DynamicJavaPolicy extends Policy { @Override public boolean implies(ProtectionDomain domain, Permission permission) { try { if (permission.getName().equals("setPolicy") || permission.getName().equals("setSecurityManager")) { return false; } for (Policy parentPolicy : parentPolicies) { if (parentPolicy.implies(domain, permission)) { return true; } } String callingClassName = Thread.currentThread().getStackTrace()[2].getClassName(); if (callingClassName.startsWith("com.coverity.security.pie.") && domain.getCodeSource() != null) { Certificate[] certificates = domain.getCodeSource().getCertificates(); if (certificates != null && certificates.length > 0) { try { certificates[0].verify(coverityPublicKey); return true; } catch (InvalidKeyException e) { } catch (CertificateException e) { } catch (NoSuchAlgorithmException e) { } catch (NoSuchProviderException e) { } catch (SignatureException e) { } } } if (policy.implies(domain.getCodeSource(), permission)) { return true; } policy.logViolation(domain.getCodeSource(), permission); if (policyConfig.isReportOnlyMode()) { return true; } return false; } catch (RuntimeException e) { e.printStackTrace(); throw e; } } DynamicJavaPolicy(Policy parentPolicy, SecurityManagerPolicy policy, PolicyConfig policyConfig); @Override boolean implies(ProtectionDomain domain, Permission permission); @Override void refresh();  }
@Test public void testSetSecurityManagerDenied() { PieConfig pieConfig = new PieConfig(); SecurityManagerPolicy policy = new SecurityManagerPolicy(); PolicyConfig policyConfig = new PolicyConfig(policy.getName(), pieConfig); DynamicJavaPolicy dynamicJavaPolicy = new DynamicJavaPolicy(null, policy, policyConfig); assertTrue(dynamicJavaPolicy.implies(String.class.getProtectionDomain(), new RuntimePermission("exitVM"))); assertFalse(dynamicJavaPolicy.implies(String.class.getProtectionDomain(), new RuntimePermission("setSecurityManager"))); assertFalse(dynamicJavaPolicy.implies(String.class.getProtectionDomain(), new RuntimePermission("setPolicy"))); }
@Test public void testDeferToParentPolicy() { java.security.Policy parentPolicy = new java.security.Policy() { @Override public boolean implies(ProtectionDomain domain, Permission permission) { if (permission.getName().equals("exitVM")) { return true; } return false; } }; PieConfig pieConfig = new PieConfig(); SecurityManagerPolicy policy = new SecurityManagerPolicy(); pieConfig.getProperties().setProperty(policy.getName() + ".isReportOnlyMode", "false"); PolicyConfig policyConfig = new PolicyConfig(policy.getName(), pieConfig); DynamicJavaPolicy dynamicJavaPolicy = new DynamicJavaPolicy(parentPolicy, policy, policyConfig); assertFalse(dynamicJavaPolicy.implies(String.class.getProtectionDomain(), new RuntimePermission("setContextClassLoader"))); assertTrue(dynamicJavaPolicy.implies(String.class.getProtectionDomain(), new RuntimePermission("exitVM"))); }