Java/Security/Service

Secure Service

/*
 * Copyright (c) 2000 David Flanagan.  All rights reserved.
 * This code is from the book Java Examples in a Nutshell, 2nd Edition.
 * It is provided AS-IS, WITHOUT ANY WARRANTY either expressed or implied.
 * You may study, use, and modify it for any non-commercial purpose.
 * You may distribute it non-commercially as long as you retain this notice.
 * For a commercial use license, or to purchase the book (recommended),
 * visit http://www.davidflanagan.ru/javaexamples2.
 */
import java.io.File;
import java.io.FileOutputStream;
import java.io.FileReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.PrintWriter;
import com.sun.corba.se.spi.activation.Server;
/**
 * This is a demonstration service. It attempts to do things that may or may not
 * be allowed by the security policy and reports the results of its attempts to
 * the client.
 */
public class SecureService implements Server.Service {
  public void serve(InputStream i, OutputStream o) throws IOException {
    PrintWriter out = new PrintWriter(o);
    // Try to install our own security manager. If we can do this,
    // we can defeat any access control.
    out.println("Trying to create and install a security manager...");
    try {
      System.setSecurityManager(new SecurityManager());
      out.println("Success!");
    } catch (Exception e) {
      out.println("Failed: " + e);
    }
    // Try to make the Server and the Java VM exit.
    // This is a denial of service attack, and it should not succeed!
    out.println();
    out.println("Trying to exit...");
    try {
      System.exit(-1);
    } catch (Exception e) {
      out.println("Failed: " + e);
    }
    // The default system policy allows this property to be read
    out.println();
    out.println("Attempting to find java version...");
    try {
      out.println(System.getProperty("java.version"));
    } catch (Exception e) {
      out.println("Failed: " + e);
    }
    // The default system policy does not allow this property to be read
    out.println();
    out.println("Attempting to find home directory...");
    try {
      out.println(System.getProperty("user.home"));
    } catch (Exception e) {
      out.println("Failed: " + e);
    }
    // Our custom policy explicitly allows this property to be read
    out.println();
    out.println("Attempting to read service.tmp property...");
    try {
      String tmpdir = System.getProperty("service.tmp");
      out.println(tmpdir);
      File dir = new File(tmpdir);
      File f = new File(dir, "testfile");
      // Check whether we"ve been given permission to write files to
      // the tmpdir directory
      out.println();
      out.println("Attempting to write a file in " + tmpdir + "...");
      try {
        new FileOutputStream(f);
        out.println("Opened file for writing: " + f);
      } catch (Exception e) {
        out.println("Failed: " + e);
      }
      // Check whether we"ve been given permission to read files from
      // the tmpdir directory
      out.println();
      out.println("Attempting to read from " + tmpdir + "...");
      try {
        FileReader in = new FileReader(f);
        out.println("Opened file for reading: " + f);
      } catch (Exception e) {
        out.println("Failed: " + e);
      }
    } catch (Exception e) {
      out.println("Failed: " + e);
    }
    // Close the Service sockets
    out.close();
    i.close();
  }
}
/*
//Server.policy
//These lines grant permissions to any code loaded from the directory shown.
//Edit the directory to match the installation on your system.
//On Windows systems, change the forward slashes to double backslashes: "\\".
grant codeBase "file:/home/david/Books/JavaExamples2/Examples" {
   // Allow the server to listen for and accept network connections
   // from any host on any port > 1024
   permission java.net.SocketPermission "*:1024-", "listen,accept";
};
*/