* | Permission Name | Permission Allows | Risks
* |
|---|
* createClassLoader |
* creation of a class loader |
* a class loader can load rogue classes which bypass all security
* permissions |
*
* getClassLoader |
* retrieval of the class loader for the calling class |
* rogue code could load classes not otherwise available |
*
* setContextClassLoader |
* allows the setting of the context class loader used by a thread |
* rogue code could change the context class loader needed by system
* threads |
*
* setSecurityManager |
* allows the application to replace the security manager |
* the new manager may be less restrictive, so that rogue code can
* bypass existing security checks |
*
* createSecurityManager |
* allows the application to create a new security manager |
* rogue code can use the new security manager to discover information
* about the execution stack |
*
* exitVM |
* allows the application to halt the virtual machine |
* rogue code can mount a denial-of-service attack by killing the
* virtual machine |
*
* shutdownHooks |
* allows registration and modification of shutdown hooks |
* rogue code can add a hook that interferes with clean
* virtual machine shutdown |
*
* setFactory |
* allows the application to set the socket factory for socket,
* server socket, stream handler, or RMI socket factory. |
* rogue code can create a rogue network object which mangles or
* intercepts data |
*
* setIO |
* allows the application to set System.out, System.in, and
* System.err |
* rogue code could sniff user input and intercept or mangle
* output |
*
* modifyThread |
* allows the application to modify any thread in the virtual machine
* using any of the methods stop, resume,
* suspend, setPriority, and
* setName of classs Thread |
* rogue code could adversely modify system or user threads |
*
* stopThread |
* allows the application to stop any thread it has
* access to in the system |
* rogue code can stop arbitrary threads |
*
* modifyThreadGroup |
* allows the application to modify thread groups using any of the
* methods destroy, resume,
* setDaemon, setMaxPriority,
* stop, and suspend of the class
* ThreadGroup |
* rogue code can mount a denial-of-service attack by changing run
* priorities |
*
* getProtectionDomain |
* retrieve a class's ProtectionDomain |
* rogue code can gain information about the security policy, to
* prepare a better attack |
*
* readFileDescriptor |
* read a file descriptor |
* rogue code can read sensitive information |
*
* writeFileDescriptor |
* write a file descriptor |
* rogue code can write files, including viruses, and can modify the
* virtual machine binary; if not just fill up the disk |
*
* loadLibrary.library name |
* dynamic linking of the named library |
* native code can bypass many security checks of pure Java |
*
* accessClassInPackage.package name |
* access to a package via a ClassLoader |
* rogue code can access classes not normally available |
*
* defineClassInPackage.package name |
* define a class inside a given package |
* rogue code can install rogue classes, including in trusted packages
* like java.security or java.lang |
*
* accessDeclaredMembers |
* access declared class members via reflection |
* rogue code can discover information, invoke methods, or modify fields
* that are not otherwise available |
*
* queuePrintJob |
* initiate a print job |
* rogue code could make a hard copy of sensitive information, or
* simply waste paper |
*
*
* @author Brian Jones
* @author Eric Blake