@Deprecated(since="17", forRemoval=true) public abstract class Policy extends Object
Policy
object is responsible for determining whether code executing in the Java runtime environment has permission to perform a security-sensitive operation. There is only one Policy
object installed in the runtime at any given time. A Policy
object can be installed by calling the setPolicy
method. The installed Policy
object can be obtained by calling the getPolicy
method.
If no Policy
object has been installed in the runtime, a call to getPolicy
installs an instance of the default Policy
implementation (a default subclass implementation of this abstract class). The default Policy
implementation can be changed by setting the value of the policy.provider
security property to the fully qualified name of the desired Policy
subclass implementation. The system class loader is used to load this class.
Application code can directly subclass Policy
to provide a custom implementation. In addition, an instance of a Policy
object can be constructed by invoking one of the getInstance
factory methods with a standard type. The default policy type is "JavaPolicy".
Once a Policy
instance has been installed (either by default, or by calling setPolicy
), the Java runtime invokes its implies
method when it needs to determine whether executing code (encapsulated in a ProtectionDomain) can perform SecurityManager-protected operations. How a Policy
object retrieves its policy data is up to the Policy
implementation itself. The policy data may be stored, for example, in a flat ASCII file, in a serialized binary file of the Policy
class, or in a database.
The refresh
method causes the policy object to refresh/reload its data. This operation is implementation-dependent. For example, if the policy object stores its data in configuration files, calling refresh
will cause it to re-read the configuration policy files. If a refresh operation is not supported, this method does nothing. Note that refreshed policy may not have an effect on classes in a particular ProtectionDomain. This is dependent on the policy provider's implementation of the implies
method and its PermissionCollection caching strategy.
Modifier and Type | Class | Description |
---|---|---|
static interface |
Policy.Parameters |
Deprecated, for removal: This API element is subject to removal in a future version. This class is only useful in conjunction with the Security Manager, which is deprecated and subject to removal in a future release. |
Modifier and Type | Field | Description |
---|---|---|
static final PermissionCollection |
UNSUPPORTED_EMPTY_COLLECTION |
Deprecated, for removal: This API element is subject to removal in a future version. A read-only empty PermissionCollection instance. |
Constructor | Description |
---|---|
Policy() |
Deprecated, for removal: This API element is subject to removal in a future version. Constructor for subclasses to call. |
Modifier and Type | Method | Description |
---|---|---|
static Policy |
getInstance |
Deprecated, for removal: This API element is subject to removal in a future version. Returns a Policy object of the specified type. |
static Policy |
getInstance |
Deprecated, for removal: This API element is subject to removal in a future version. Returns a Policy object of the specified type. |
static Policy |
getInstance |
Deprecated, for removal: This API element is subject to removal in a future version. Returns a Policy object of the specified type. |
Policy.Parameters |
getParameters() |
Deprecated, for removal: This API element is subject to removal in a future version. Return Policy parameters. |
PermissionCollection |
getPermissions |
Deprecated, for removal: This API element is subject to removal in a future version. Return a PermissionCollection object containing the set of permissions granted to the specified CodeSource. |
PermissionCollection |
getPermissions |
Deprecated, for removal: This API element is subject to removal in a future version. Return a PermissionCollection object containing the set of permissions granted to the specified ProtectionDomain. |
static Policy |
getPolicy() |
Deprecated, for removal: This API element is subject to removal in a future version. Returns the installed Policy object. |
Provider |
getProvider() |
Deprecated, for removal: This API element is subject to removal in a future version. Return the Provider of this policy. |
String |
getType() |
Deprecated, for removal: This API element is subject to removal in a future version. Return the type of this Policy . |
boolean |
implies |
Deprecated, for removal: This API element is subject to removal in a future version. Evaluates the global policy for the permissions granted to the ProtectionDomain and tests whether the permission is granted. |
void |
refresh() |
Deprecated, for removal: This API element is subject to removal in a future version. Refreshes/reloads the policy configuration. |
static void |
setPolicy |
Deprecated, for removal: This API element is subject to removal in a future version. Sets the system-wide Policy object. |
public static final PermissionCollection UNSUPPORTED_EMPTY_COLLECTION
public Policy()
public static Policy getPolicy()
Policy
object. This value should not be cached, as it may be changed by a call to setPolicy
. This method first calls SecurityManager.checkPermission
with a SecurityPermission("getPolicy")
permission to ensure it's ok to get the Policy
object.SecurityException
- if a security manager exists and its checkPermission
method doesn't allow getting the Policy
object.public static void setPolicy(Policy p)
Policy
object. This method first calls SecurityManager.checkPermission
with a SecurityPermission("setPolicy")
permission to ensure it's ok to set the Policy.p
- the new system Policy
object.SecurityException
- if a security manager exists and its checkPermission
method doesn't allow setting the Policy.public static Policy getInstance(String type, Policy.Parameters params) throws NoSuchAlgorithmException
This method traverses the list of registered security providers, starting with the most preferred provider. A new Policy
object encapsulating the PolicySpi
implementation from the first provider that supports the specified type is returned.
Note that the list of registered providers may be retrieved via the Security.getProviders()
method.
jdk.security.provider.preferred
Security
property to determine the preferred provider order for the specified algorithm. This may be different than the order of providers returned by Security.getProviders()
.type
- the specified Policy type. See the Policy section in the Java Security Standard Algorithm Names Specification for a list of standard Policy types.params
- parameters for the Policy
, which may be null
.Policy
objectIllegalArgumentException
- if the specified parameters are not understood by the PolicySpi
implementation from the selected Provider
NoSuchAlgorithmException
- if no Provider
supports a PolicySpi
implementation for the specified typeNullPointerException
- if type
is null
SecurityException
- if the caller does not have permission to get a Policy
instance for the specified type.public static Policy getInstance(String type, Policy.Parameters params, String provider) throws NoSuchProviderException, NoSuchAlgorithmException
Policy
object of the specified type. A new Policy
object encapsulating the PolicySpi
implementation from the specified provider is returned. The specified provider must be registered in the provider list.
Note that the list of registered providers may be retrieved via the Security.getProviders()
method.
type
- the specified Policy type. See the Policy section in the Java Security Standard Algorithm Names Specification for a list of standard Policy types.params
- parameters for the Policy
, which may be null
.provider
- the provider.Policy
objectIllegalArgumentException
- if the specified provider is null
or empty, or if the specified parameters are not understood by the PolicySpi
implementation from the specified providerNoSuchAlgorithmException
- if the specified provider does not support a PolicySpi
implementation for the specified typeNoSuchProviderException
- if the specified provider is not registered in the security provider listNullPointerException
- if type
is null
SecurityException
- if the caller does not have permission to get a Policy
instance for the specified typepublic static Policy getInstance(String type, Policy.Parameters params, Provider provider) throws NoSuchAlgorithmException
Policy
object of the specified type. A new Policy
object encapsulating the PolicySpi
implementation from the specified provider is returned. Note that the specified provider does not have to be registered in the provider list.
type
- the specified Policy type. See the Policy section in the Java Security Standard Algorithm Names Specification for a list of standard Policy types.params
- parameters for the Policy
, which may be null
.provider
- the Provider
.Policy
objectIllegalArgumentException
- if the specified Provider
is null
, or if the specified parameters are not understood by the PolicySpi
implementation from the specified Provider
NoSuchAlgorithmException
- if the specified Provider
does not support a PolicySpi
implementation for the specified typeNullPointerException
- if type
is null
SecurityException
- if the caller does not have permission to get a Policy
instance for the specified typepublic Provider getProvider()
Provider
of this policy. This Policy
instance will only have a provider if it was obtained via a call to Policy.getInstance
. Otherwise this method returns null
.
Provider
of this policy, or null
.public String getType()
Policy
. This Policy
instance will only have a type if it was obtained via a call to Policy.getInstance
. Otherwise this method returns null
.
Policy
, or null
.public Policy.Parameters getParameters()
Policy
parameters. This Policy
instance will only have parameters if it was obtained via a call to Policy.getInstance
. Otherwise this method returns null
.
Policy
parameters, or null
.public PermissionCollection getPermissions(CodeSource codesource)
Applications are discouraged from calling this method since this operation may not be supported by all policy implementations. Applications should solely rely on the implies
method to perform policy checks. If an application absolutely must call a getPermissions method, it should call getPermissions(ProtectionDomain)
.
The default implementation of this method returns Policy.UNSUPPORTED_EMPTY_COLLECTION. This method can be overridden if the policy implementation can return a set of permissions granted to a CodeSource.
codesource
- the CodeSource to which the returned PermissionCollection has been granted.public PermissionCollection getPermissions(ProtectionDomain domain)
Applications are discouraged from calling this method since this operation may not be supported by all policy implementations. Applications should rely on the implies
method to perform policy checks.
The default implementation of this method first retrieves the permissions returned via getPermissions(CodeSource)
(the CodeSource is taken from the specified ProtectionDomain), as well as the permissions located inside the specified ProtectionDomain. All of these permissions are then combined and returned in a new PermissionCollection object. If getPermissions(CodeSource)
returns Policy.UNSUPPORTED_EMPTY_COLLECTION, then this method returns the permissions contained inside the specified ProtectionDomain in a new PermissionCollection object.
This method can be overridden if the policy implementation supports returning a set of permissions granted to a ProtectionDomain.
domain
- the ProtectionDomain to which the returned PermissionCollection has been granted.public boolean implies(ProtectionDomain domain, Permission permission)
domain
- the ProtectionDomain to testpermission
- the Permission object to be tested for implication.true
if "permission" is a proper subset of a permission granted to this ProtectionDomain.public void refresh()
refresh
on a file-based policy will cause the file to be re-read. The default implementation of this method does nothing. This method should be overridden if a refresh operation is supported by the policy implementation.
© 1993, 2023, Oracle and/or its affiliates. All rights reserved.
Documentation extracted from Debian's OpenJDK Development Kit package.
Licensed under the GNU General Public License, version 2, with the Classpath Exception.
Various third party code in OpenJDK is licensed under different licenses (see Debian package).
Java and OpenJDK are trademarks or registered trademarks of Oracle and/or its affiliates.
https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/security/Policy.html