JEP 140: Limited doPrivileged
|Status||Closed / Delivered|
|Discussion||security dash dev at openjdk dot java dot net|
|Endorsed by||Brian Goetz|
|Blocks||JEP 183: HTTP Cross-Origin Resource Sharing|
|JEP 184: HTTP URL Permissions|
Enable code to assert a subset of its privileges without otherwise preventing the full access-control stack walk to check for other permissions.
This is very useful when you need to enable some permissions while allowing others to continue the stack walk.
java.security.AccessController.doPrivileged method that takes a
For example, some bootstrap JRE code could assert a privilege to GET a configuration file via http:
AccessController.doPrivileged(anon class..., new URLPermission(url, request props ..., "GET") ...
checkPermission() for a matching
URLPermission (done by the
handler) would stop walking the access-control context (acc) stack at that
doPrivileged() invocation and succeed. A check for a non-matching
URLPermission or some other permission, however, would match the JRE class's
generally assigned privileges and continue walking the full acc stack as if the
doPrivileged() had not been invoked.
These limited privileges are also captured by
by thread inheritance.