org.ocap.application.SecurityPolicyHandler.html Maven / Gradle / Ivy

This interface provides a callback handler to modify the Permissions granted to an application to be launched. An application that has a MonitorAppPermission("security") can have a concrete class that implements this interface and set an instance of it to the AppManagerProxy.

The getAppPermissions(org.ocap.application.PermissionInformation) method shall be called before the OCAP implementation launches any type of application (e.g. before class loading of any OCAP-J application). The application shall then be loaded and started with the set of Permissions that are returned as the return value of this method.

See Also:

AppManagerProxy.setSecurityPolicyHandler(org.ocap.application.SecurityPolicyHandler)

getAppPermissions

java.security.PermissionCollection getAppPermissions(PermissionInformation permissionInfo)

This callback method is used to modify the set of Permissions that is granted to an application to be launched.

The OCAP implementation shall call this method before class loading of any application, if an instance of a class that implements the SecurityPolicyHandler interface is set to the AppManagerProxy. The permissionInfo parameter of this method contains the AppID of the application to be launched and a requested set of Permissions that consists of Permissions requested in a permission request file and Permissions requested for the unsigned application. This method can modify the requested set of Permissions and returns them as the return value. The OCAP implementation shall grant them to the application.

The modified set of Permissions shall be a subset of the requested set of Permissions specified by the permissionInfo parameter, and shall be a superset of the set of the Permissions granted to unsigned applications (as returned by PermissionInformation.getUnsignedAppPermissions()).

Parameters:

permissionInfo - The PermissionInformation that specifies the application to be launched and its requested set of Permissions that are requested in a permission request file and requested for the unsigned application.

Returns:

An instance of a subclass of the java.security.PermissionCollection that contains a modified set of Permissions to be granted to the application specified by the permissionInfo parameter. The modified set of Permissions (i.e., return value) shall be granted to the application. If the modified set of Permissions is not a subset of the requested Permissions, or is not a superset of the set of the Permissions granted to unsigned applications (as returned by PermissionInformation.getUnsignedAppPermissions()), the OCAP implementation shall ignore the returned PermissionCollection and shall grant the requested set of Permissions to the application.