title: RMISecurityManager sandboxing
body: <p>I wrote a simple RMI server and gave it a default <code>RMISecurityManager</code> with: </p>
  
  <pre><code>System.setSecurityManager (new RMISecurityManager());
  </code></pre>
  
  <p>When I try to run the server it throws an exception:</p>
  
  <blockquote>
    <p><code>java.security.AccessControlException</code>: access denied ("java.net.SocketPermission" "127.0.0.1:1099" "connect,resolve")</p>
  </blockquote>
  
  <p>I thought the security manager would throw an exception if any downloaded code attempted to connect somewhere. But here the security manager is complaining when the server itself tries to do something. Why?</p>
  
  <p>Here's the code for the server (from Oracle RMI tutorial but I added the RMISecurityManager):</p>
  
  <pre><code>package example.hello;
  import java.rmi.registry.Registry;
  import java.rmi.registry.LocateRegistry;
  import java.rmi.RemoteException;
  import java.rmi.server.UnicastRemoteObject;
  import java.rmi.RMISecurityManager;
  
  public class Server implements Hello {
  
  public Server() {}
  
  public String sayHello() {
      return "Hello, world!";
  }
  
  public static void main(String args[]) {
  
      try {
           Server obj = new Server();
  
           // * Addition *
           System.setSecurityManager (new RMISecurityManager());
  
           // Create object that will provide the remote service
           Hello stub = (Hello) UnicastRemoteObject.exportObject(obj, 0);
  
           // Bind the remote object's stub in the registry
           Registry registry = LocateRegistry.getRegistry();
           registry.bind("Hello", stub);
           System.err.println("Server ready");
      } catch (Exception e) {
           System.err.println("Server exception: " + e.toString());
           e.printStackTrace();
      }
  }
  </code></pre>
  
  <p>}</p>
  
  <p>I do this:</p>
  
  <p>$ javac -d classes example/*java</p>
  
  <p>$ java -cp <code>pwd</code>/classes -Djava.rmi.server.codebase=file:<code>pwd</code>/classes/ example.hello.Server</p>
  
  <p>Server exception: java.security.AccessControlException: access denied ("java.net.SocketPermission" "127.0.0.1:1099" "connect,resolve")
  java.security.AccessControlException: access denied ("java.net.SocketPermission" "127.0.0.1:1099" "connect,resolve")
      at java.security.AccessControlContext.checkPermission(AccessControlContext.java:372)
      at java.security.AccessController.checkPermission(AccessController.java:559)
      at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
      at java.lang.SecurityManager.checkConnect(SecurityManager.java:1051)
      at java.net.Socket.connect(Socket.java:574)
      at java.net.Socket.connect(Socket.java:528)
      at java.net.Socket.(Socket.java:425)
      at java.net.Socket.(Socket.java:208)
      at sun.rmi.transport.proxy.RMIDirectSocketFactory.createSocket(RMIDirectSocketFactory.java:40)
      at sun.rmi.transport.proxy.RMIMasterSocketFactory.createSocket(RMIMasterSocketFactory.java:146)
      at sun.rmi.transport.tcp.TCPEndpoint.newSocket(TCPEndpoint.java:613)
      at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:216)
      at sun.rmi.transport.tcp.TCPChannel.newConnection(TCPChannel.java:202)
      at sun.rmi.server.UnicastRef.newCall(UnicastRef.java:340)
      at sun.rmi.registry.RegistryImpl_Stub.bind(Unknown Source)
      at example.hello.Server.main(Server.java:66)</p>
  
  <p>Update:</p>
  
  <p>My understanding of my RMISecurityManager was incorrect. I assumed its sandbox automatically only applied to foreign code i.e. code submitted by clients for execution (as in the "compute engine" example from the Oracle RMI tutorial). Creating the following policy allowed the server to talk to the RMI registry at start-up and the exception disappeared:</p>
  
  <pre><code>grant codeBase "file:/path/to/classes/" {
    permission java.net.SocketPermission "127.0.0.1:1099", "connect, resolve";
  };
  </code></pre>
  
  <p>But how do I use the security manager to create rules specific to downloaded code?</p>