Geek Answers Handbook

Is it possible to break the security manager with sun.misc.unsafe?

After talking to another question, an interesting problem arises.

Classes loaded by the security manager are protected by appropriate protection. This security may disable reflection (for example).

Question: Is it possible to split the security manager using sun.misc.unsafe? If so, how?

EDIT

Changed SecuredClassLoader to Security Manager question.

+1
java security classloader
source share
2 answers

Not. The sun.misc.Unsafe class requires access control, like any other privileged action. You can block it using a special classloader or security manager. Here's a simple example with an empty security manager that shows it will AccessControlException :

 System.setSecurityManager(new SecurityManager()); Unsafe unsafe = Unsafe.getUnsafe();
+2
source share

What is a "safe classloader"? SecureClassLoader? It is not safe, despite its name. All he does is limit the loading of classes from class to a specific code location.

Therefore, you do not even need any unsafe operations to “break” it. Just, for example, make sure the new class of the hacked class is on the class path before SecureClassLoader even gets control.

Someone in this thread has already told you - you cannot get a secure place in an unsecured environment. If your code is deployed on the user's computer, the user is god there, and no JVM security will help you simply because the JVM is a tiny layer on top of much more powerful native things.

+1
source share

More articles:


All Articles