Practical security in a modular world
summary
A tiny custom application server demonstrates concrete JVM security behavior: a classpath deployment needs explicit policy grants for the demo app and for the server, the ServiceLoader call fails without permissions, and wrapping the lookup in AccessController.doPrivileged fixes discovery while adding a custom ProtocolPermission controls protocol use; modularizing with JDK 9 removes the ServiceLoader permission problem, jlink builds a stripped JDK with only java.util.logging, reflective module export via Module APIs bypasses encapsulation, and policy edits make the demo run.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 1:49Java security sandbox model overview
- 9:17Demo of security manager in action
- 20:56Security in Java 9 module system
- 24:49Modularizing the demo application
- 33:31Permissions for JDK modules
- 38:58OSGi security model comparison
- 43:23Q&A session
related talks
44mJava Code Security
43mSecurity Architecture of the Java Platform
44mSecuring the JVM
48mHidden Security Features of the JVM - Everything You Didn’t Know and More
02h 38mJava application security the hard way - a workshop for the serious developer
59mDecomposing Java applications
50mDecomposing Java applications
47mFrontiers of Access Controls: Modules and Nestmates