Monday, May 01, 2006

Java Security Basics

Java Security Series Part 1

Java takes a holistic approach when dealing with security and handles it at two basic levels as shown below

  1. Language construct level
  2. Runtime
Language Syntax Security Features

Building on the problems faced by languages such C/C++, many of the features of these languages are considered unsafe and left out. These features not only feed into the complexity of the language but also are the source for programmer errors. Some of the features that make Java secure are -

  1. Single Implementation Inheritance
  2. Strong Type checking
  3. No support for pointers
  4. Array bounds checking
  5. Other miscellaneous features such as safety against use of uninitialized variables
Because of this, it makes so many lesser options for the programmers to construct blunders. The compiler makes sure that the bytecode generated form the Java source is safe. However, since the actual byte codes are standardized in JVM specifications, for an informed hacker, it should be fairly easy to concoct byte code sequences. However, this situation is taken care of later during the class loading process when the class loaders send the loaded byte codes into the JVM for Byte Code Verification.

Runtime Security Features
The runtime facilities kick in as soon as the JVM is started and made to execute the Java application. Some of key contributors for a secure environment are -

  1. ClassLoaders
  2. ByteCode Verification Process
  3. Security Framework

Class Loaders

When JVM is instructed to start a Java application one of the first things it does is the creation of "System Classloader". This system class loader is then reponsible for loading up the byte code for the application java class file and executing it. There are typically three class loaders that get installed when JVM starts up. These are -

  1. Bootsrtrap Class loader - Since class loaders are themselves classes, we run into the classic chicken-egg problem. Who loads the class loader classes. This is solved by a native. This class loader is also called Null or Primordial class loader. This class loader is responsible for loading the Java system classes from rt.jar in jre/lib directory.
  2. Extensions Class loader - This is the child of Bootstrap class loader is basically a secure URL class loader responsible for loading classes in jre/lib/ext directory.
  3. System Class loader - This is the class loader which is responsible for acting on the CLASSPATH environment variable. It is also a secure URL class loader type and is the child of Extensions class loader. Though it is called System Classloader, it actually loads up application classes.

Class loader instances at runtime have parent child relationship between them with the boot strap class loader being the root parent. Below this class loader the extensions class loader and system class loader form a linear chain. By creating user class loader and then building up hierarchies, a very structured partitioning system can be formed with each class loader forming a node in the tree and all the classes loaded forming the leaves. Same class loaded by different class loader are actually of two different types and hence the partition. Another benefit of this kind of hierarchy is that it allows delegation when trying to load the classes. So, when a class is required to be loaded, by default the system class loader is requested. System class loader first delegates this loading to its parent class loader which is the extensions class loader which in turn delegates to the bootstrap classloader. If bootstrap class loader cannot load the class (because the class is not a system class), then the extensions class loader attempts and even if this fails then does the system class loader attempt to load. If a user classloader is being used, the same logic works here too. If the user class loader is constructed using the default constructor, then the parent is the system class loader, otherwise, the constructor takes in the parent class loader.

The loadClass API is actually in the java.lang.ClassLoader class, and typically it is not overloaded. Its implementation does the following -

  • See if the class is already loaded and is present in the class cache and if present and needed to resolve the class, resolve the class and return.
  • Otherwise, delegate loading to parent class loader.
  • If none of the parent class loaders can load the class, then call findClass. findClass is supposed to locate the actual class data and define the class and return the Class object corresponding to the class.
  • If needed to resolve the class, resolve the class and return.

Typically user class loaders need to only override findClass method. The overridden findClass method should -

  • "find" the raw bytes pertaining to the bytecode of class
  • "define" the class - process of creating a "Class" object for the class from the raw bytecodes and associating a protection domain (security domain of the class - discussed later)

A class object encapsulates the entire RTTI information. My understanding here is that it encapsulates both the Reflection information (means to find the capability of a class) and Introspection information (means to find the type identity of the class such as type name, inheritance structure etc used in instanceof operator). If the same class is loaded by different class loaders, then obviously the RTTI information will not be the same and hence, these will be two different types. Hence, in Java, a type of an object at runtime is determined both by its class and the class loader.

Now, before this class can be used and executed, it needs to be "resolved" - linked - process of taking the Class and including it into the runtime state of the JVM so that it can be executed. Thsi process involves basically three steps -

  • Byte Code Verification - making sure that the byte code does not break any JLS guarentees.
  • Preparation - allocation of all the static storages such as class variables etc and v-table initialization. The static storages allocated are initialized to default values. However, please note that static initializers are not run, as we are still not in a position to execute anything.
  • Symbol resolutions - checking the referred symbols and loading up these classes and interfaces. The JVM specification is not too strict as to when this can happen. The referred symbols can statically resolved right at this point, or more lazily at runtime. The strategy depends on the implementation

Finally before any code can be executed, the class needs to be initialized. This step involves all the static initializations and initializer list and block execution. Any super classes need to be loaded, verfified, prepared, resolved and initialized at this time. An interesting point here is that any interfaces implemented by the class or any super interfaces of the interface need not be initialized. This is because any interface fields are public static final and hence are compile time constant. In any case, the initialization should happen before -

  • T is a class and an instance of T is created.
  • T is a class and a static method declared by T is invoked.
  • A static field declared by T is assigned.
  • A static field declared by T is used and the field is not a constant variable.

After this point, the class is ready for execution.

10 Comments:

Blogger ninest123 Ninest said...

ninest123 10.27
tiffany jewelry, michael kors outlet, oakley sunglasses wholesale, ugg boots, louis vuitton, jordan shoes, nike air max, burberry outlet, uggs outlet, prada outlet, louis vuitton, ugg boots, louis vuitton outlet, michael kors outlet store, ray ban sunglasses, louis vuitton outlet, replica watches, replica watches, uggs outlet, michael kors outlet, polo ralph lauren outlet online, nike free, ray ban sunglasses, oakley sunglasses, christian louboutin outlet, michael kors outlet online, longchamp outlet, louis vuitton outlet, christian louboutin, tiffany and co, prada handbags, cheap oakley sunglasses, polo outlet, longchamp outlet, tory burch outlet, longchamp outlet, nike outlet, oakley sunglasses, oakley sunglasses, ray ban sunglasses, christian louboutin shoes, christian louboutin uk, chanel handbags, uggs on sale, burberry handbags, nike air max, kate spade outlet, michael kors outlet online

9:46 AM  
Blogger ninest123 Ninest said...

hollister uk, nike roshe run uk, sac longchamp pas cher, nike air max uk, north face, vans pas cher, michael kors, kate spade, nike blazer pas cher, longchamp pas cher, ray ban uk, nike free run, abercrombie and fitch uk, louboutin pas cher, coach outlet store online, timberland pas cher, nike roshe, north face uk, polo ralph lauren, oakley pas cher, nike air max, sac vanessa bruno, hollister pas cher, polo lacoste, true religion outlet, ralph lauren uk, nike tn, sac hermes, ray ban pas cher, coach outlet, jordan pas cher, michael kors, coach purses, nike air force, true religion jeans, lululemon canada, michael kors pas cher, mulberry uk, nike air max uk, true religion outlet, burberry pas cher, michael kors outlet, nike free uk, converse pas cher, coach outlet, hogan outlet, new balance, guess pas cher, true religion outlet, air max

9:47 AM  
Blogger ninest123 Ninest said...

bottega veneta, new balance shoes, nike air max, soccer jerseys, louboutin, giuseppe zanotti outlet, lululemon, mac cosmetics, vans, nike trainers uk, vans outlet, abercrombie and fitch, reebok outlet, nike air max, converse, iphone 6 cases, insanity workout, ghd hair, hollister clothing, converse outlet, oakley, nfl jerseys, baseball bats, herve leger, gucci, nike huaraches, mont blanc pens, north face outlet, ferragamo shoes, valentino shoes, north face outlet, p90x workout, longchamp uk, nike roshe run, soccer shoes, wedding dresses, timberland boots, hollister, hermes belt, hollister, ralph lauren, jimmy choo outlet, chi flat iron, asics running shoes, ray ban, instyler, mcm handbags, beats by dre, celine handbags, babyliss, gucci handbags, michael kors outlet online

9:48 AM  
Blogger ninest123 Ninest said...

toms shoes, ugg, ugg uk, moncler, moncler, juicy couture outlet, hollister, ugg,uggs,uggs canada, michael kors outlet online, canada goose outlet, lancel, wedding dresses, moncler outlet, canada goose, swarovski, barbour uk, moncler, canada goose outlet, louis vuitton, ugg,ugg australia,ugg italia, louis vuitton, moncler uk, louis vuitton, ugg pas cher, louis vuitton, montre pas cher, links of london, marc jacobs, barbour, louis vuitton, canada goose uk, michael kors handbags, canada goose outlet, pandora charms, supra shoes, replica watches, canada goose, juicy couture outlet, coach outlet, karen millen uk, moncler outlet, moncler, pandora uk, doudoune moncler, thomas sabo, swarovski crystal, pandora jewelry, canada goose jackets, michael kors outlet, canada goose, doke gabbana, pandora jewelry
ninest123 10.27

9:49 AM  
Blogger 艾丰 said...

jianbin1219
longchamp outlet
true religion sale
true religion outlet
fitflops shoes
fitflops sale
fitflops sale clearance
fitflops sale
fitflops shoes
michael kors outlet
michael kors outlet
michael kors outlet
tiffany and co
tiffany jewellery
beats by dr dre
beats by dre
oakley sunglasses
oakley sunglasses
ray-ban sunglasses
ray ban sunglasses
hollister uk
lululemon outlet
ugg outlet
ugg boots
ugg boots
rolex watches
mulberry handbags
mulberry bags
mulberry outlet
mulberry sale
mulberry handbags
mulberry handbags
louis vuitton handbags
louis vuitton handbags
toms shoes

11:01 AM  
Blogger oakleyses said...

christian louboutin uk, louis vuitton outlet, christian louboutin shoes, michael kors pas cher, louis vuitton outlet, sac longchamp pas cher, prada handbags, gucci handbags, tiffany and co, polo ralph lauren outlet online, christian louboutin outlet, cheap oakley sunglasses, longchamp outlet, uggs on sale, polo outlet, louis vuitton, nike air max, oakley sunglasses, longchamp outlet, nike free, nike outlet, longchamp outlet, longchamp pas cher, chanel handbags, nike air max, oakley sunglasses, nike free run, tiffany jewelry, oakley sunglasses wholesale, louboutin pas cher, ray ban sunglasses, ugg boots, replica watches, air max, louis vuitton outlet, oakley sunglasses, nike roshe, louis vuitton, tory burch outlet, ray ban sunglasses, jordan shoes, christian louboutin, prada outlet, polo ralph lauren, burberry pas cher, ugg boots, jordan pas cher, kate spade outlet, ray ban sunglasses

8:38 AM  
Blogger oakleyses said...

nike blazer pas cher, mulberry uk, burberry handbags, michael kors, timberland pas cher, oakley pas cher, ray ban uk, vans pas cher, coach purses, north face, nike free uk, new balance, ray ban pas cher, sac hermes, michael kors, nike air force, ralph lauren uk, nike air max, kate spade, nike roshe run uk, true religion jeans, north face uk, hogan outlet, michael kors outlet online, nike air max uk, uggs outlet, nike tn, burberry outlet, hollister uk, coach outlet store online, replica handbags, lululemon canada, michael kors outlet online, michael kors outlet online, michael kors outlet, michael kors outlet online, converse pas cher, michael kors outlet, true religion outlet, true religion outlet, polo lacoste, hollister pas cher, coach outlet, guess pas cher, true religion outlet, abercrombie and fitch uk, nike air max uk, sac vanessa bruno, michael kors outlet

8:40 AM  
Blogger oakleyses said...

hollister, oakley, celine handbags, instyler, nike trainers uk, ghd hair, converse outlet, hollister clothing, hermes belt, beats by dre, ray ban, lancel, herve leger, timberland boots, nike air max, chi flat iron, longchamp uk, asics running shoes, vans, nike air max, insanity workout, reebok outlet, giuseppe zanotti outlet, abercrombie and fitch, nike roshe run, north face outlet, louboutin, jimmy choo outlet, iphone cases, gucci, mcm handbags, north face outlet, valentino shoes, soccer shoes, hollister, wedding dresses, babyliss, bottega veneta, baseball bats, p90x workout, nfl jerseys, nike huaraches, new balance shoes, soccer jerseys, mont blanc pens, ralph lauren, vans outlet, mac cosmetics, ferragamo shoes, lululemon

8:43 AM  
Blogger oakleyses said...

hollister, louis vuitton, moncler outlet, pandora uk, moncler, canada goose outlet, ugg,ugg australia,ugg italia, marc jacobs, toms shoes, moncler outlet, louis vuitton, canada goose, swarovski crystal, supra shoes, moncler, ugg, juicy couture outlet, wedding dresses, thomas sabo, karen millen uk, ugg pas cher, canada goose jackets, pandora jewelry, louis vuitton, moncler, swarovski, pandora jewelry, links of london, moncler uk, louis vuitton, coach outlet, ugg uk, canada goose uk, ugg,uggs,uggs canada, canada goose, doudoune moncler, louis vuitton, pandora charms, juicy couture outlet, canada goose outlet, canada goose outlet, canada goose, moncler, replica watches, montre pas cher

8:46 AM  
Blogger Liu Liu said...

Nick Saban’s relatively brief time as head coach of the Miami Dolphins is not looked upon fondly by most fans of the team. He went 15-17 christian louboutin shoes in his two seasons, but basically quit on the nfl jerseys store team in the final weeks Nike Air Max 90 of the 2006 season, focused more on his next job, at the University of Alabama, instead of the one he christian louboutin uk was under contract for.And at least one player who played – or at Christian Louboutin Women Flat least practiced – under Saban during those ill-fated christian louboutin men flat final weeks Nike Roshe Run hasn’t forgotten NFL Jerseys how Nike Free Run he was louboutin outlet treated. According to Nike Air Max 2015 Shoes receiver P.K. Sam, a journeyman cheap nfl jerseys who spent time with five NFL teams as well as two CFL clubs, Saban cut wholesale nfl jerseys him after he left the team christian louboutin Panettone spiked leather wallet briefly to see his dying father

2:54 PM  

Post a Comment

<< Home