/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* A <code>SubjectDomainCombiner</code> updates ProtectionDomains
* with Principals from the <code>Subject</code> associated with this
* <code>SubjectDomainCombiner</code>.
*
*/
new WeakKeyValueMap<>();
"\t[SubjectDomainCombiner]");
// Note: check only at classloading time, not dynamically during combine()
private static final boolean useJavaxPolicy =
// Relevant only when useJavaxPolicy is true
private static final boolean allowCaching =
(useJavaxPolicy && cachePolicy());
/**
* Associate the provided <code>Subject</code> with this
* <code>SubjectDomainCombiner</code>.
*
* <p>
*
* @param subject the <code>Subject</code> to be associated with
* with this <code>SubjectDomainCombiner</code>.
*/
if (subject.isReadOnly()) {
}
}
/**
* Get the <code>Subject</code> associated with this
* <code>SubjectDomainCombiner</code>.
*
* <p>
*
* @return the <code>Subject</code> associated with this
* <code>SubjectDomainCombiner</code>, or <code>null</code>
* if no <code>Subject</code> is associated with this
* <code>SubjectDomainCombiner</code>.
*
* @exception SecurityException if the caller does not have permission
* to get the <code>Subject</code> associated with this
* <code>SubjectDomainCombiner</code>.
*/
("getSubjectFromDomainCombiner"));
}
return subject;
}
/**
* Update the relevant ProtectionDomains with the Principals
* from the <code>Subject</code> associated with this
* <code>SubjectDomainCombiner</code>.
*
* <p> A new <code>ProtectionDomain</code> instance is created
* for each <code>ProtectionDomain</code> in the
* <i>currentDomains</i> array. Each new <code>ProtectionDomain</code>
* instance is created using the <code>CodeSource</code>,
* <code>Permission</code>s and <code>ClassLoader</code>
* from the corresponding <code>ProtectionDomain</code> in
* <i>currentDomains</i>, as well as with the Principals from
* the <code>Subject</code> associated with this
* <code>SubjectDomainCombiner</code>.
*
* <p> All of the newly instantiated ProtectionDomains are
* combined into a new array. The ProtectionDomains from the
* <i>assignedDomains</i> array are appended to this new array,
* and the result is returned.
*
* <p> Note that optimizations such as the removal of duplicate
* ProtectionDomains may have occurred.
* In addition, caching of ProtectionDomains may be permitted.
*
* <p>
*
* @param currentDomains the ProtectionDomains associated with the
* current execution Thread, up to the most recent
* privileged <code>ProtectionDomain</code>.
* The ProtectionDomains are are listed in order of execution,
* with the most recently executing <code>ProtectionDomain</code>
* residing at the beginning of the array. This parameter may
* be <code>null</code> if the current execution Thread
* has no associated ProtectionDomains.<p>
*
* @param assignedDomains the ProtectionDomains inherited from the
* parent Thread, or the ProtectionDomains from the
* privileged <i>context</i>, if a call to
* AccessController.doPrivileged(..., <i>context</i>)
* had occurred This parameter may be <code>null</code>
* if there were no ProtectionDomains inherited from the
* parent Thread, or from the privileged <i>context</i>.
*
* @return a new array consisting of the updated ProtectionDomains,
* or <code>null</code>.
*/
} else {
return null;
}
});
}
}
// No need to optimize assignedDomains because it should
// have been previously optimized (when it was set).
// Note that we are returning a direct reference
// to the input array - since ACC does not clone
// the arrays when it calls combiner.combine,
// multiple ACC instances may share the same
// array instance in this case
return assignedDomains;
}
// optimize currentDomains
//
// No need to optimize assignedDomains because it should
// have been previously optimized (when it was set).
}
return null;
}
// maintain backwards compatibility for developers who provide
// their own custom javax.security.auth.Policy implementations
if (useJavaxPolicy) {
}
// the ProtectionDomains for the new AccessControlContext
// that we will return
boolean allNew = true;
synchronized(cachedPDs) {
if (!subject.isReadOnly() &&
// if the Subject was mutated, clear the PD cache
synchronized(newSet) {
}
}
}
for (int i = 0; i < cLen; i++) {
pd.getPermissions(),
pd.getClassLoader(),
} else {
allNew = false;
}
newDomains[i] = subjectPd;
}
}
for (int i = 0; i < cLen; i++) {
printDomain(newDomains[i]));
}
}
// now add on the assigned domains
if (aLen > 0) {
// optimize the result (cached PDs might exist in assignedDomains)
if (!allNew) {
}
}
// if aLen == 0 || allNew, no need to further optimize newDomains
} else {
printDomain(newDomains[i]));
}
}
}
// return the new ProtectionDomains
return null;
} else {
return newDomains;
}
}
/**
* Use the javax.security.auth.Policy implementation
*/
if (!allowCaching) {
(new PrivilegedAction<Void>() {
// Call refresh only caching is disallowed
return null;
}
});
}
// the ProtectionDomains for the new AccessControlContext
// that we will return
synchronized(cachedPDs) {
if (!subject.isReadOnly() &&
// if the Subject was mutated, clear the PD cache
synchronized(newSet) {
}
}
}
for (int i = 0; i < cLen; i++) {
// XXX
// we must first add the original permissions.
// that way when we later add the new JAAS permissions,
// any unresolved JAAS-related permissions will
// automatically get resolved.
// get the original perms
synchronized (coll) {
while (e.hasMoreElements()) {
(Permission)e.nextElement();
}
}
}
// get perms from the policy
(new PrivilegedAction<PermissionCollection>() {
public PermissionCollection run() {
return
}
});
// add the newly granted perms,
// avoiding duplicates
synchronized (newPerms) {
while (e.hasMoreElements()) {
}
}
}
subjectPd = new ProtectionDomain
if (allowCaching)
}
newDomains[i] = subjectPd;
}
}
for (int i = 0; i < cLen; i++) {
}
}
// now add on the assigned domains
if (aLen > 0) {
}
} else {
newDomains[i].toString());
}
}
}
// return the new ProtectionDomains
return null;
} else {
return newDomains;
}
}
return null;
int num = 0;
// skip domains with AllPermission
// XXX
//
// if (domains[i].implies(ALL_PERMISSION))
// continue;
// skip System Domains
// remove duplicates
boolean found = false;
}
if (!found) {
}
}
}
// resize the array if necessary
}
}
private static boolean cachePolicy() {
(new PrivilegedAction<String>() {
}
});
if (s != null) {
return Boolean.parseBoolean(s);
}
// cache by default
return true;
}
} else {
i < currentDomains.length; i++) {
if (currentDomains[i] == null) {
} else {
printDomain(currentDomains[i]));
}
}
}
} else {
i < assignedDomains.length; i++) {
if (assignedDomains[i] == null) {
} else {
printDomain(assignedDomains[i]));
}
}
}
}
return "null";
}
}
});
}
/**
* A HashMap that has weak keys and values.
*
* Key objects in this map are the "current" ProtectionDomain instances
* received via the combine method. Each "current" PD is mapped to a
* new PD instance that holds both the contents of the "current" PD,
* as well as the principals from the Subject associated with this combiner.
*
* The newly created "principal-based" PD values must be stored as
* WeakReferences since they contain strong references to the
* corresponding key object (the "current" non-principal-based PD),
* which will prevent the key from being GC'd. Specifically,
* a "principal-based" PD contains strong references to the CodeSource,
* signer certs, PermissionCollection and ClassLoader objects
* in the "current PD".
*/
private static class WeakKeyValueMap<K,V> extends
WeakHashMap<K,WeakReference<V>> {
}
return null;
}
}
return null;
}
}
}