Does the JVM have features to only execute a white-list of files?

Question

Due to security concerns, I need to find a way to restrict what files the JVM will run. I have about 5 jars that can be run, and nothing else should be able to run on the JVM. This is due to some domain-specific restrictions, where particular permissions have to be assigned to the JVM, but these permissions shouldn't be available to anyone who wants to write and execute a java file.

I feel like there is likely some kind of feature to run only trusted / signed code in the JVM, but I'm having trouble finding any relevant information.

If anyone has any ideas that would be great!

Answer 1

If you don't need to be able to read code from other JARs, you can use a SecurityManager to prevent reading of any other JAR, or loading a class from a directory. You will want to restrict reflections and loading of shared libraries as well to prevent loading of classes manually.

Answer 2

I think it's not that simple... If you don't control user station completly you cannot protect java with SM. For example Primordial classloader loads classes that are not subjected to SM checks and many other verifications... So user can add a lib in bootclasspath that will have all of the privileges.... (For example: classes folder or lib folder in java installation, he can even override java.* package if he owns the jvm)

What you can do is:

• Obfuscate your code
• Use hidden api to your java app (not 'java -jar myapp.jar "/path/to/file/to/encrypt"')

And you are still not 100% secure... all code can be reverse engineered and algorithm and keys extracted, all you can do is make it hard enough that it won't be attractive any more.

EDIT

I think that you may have a big design problem. Namely, if file encryption is user-driven then the user knows the encryption key, and all security remains in that key not your code. Anyone can try to decrypt it but only someone with valid key will be able to. And if that's the case than your code does not need any special treatment.

There is another possiblity that you embedded secret key in your java app... and this key is static in all of your installations, then this key is not secret any more, and it's not encryption but obfuscation.