Question

I have a method A which might look like following:

public double A{
  if (secM == null) {
    secM = new SecurityManager();
    System.setSecurityManager(secM);
  }
  //do something and return a double

}

The problem is that once the SecurityManager is set, it is for the entire project, but I only need it to be for the class this method is in.
How can I tell the SecurityManager to only verify the permissions for this method/class?

Answer 1

What actions do you want the SecurityManager to prevent, and which do you want to allow? SecurityManager is more often used to control particular actions by any method, rather than actions by a single method.

However, it can do the latter too, by creating a custom SecurityManager that examines the call stack – see this answer for an example – is this what you need?

You can provide the system-wide SecurityManager with a policy tailored to your application, so you can permit most things but prevent a small set of actions. The permissions you can control are listed here.

Update: you might be able to do this more elegantly by pulling your method out into a separate class, that can be loaded separately (by a different classloader) than your other classes. See this example. Then you can do a trivial check with the classloader rather than checking the full stack trace. However, I’m not familiar with this method – there may be implications if classes from the two separate classloaders need to interact…