org.jboss.as.naming

Class JndiPermission

java.lang.Object

java.security.Permission

org.jboss.as.naming.JndiPermission

All Implemented Interfaces:

Serializable, Guard

public final class JndiPermission
extends Permission
implements Serializable

This class represents access to a path in the JNDI tree. A JndiPermission consists of a pathname and a set of actions valid for that pathname.

Pathname is the pathname of the file or directory granted the specified actions. A pathname that ends in "/*" indicates all the files and directories contained in that directory. A pathname that ends with "/-" indicates (recursively) all files and subdirectories contained in that directory. A pathname consisting of the special token "<<ALL BINDINGS>>" matches any file.

The actions to be granted are passed to the constructor in an array of Action instances. The possible actions are "bind", "rebind", "unbind", "lookup", "list", "listBindings", and "createSubcontext". Their meaning is defined as follows:

bind

Context.bind permission

rebind

Context.rebind permission

unbind

Context.unbind permission.

lookup

Context.lookup permission.

list

Context.list permission.

listBindings

Context.listBindings permission.

createSubcontext

Context.createSubcontext permission.

destroySubcontext

Context.destroySubcontext permission.

addNamingListener

EventContext.addNamingListener permission.

Be careful when granting JndiPermissions. Think about the implications of granting read and especially write access to various files and directories. The "<<ALL BINDINGS>>" permission with write action is especially dangerous. This grants permission to write to the entire file system. One thing this effectively allows is replacement of the system binary, including the JVM runtime environment.

Please note: Code can always read a file from the same directory it's in (or a subdirectory of that directory); it does not need explicit permission to do so.

Version:

$Revision: 81310 $

Author:

Marianne Mueller, Roland Schemers, Scott.Stark@jboss.org

See Also:

Permission, Permissions, PermissionCollection

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	JndiPermission.Action

Constructor Summary

Constructors

Constructor and Description
JndiPermission(Name path, JndiPermission.Action... actions)
JndiPermission(String path, JndiPermission.Action... actions) Creates a new JndiPermission object with the specified actions.
JndiPermission(String path, String actions)

Method Summary

Modifier and Type	Method and Description
static void	check(Name name, JndiPermission.Action... actions) A utility method to check if the current access control context possesses the JndiPermission for given JNDI name and actions.
boolean	equals(Object obj) Checks two JndiPermission objects for equality.
String	getActions() Returns the "canonical string representation" of the actions.
int	hashCode() Returns the hash code value for this object.
boolean	implies(Permission p) Checks if this JndiPermission object "implies" the specified permission.
PermissionCollection	newPermissionCollection() Returns a new PermissionCollection object for storing JndiPermission objects.

Methods inherited from class java.security.Permission

checkGuard, getName, toString

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

JndiPermission

public JndiPermission(String path,
                      JndiPermission.Action... actions)

Creates a new JndiPermission object with the specified actions. path is the pathname of a file or directory, and actions contains a comma-separated list of the desired actions granted on the file or directory. Possible actions are "bind", "rebind", "unbind", "lookup", "list", "listBindings", "createSubcontext", "destroySubcontext" and "addNamingListener".

A pathname that ends in "/*" (where "/" is the file separator character, '/') indicates all the files and directories contained in that directory. A pathname that ends with "/-" indicates (recursively) all files and subdirectories contained in that directory. The special pathname "<<ALL BINDINGS>>" matches any file.

A pathname consisting of a single "*" indicates all the files in the current directory, while a pathname consisting of a single "-" indicates all the files in the current directory and (recursively) all files and subdirectories contained in the current directory.

A pathname containing an empty string represents an empty path.

Parameters:

path - the pathname of the file/directory.

actions - the action string.

Throws:

IllegalArgumentException - If actions is null, empty or contains an action other than the specified possible actions.

JndiPermission

public JndiPermission(Name path,
                      JndiPermission.Action... actions)

JndiPermission

public JndiPermission(String path,
                      String actions)

Parameters:

path - the pathname to grant the permission

actions - the comma separated string of actions granted

See Also:

The default policy file parser ({@code sun.security.provider.PolicyFile}) requires this constructor.

Method Detail

check

public static void check(Name name,
                         JndiPermission.Action... actions)

A utility method to check if the current access control context possesses the JndiPermission for given JNDI name and actions.

Parameters:

name - the JNDI name

actions - the actions to check the permission for

implies

public boolean implies(Permission p)

Checks if this JndiPermission object "implies" the specified permission.

More specifically, this method returns true if:

• p is an instanceof JndiPermission,

• p's actions are a proper subset of this object's actions, and

• p's pathname is implied by this object's pathname. For example, "/tmp/*" implies "/tmp/foo", since "/tmp/*" encompasses all files in the "/tmp" directory, including the one named "foo".

Specified by:

implies in class Permission

Parameters:

p - the permission to check against.

Returns:

true if the specified permission is not null and is implied by this object, false otherwise.

equals

public boolean equals(Object obj)

Checks two JndiPermission objects for equality. Checks that obj is a JndiPermission, and has the same pathname and actions as this object.

Specified by:

equals in class Permission

Parameters:

obj - the object we are testing for equality with this object.

Returns:

true if obj is a JndiPermission, and has the same pathname and actions as this JndiPermission object, false otherwise.

hashCode

public int hashCode()

Returns the hash code value for this object.

Specified by:

hashCode in class Permission

Returns:

a hash code value for this object.

getActions

public String getActions()

Returns the "canonical string representation" of the actions. That is, this method always returns present actions in the following order: bind, rebind, unbind, lookup, list, listBindings, createSubcontext. For example, if this JndiPermission object allows both unbind and bind actions, a call to getActions will return the string "bind,unbind".

Specified by:

getActions in class Permission

Returns:

the canonical string representation of the actions.

newPermissionCollection

public PermissionCollection newPermissionCollection()

Returns a new PermissionCollection object for storing JndiPermission objects.

JndiPermission objects must be stored in a manner that allows them to be inserted into the collection in any order, but that also enables the PermissionCollection implies method to be implemented in an efficient (and consistent) manner.

For example, if you have two JndiPermissions:

1. "/tmp/-", "bind"
2. "/tmp/scratch/foo", "unbind"

and you are calling the implies method with the JndiPermission:

   "/tmp/scratch/foo", "bind,unbind",
 

then the implies function must take into account both the "/tmp/-" and "/tmp/scratch/foo" permissions, so the effective permission is "bind,unbind", and implies returns true. The "implies" semantics for JndiPermissions are handled properly by the PermissionCollection object returned by this newPermissionCollection method.

Overrides:

newPermissionCollection in class Permission

Returns:

a new PermissionCollection object suitable for storing JndiPermissions.