Understanding the Java Virtual Machine: Security
by Kevin Jones
This course covers the details of code security explaining how the SecurityManager and the AccessController work together to grant permissions to code in the current call stack. We cover how to grant permissions based on policy and how to create your own permissions and also cover how to limit the stack walk so that privileged code can run.
What you'll learn
Java security is built around the idea of permissions and policy. Code is granted permissions based on the currently in-force policy. In this course, we look at how the security manager and access controller work hand-in-hand to provide this security. The course covers how to set a security manager and how to set up and edit a policy file to grant the levels of permissions that code needs. Permissions are typically based on where code is loaded from but we also look at how to sign code, so that permissions can be based on who created a library. The course also looks at how the AccessController walk the call stack to check that a permission can be granted. While the JRE comes with a set of permissions, these are not always enough so the class covers creating and using your own permissions. Finally we cover the idea of 'privileged scope' which allows code to be granted some permission even when code around them should cause the grant to fail.
About the author
A long time ago in a university far, far away Kevin fell in love with programming. Initially on the university's DEC20 computer doing BASIC and Pascal and a little bit of Fortran. His first job had him writing batch PL/1 on an IBM mainframe where he also discovered the arcane delights of JCL. He soon realized the multiuser systems were not for him after discovering the delights of dBase IV on IBM PCs. From here it was all downhill as he became addicted to C and the Windows API. Just missing out ... moreon coding for Windows 1, he did code for the other 16 bit versions of Windows, 2 and 3, including the various network-ready versions. He still remembers the awkwardness of having to carry an IBM Token Ring MAU with him wherever he went.
After trying to pretend that Windows and C were really object oriented he decided that it would be better to learn C++. It was around this point that he realized that as well as writing code for a living he could be paid for telling people how to write code for a living. He taught Windows, MFC and C++ for a UK training company before his spirit was broken on the back of the OLE support in MFC when he finally stepped away from the nightmare of unmanaged code to the nirvana of the managed runtime called Java.
It was at this time that he spoke at several JavaOne conferences usually on the subject of Servlets, JavaServer Pages and tag libraries. After buying the Sun employees copious amounts of Apple Martini Kevin was invited onto the expert groups for the Servlet and JSP specifications.
Oh, how he laughed when .Net appeared and the same arguments raged about non-deterministic destruction and garbage collection that were now so old hat in the Java world. He finally got his hands dirty in C# and .Net about eight years ago, again working in the web tier and hating every minute of the using the monstrosity that was and is ASP.Net Web Forms. It wasn't until MVC appeared that he finally felt he had come home to Microsoft.
Now of course MVC is so last year and Kevin is focusing more and more on rich clients using JavaScript and tools such as Knockout and AngularJS. He believes that JavaScript is the best thing since, well, JavaScript.
He still retains his passion for developing and teaching; spending about a quarter of the year doing the latter and most of the time doing the former.
When not stuck in front of a computer you can find him: with his nose in a book, a good one preferably, but almost any book would do; watching a film; walking; running; or annoying his wife by watching sports on television.