Re: question about serialization

[Chris Gray]

On Monday 04 August 2003 11:57, Jeroen Frijters wrote:
> Chris Gray wrote:
> > Granting AllPermission to everything loaded by the system
> > class loader is IMHO acceptable, *iff* by system class
> > loader you mean the class loader which
> > loads java.* classes from a trusted location.
>
> This is the "bootstrap class loader" aka "null class loader" (because
> Object.class.getClassLoader() returns null).

Can be, but doesn't have to be: Sun's documentation allows for the 
possibility that the bootstrap class loader hands over to a regular instance 
of ClassLoader once bootstrapping is complete.

Still, java.lang.Object illustrates the problem nicely: it's not possible to 
be playing with ProtectionDomain and Permissions and all that when you 
haven't even loaded Object yet. :) So the VM has to improvise something, and 
the usual answer is to regard all classes loaded by the bootstrap class loader
as being totally privileged.

Regards

-- 
Chris Gray                                /k/ Embedded Java Solutions
Embedded & Mobile Java, OSGi              http://www.kiffer.be/k/
address@hidden                      +32 477 599 703