Re: Further Defenses for the Security Manager

2014-12-19 Thread Jeff Nisewanger
Thank you for contacting us and sharing the initial results of your research. You raised two basic topics. First, you discussed the possibility of adding additional restrictions on the ability to change the system Security Manager multiple times during application execution. This is normally al

Re: A Bug in AccessControlContext.equals() and hashCode()?

2014-07-01 Thread Jeff Nisewanger
On 6/25/2014 9:02 PM, Xiaomin Ding wrote: On 6/16/2014 10:40 PM, David M. Lloyd wrote: On 06/16/2014 09:19 AM, Frank Ding wrote: Hi Jeff, Thanks for your reply. One further question is that you confirmed that two AccessControlContext objects considered equal via method equals() should return

Re: A Bug in AccessControlContext.equals() and hashCode()?

2014-06-12 Thread Jeff Nisewanger
> On Jun 11, 2014, at 11:14 PM, Frank Ding wrote: > My questions are: > 1. Though spec doesn't require two objects with same hashcode are equal, > what's the particular reason that field "DomainCombiner combiner" are used > for equal() but not hashCode()? As you pointed out, the value returne

Re: question about restricted packages

2014-01-27 Thread Jeff Nisewanger
But be aware that this isn't a static list -- applications or middleware can extend it at runtime (generally when they start up). Jeff > On Jan 27, 2014, at 10:34 AM, Chris Hegarty wrote: > > Take a look at the java.security-XXX files in > http://hg.openjdk.java.net/jdk8/jdk8/jdk/file/tip/sr

Re: Code Review Request: JEP 140 Limited doPrivileged

2013-06-04 Thread Jeff Nisewanger
;ll look into that a bit more. checkPermission2 is checking the limited privilege scope. Maybe good to rename it to something like checkLimitedPrivilegeScope to make it explicit. Yes, perhaps. Jeff On 5/28/2013 10:56 PM, Jeff Nisewanger wrote: This is the implementation of the JE

Re: Code Review Request: JEP 140 Limited doPrivileged

2013-06-04 Thread Jeff Nisewanger
On 5/29/2013 5:44 AM, Florian Weimer wrote: On 05/29/2013 07:56 AM, Jeff Nisewanger wrote: The webrev is: http://cr.openjdk.java.net/~jdn/8014097/webrev.0/ The overloads make it cumbersome to use this feature with lambda expressions: http://mail.openjdk.java.net/pipermail/security-dev

Code Review Request: JEP 140 Limited doPrivileged

2013-05-28 Thread Jeff Nisewanger
This is the implementation of the JEP 140 feature for a limited privilege form of doPrivileged(). A test will be added in an updated webrev within the next day. The JEP is: http://openjdk.java.net/jeps/140 The webrev is: http://cr.openjdk.java.net/~jdn/8014097/webrev.0/

Re: Permission Bug in AtomicLongFieldUpdater and AtomicIntegerFieldUpdater

2010-04-22 Thread Jeff Nisewanger
the constructor could have legally accessed the field via static bytecode (assuming the field's declaring class was loadable via the caller's defining class loader). Jeff Jeff Nisewanger said the following on 04/22/10 10:30: On 4/16/2010 5:50 AM, David Holmes wrote: Hi Doug,

Re: Permission Bug in AtomicLongFieldUpdater and AtomicIntegerFieldUpdater

2010-04-21 Thread Jeff Nisewanger
On 4/16/2010 5:50 AM, David Holmes wrote: Hi Doug, approval as I'm not a subscriber.> Doug Lea said the following on 04/16/10 21:43: On 04/15/10 18:34, Martin Buchholz wrote: People are using Atomic field updaters to update fields in classes in other classloaders. I think the policy on

Re: Permission Bug in AtomicLongFieldUpdater and AtomicIntegerFieldUpdater

2010-04-21 Thread Jeff Nisewanger
On 4/19/2010 11:23 AM, Martin Buchholz wrote: Jeff, please review. Yes, will do. I was caught up with other things last week. I will try to go through and catch up with this discussion later today. Jeff