CODEWITHSUNDEEP
java
jeff porter
jeff porter

Reputation: 6620

Java security: how to ensure class is only access from specific package?

Now I know I can mark a method as 'no modifier' so that its only accessible by Class & Package.

That is not what I need in this case though. What I need is this:

Methods on Class "Secure.java" can only be accessed from other Classes in the same JAR file.

AND (this is extra)

When call is made into a secure method, the call stack does not go back to a none secure class & then back in again. For example:

This is good:

This is bad:

Now I think I can do this via a little manual work:

 private void checkSecurity()
  {
    StackTraceElement[] stackTraceElements = Thread.currentThread().getStackTrace();
    for (StackTraceElement stackTraceElement : stackTraceElements)
    {
      // TODO: Add a little magic to check that we've not stepped outside the secure packages.
      if (!stackTraceElement.getClassName().startsWith("com.secure"))
      {
         throw new SecurityException("Woop!");
      }
    }
  }

QUESTION: This feels like there should be something that Java provides to help me out here?

I've read about 

AccessController.doPrivileged(new PrivilegedExceptionAction<String>()

But seems to only be about accessing resources/network connections etc. Not about accessing the call stack to ensure some sort of package protection.

Notes:

Upvotes: 2

Views: 1273

Answers (3)

jeff porter
jeff porter

Reputation: 6620

In the end I used the checkSecurity() method above.

I didn't find a Java 1.6 feature to help me out.

Upvotes: 0

Alexandre Dupriez
Alexandre Dupriez

Reputation: 3036

You are basically looking for access restrictions based on the container (jar) of your classes. Java does not provide such control on its own (at least not easily).

OSGI specifications are closer to the access control you want to achieve. In essence, OSGI do support and enforce access restrictions and rules based on the jar files (which it calls bundles).

You say you are using Spring: maybe have a look on these articles from JavaWorld here and here to check in which extent OSGI can help you.

Upvotes: 1

user207421
user207421

Reputation: 310876

Your title says 'from same package' which provides the hint. Put the class into the same package as the classes that may access it; don't make it public, so it is only accessible to classes in that package; sign the JAR file; and seal the package.

Upvotes: 1

Related Questions