IBM WebSphere V5.0 Security - CGISecurity

To call a piece of trusted code to temporarily enable access to more resourcesthan are available directly to the application the doPrivileged method can beused. It comes handy when for example an application wants to ........The domains, either system or application, can also implement additionalprotection of their internal resources within the domain boundary.Security managementThe security manager defines the outer boundaries of the Java sandbox. Thefact that the security manager is customizable, it allows the security manager toestablilish custom security policies for an application. The concreteSecurityManager provided with the Java version 1.2 allows you to define yourcustom policy not in Java code, but in an ASCII file called the policy file.The security manager is not automatically loaded when an application is running,in order to activate the manager, the user has to specify the-Djava.security.manager command-line argument for the Java runtime.A custom security manager class can be also specified in the command-line:-Djava.security.manager=com.mycompany.MySecurityManager; if nothing isspecified then the default security manager will be initialized for the application.Access controlThe java.security.ProtectionDomain class represents a unit of protection within aJava application environment and is typically associated with a concept ofprincipal.The java.security.AccessController class is used for the following purposes:► To decide whether an access to a critical resource is allowed or denied,based on the security policy currently in effect,► To mark code as being privileged,► To obtain a snapshot of the current calling context to support access-controldecisions from a different context.Any code that controls access to system resources sould invokeAccessControler methods if it wishes to use the specific security model andaccess control algorithm utilized by these methods.Security permissionsThe permission classes represent access to system resources. Thejava.security.Permission class is an abstract class and is subclassed torepresent specific accesses.198 IBM WebSphere V5.0 Security Handbook