1

Following a conversation on another question, an interesting issue is being raised.

Classes loaded with a security manager are protected with the corresponding security. This security could disable reflection (for example).

The question is: is it possible to break a security manager with sun.misc.unsafe? If yes, how?

EDIT

Changed SecuredClassLoader to Security Manager in question.

Community
  • 1
  • 1
Jérôme Verstrynge
  • 57,710
  • 92
  • 283
  • 453

2 Answers2

3

No. The sun.misc.Unsafe class requires an access check just like any other privileged action. You can block it with a custom class loader or security manager. Here's a simple example with an empty security manager that shows it'll throw an AccessControlException:

System.setSecurityManager(new SecurityManager());
Unsafe unsafe = Unsafe.getUnsafe();
WhiteFang34
  • 70,765
  • 18
  • 106
  • 111
  • The guy forgot to mention that the code is executed on end user's (potentially hacker's) machine. I believe it changes the whole game... a bit ;) – Vladimir Dyuzhev Apr 23 '11 at 02:49
  • Yeah, I agree that changes the whole game. I'm just answering this specific question and leaving that other part to the other question :) – WhiteFang34 Apr 23 '11 at 02:58
  • @road to yamburg So, we've established that the situation is not the same when one is running code on a controlled server and a desktop application. – Jérôme Verstrynge Apr 23 '11 at 02:59
1

What is "secure class loader"? SecureClassLoader? It is not secure, despite its name. All it does is limits the class loading source to a specific code location.

Therefore you don't even need any unsafe operations to "break" that. Just, for instance, make sure a replacement hacked class is in the classpath before SecureClassLoader even got the control.

Someone in that thread told you already -- you cannot have a secured spot in unsecured environment. If your code is deployed to a user machine, user is God there, and no JVM security can help you simply because JVM is a tiny layer on top of much more powerful native things.

Vladimir Dyuzhev
  • 18,130
  • 10
  • 48
  • 62