RE: Bypassing security manager checks (was: Re: Infinite loop)

[Jeroen Frijters]

Andrew Haley wrote:
> Gary Benson writes:
>  > Michael Koch wrote:
>  > > On Wed, Nov 16, 2005 at 11:56:37AM +0000, Gary Benson wrote:
>  > > > If your security policy denies read access to that 
> system property
>  > > 
>  > > The solution is to use 
> gnu.classpath.SystemProperties.getProperty(...).
>  > > This does no security check. It is exactly for such issues.
>  > 
>  > Out of interest, what stops user code from calling such things?
>  
> Nothing.  That's one of the bugs on the list.

That's not exactly true. The system class loader does enforce that user
code cannot access classes in protected packages. It's just that we
don't have the proper security configuration files in place to define
the protected packages yet.

Regards,
Jeroen