Question

Suppose there’s a java thread, where classes get loaded which are provided by multiple parties. Can those providers specify their own security managers and policies s.t. they can restrict the access among those providers?

Answer 1

You can only have one SecurityManager set as the security manager.

Threads have little to do with security in Java. Objects are passed between threads, so it doesn’t make much sense to use a thread-based access model.

In Java each class gets assigned a ProtectionDomain and hence a set of permissions (these might be in some sense “dynamic” but for most purposes it’s effectively constant). When the security manager is asked to check a permission, it delegates to the AccessController which checks each ProtectionDomain active on the stack (roughly). In practice you need to isolate code from multiple parties, but each party can have its own ProtectionDomain and hence permissions.