Question

Is there a way to run some java byte-code into a specially restricted part of a running JVM ? I’m thinking about access to very little ram (a few tens of kilobytes perhaps) and no access to the external world whatsoever (apart from that ram).

The goal would be to execute some user provided byte-code into this safe environment in a way that the host cannot ever crash or leak information from the execution of rogue byte-code.

Answer 1

You can run untrusted bytecodes within a security sandbox, and setup the sandbox so that there is no possibility of communicating with the outside world. This is what a browser-resident JVM does when you run an untrusted applet … except that you need the sandbox restrictions to be tighter. (An applet sandbox doesn’t block ALL network connections.)

Reference: How do I create a Java sandbox?

However, it is NOT POSSIBLE to entirely control what the rogue code does. For example, if it decides to go into an infinite loop or allocate a huge data structure, the trusted part of your JVM has no bomb-proof way of stopping it. And if there is a security flaw in the JVM, class libraries or your sandbox, then there’s a chance that the rogue code could exploit it.

---

Note that none of this involves restricting the code to a particular area of RAM. You can’t do that in Java.