Permission controlling access to MBeanServer operations. If a security manager has been set using System#setSecurityManager , most operations on the MBean Server require that the caller's permissions imply an MBeanPermission appropriate for the operation. This is described in detail in the documentation for the MBeanServer interface.
As with other Permission objects, an MBeanPermission can represent either a permission that you have or a permission that you need. When a sensitive operation is being checked for permission, an MBeanPermission is constructed representing the permission you need. The operation is only allowed if the permissions you have imply the permission you need.
An MBeanPermission contains four items of information:
The action. For a permission you need,
this is one of the actions in the list below. For a permission you have, this is
a comma-separated list of those actions, or *,
representing all actions.
The class name.
For a permission you need, this is the class name of an MBean you are accessing, as returned by MBeanServer.getMBeanInfo(name) .getClassName() . Certain operations do not reference a class name, in which case the class name is null.
For a permission you have, this is either empty or a class
name pattern. A class name pattern is a string following the
Java conventions for dot-separated class names. It may end with
".*" meaning that the permission grants access to any
class that begins with the string preceding ".*". For
instance, "javax.management.*" grants access to
javax.management.MBeanServerDelegate and
javax.management.timer.Timer, among other classes.
A class name pattern can also be empty or the single character
"*", both of which grant access to any class.
The member.
For a permission you need, this is the name of the attribute or operation you are accessing. For operations that do not reference an attribute or operation, the member is null.
For a permission you have, this is either the name of an attribute
or operation you can access, or it is empty or the single character
"*", both of which grant access to any member.
The object name.
For a permission you need, this is the ObjectName of the MBean you are accessing. For operations that do not reference a single MBean, it is null. It is never an object name pattern.
For a permission you have, this is the ObjectName of the MBean or MBeans you can access. It may be an object name pattern to grant access to all MBeans whose names match the pattern. It may also be empty, which grants access to all MBeans whatever their name.
If you have an MBeanPermission, it allows operations only if all four of the items match.
The class name, member, and object name can be written together as a single string, which is the name of this permission. The name of the permission is the string returned by getName() . The format of the string is:
className#member[objectName]
The object name is written using the usual syntax for ObjectName
. It may contain any legal characters, including
]. It is terminated by a ] character
that is the last character in the string.
One or more of the className, member,
or objectName may be omitted. If the
member is omitted, the # may be too (but
does not have to be). If the objectName is omitted,
the [] may be too (but does not have to be). It is
not legal to omit all three items, that is to have a name
that is the empty string.
One or more of the className, member,
or objectName may be the character "-",
which is equivalent to a null value. A null value is implied by
any value (including another null value) but does not imply any
other value.
The possible actions are these:
In a comma-separated list of actions, spaces are allowed before and after each action.
Create a new MBeanPermission object with the specified target name and actions.
The target name is of the form
"className#member[objectName]" where each part is
optional. It must not be empty or null.
The actions parameter contains a comma-separated list of the desired actions granted on the target name. It must not be empty or null.
Create a new MBeanPermission object with the specified target name (class name, member, object name) and actions.
The class name, member and object name parameters define a
target name of the form
"className#member[objectName]" where each part is
optional. This will be the result of
on the
resultant MBeanPermission.
The actions parameter contains a comma-separated list of the desired actions granted on the target name. It must not be empty or null.
SecurityManager.checkPermission method is called,
passing this permission object as the permission to check.
Returns silently if access is granted. Otherwise, throws
a SecurityException.java.io.FilePermission,
the name will be a pathname.Checks if this MBeanPermission object "implies" the specified permission.
More specifically, this method returns true if:
If this object's className is "*", p's
className always matches it. If it is "a.*", p's
className matches it if it begins with "a.".
If this object's member is "*", p's
member always matches it.
If this object's objectName n1 is an object name pattern, p's objectName n2 matches it if or if .
A permission that includes the queryMBeans action
is considered to include queryNames as well.
PermissionCollection.implies method is called.
If null is returned,
then the caller of this method is free to store permissions of this
type in any PermissionCollection they choose (one that uses a Hashtable,
one that uses a Vector, etc).wait methods.
The awakened thread will not be able to proceed until the current thread relinquishes the lock on this object. The awakened thread will compete in the usual manner with any other threads that might be actively competing to synchronize on this object; for example, the awakened thread enjoys no reliable privilege or disadvantage in being the next thread to lock this object.
This method should only be called by a thread that is the owner of this object's monitor. A thread becomes the owner of the object's monitor in one of three ways:
synchronized statement
that synchronizes on the object.
Class, by executing a
synchronized static method of that class.
Only one thread at a time can own an object's monitor.
wait methods.
The awakened threads will not be able to proceed until the current thread relinquishes the lock on this object. The awakened threads will compete in the usual manner with any other threads that might be actively competing to synchronize on this object; for example, the awakened threads enjoy no reliable privilege or disadvantage in being the next thread to lock this object.
This method should only be called by a thread that is the owner
of this object's monitor. See the notify method for a
description of the ways in which a thread can become the owner of
a monitor.
The current thread must own this object's monitor. The thread
releases ownership of this monitor and waits until another thread
notifies threads waiting on this object's monitor to wake up
either through a call to the notify method or the
notifyAll method. The thread then waits until it can
re-obtain ownership of the monitor and resumes execution.
As in the one argument version, interrupts and spurious wakeups are possible, and this method should always be used in a loop:
synchronized (obj) {
while (<condition does not hold>)
obj.wait();
... // Perform action appropriate to condition
}
This method should only be called by a thread that is the owner
of this object's monitor. See the notify method for a
description of the ways in which a thread can become the owner of
a monitor.The current thread must own this object's monitor.
This method causes the current thread (call it T) to place itself in the wait set for this object and then to relinquish any and all synchronization claims on this object. Thread T becomes disabled for thread scheduling purposes and lies dormant until one of four things happens:
A thread can also wake up without being notified, interrupted, or timing out, a so-called spurious wakeup. While this will rarely occur in practice, applications must guard against it by testing for the condition that should have caused the thread to be awakened, and continuing to wait if the condition is not satisfied. In other words, waits should always occur in loops, like this one:
synchronized (obj) {
while (<condition does not hold>)
obj.wait(timeout);
... // Perform action appropriate to condition
}
(For more information on this topic, see Section 3.2.3 in Doug Lea's
"Concurrent Programming in Java (Second Edition)" (Addison-Wesley,
2000), or Item 50 in Joshua Bloch's "Effective Java Programming
Language Guide" (Addison-Wesley, 2001).
If the current thread is interrupted by another thread while it is waiting, then an InterruptedException is thrown. This exception is not thrown until the lock status of this object has been restored as described above.
Note that the wait method, as it places the current thread into the wait set for this object, unlocks only this object; any other objects on which the current thread may be synchronized remain locked while the thread waits.
This method should only be called by a thread that is the owner
of this object's monitor. See the notify method for a
description of the ways in which a thread can become the owner of
a monitor.
This method is similar to the wait method of one
argument, but it allows finer control over the amount of time to
wait for a notification before giving up. The amount of real time,
measured in nanoseconds, is given by:
1000000*timeout+nanos
In all other respects, this method does the same thing as the method of one argument. In particular, wait(0, 0) means the same thing as wait(0).
The current thread must own this object's monitor. The thread releases ownership of this monitor and waits until either of the following two conditions has occurred:
notify method
or the notifyAll method.
timeout
milliseconds plus nanos nanoseconds arguments, has
elapsed.
The thread then waits until it can re-obtain ownership of the monitor and resumes execution.
As in the one argument version, interrupts and spurious wakeups are possible, and this method should always be used in a loop:
synchronized (obj) {
while (<condition does not hold>)
obj.wait(timeout, nanos);
... // Perform action appropriate to condition
}
This method should only be called by a thread that is the owner
of this object's monitor. See the notify method for a
description of the ways in which a thread can become the owner of
a monitor.