as Gregg says,
it might just do exactly that...

I also agree that it is extremely frustrating to wade through all the
Security permissions that you enable one by one. Something that will
help is to define your own policies, and wrap blocks of code that
takes no 'in arguments' (directly or indirectly) in an
AccessController and check against your permission. That way you can
limit the permissions needed to be declared explicitly.

That said, if you have no SecurityManager, RMI will disable dynamic
classloading but still work if the classes are available within its
classloader. That brings your RMI application to the same security
level as an unsecured standalone app on the network.


Cheers
Niclas

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff RMI-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

For a list of frequently asked RMI questions please refer to:
http://java.sun.com/j2se/1.3/docs/guide/rmi/faq.html

To view past RMI-USERS postings, please see:
http://archives.java.sun.com/archives/rmi-users.html